## Automatically generated incremental diff
## From:   linux-2.4.21-rc4
## To:     linux-2.4.21-rc5
## Robot:  $Id: make-incremental-diff,v 1.11 2002/02/20 02:59:33 hpa Exp $

diff -urN linux-2.4.21-rc4/Documentation/Configure.help linux-2.4.21-rc5/Documentation/Configure.help
--- linux-2.4.21-rc4/Documentation/Configure.help	2003-05-27 12:43:43.000000000 -0700
+++ linux-2.4.21-rc5/Documentation/Configure.help	2003-05-27 12:43:57.000000000 -0700
@@ -22892,7 +22892,10 @@
   sysctl and with the "keyboard_sends_linux_keycodes=" kernel
   argument.
 
-  If unsure, say Y here.
+  This option is now deprecated and will be removed in a future
+  kernel release.
+  
+  If unsure, say N here.
 
 I2C/SPI Microcode Patch
 CONFIG_UCODE_PATCH
diff -urN linux-2.4.21-rc4/Makefile linux-2.4.21-rc5/Makefile
--- linux-2.4.21-rc4/Makefile	2003-05-27 12:43:43.000000000 -0700
+++ linux-2.4.21-rc5/Makefile	2003-05-27 12:43:57.000000000 -0700
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 4
 SUBLEVEL = 21
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 
 KERNELRELEASE=$(VERSION).$(PATCHLEVEL).$(SUBLEVEL)$(EXTRAVERSION)
 
diff -urN linux-2.4.21-rc4/arch/x86_64/ia32/ia32_ioctl.c linux-2.4.21-rc5/arch/x86_64/ia32/ia32_ioctl.c
--- linux-2.4.21-rc4/arch/x86_64/ia32/ia32_ioctl.c	2003-05-27 12:43:45.000000000 -0700
+++ linux-2.4.21-rc5/arch/x86_64/ia32/ia32_ioctl.c	2003-05-27 12:43:58.000000000 -0700
@@ -1,4 +1,4 @@
-/* $Id: ia32_ioctl.c,v 1.31 2003/03/21 07:50:07 ak Exp $
+/* $Id: ia32_ioctl.c,v 1.34 2003/05/08 06:34:01 ak Exp $
  * ioctl32.c: Conversion between 32bit and 64bit native ioctls.
  *
  * Copyright (C) 1997-2000  Jakub Jelinek  (jakub@redhat.com)
@@ -594,6 +594,10 @@
 			err = -EFAULT;
 			goto out;
 		}
+		if (len > PAGE_SIZE - sizeof(struct ethtool_regs)) { 
+			err = -EINVAL;
+			goto out;
+		}			
 		len += sizeof(struct ethtool_regs);
 		break;
 	}
@@ -932,6 +936,10 @@
 			err = -EFAULT;
 			goto out;
 		}
+		if (cmap.len > PAGE_SIZE/sizeof(u16)) { 
+			err = -EINVAL;
+			goto out;
+		}
 		err = -ENOMEM;
 		cmap.red = kmalloc(cmap.len * sizeof(__u16), GFP_KERNEL);
 		if (!cmap.red)
@@ -1373,12 +1381,16 @@
 	u32 iov_len;
 } sg_iovec32_t;
 
+#define EMU_SG_MAX 128
+
 static int alloc_sg_iovec(sg_io_hdr_t *sgp, u32 uptr32)
 {
 	sg_iovec32_t *uiov = (sg_iovec32_t *) A(uptr32);
 	sg_iovec_t *kiov;
 	int i;
 
+	if (sgp->iovec_count > EMU_SG_MAX)
+		return -EINVAL;
 	sgp->dxferp = kmalloc(sgp->iovec_count *
 			      sizeof(sg_iovec_t), GFP_KERNEL);
 	if (!sgp->dxferp)
@@ -1392,39 +1404,9 @@
 		if (__get_user(iov_base32, &uiov->iov_base) ||
 		    __get_user(kiov->iov_len, &uiov->iov_len))
 			return -EFAULT;
-
-		kiov->iov_base = kmalloc(kiov->iov_len, GFP_KERNEL);
-		if (!kiov->iov_base)
-			return -ENOMEM;
-		if (copy_from_user(kiov->iov_base,
-				   (void *) A(iov_base32),
-				   kiov->iov_len))
+		if (verify_area(VERIFY_WRITE, (void *)A(iov_base32), kiov->iov_len))
 			return -EFAULT;
-
-		uiov++;
-		kiov++;
-	}
-
-	return 0;
-}
-
-static int copy_back_sg_iovec(sg_io_hdr_t *sgp, u32 uptr32)
-{
-	sg_iovec32_t *uiov = (sg_iovec32_t *) A(uptr32);
-	sg_iovec_t *kiov = (sg_iovec_t *) sgp->dxferp;
-	int i;
-
-	for (i = 0; i < sgp->iovec_count; i++) {
-		u32 iov_base32;
-
-		if (__get_user(iov_base32, &uiov->iov_base))
-			return -EFAULT;
-
-		if (copy_to_user((void *) A(iov_base32),
-				 kiov->iov_base,
-				 kiov->iov_len))
-			return -EFAULT;
-
+		kiov->iov_base = (void *)A(iov_base32);
 		uiov++;
 		kiov++;
 	}
@@ -1434,16 +1416,6 @@
 
 static void free_sg_iovec(sg_io_hdr_t *sgp)
 {
-	sg_iovec_t *kiov = (sg_iovec_t *) sgp->dxferp;
-	int i;
-
-	for (i = 0; i < sgp->iovec_count; i++) {
-		if (kiov->iov_base) {
-			kfree(kiov->iov_base);
-			kiov->iov_base = NULL;
-		}
-		kiov++;
-	}
 	kfree(sgp->dxferp);
 	sgp->dxferp = NULL;
 }
@@ -1472,6 +1444,7 @@
 	sg_io64.sbp = NULL;
 
 	err |= __get_user(cmdp32, &sg_io32->cmdp);
+
 	sg_io64.cmdp = kmalloc(sg_io64.cmd_len, GFP_KERNEL);
 	if (!sg_io64.cmdp) {
 		err = -ENOMEM;
@@ -1506,17 +1479,11 @@
 			goto out;
 		}
 	} else {
-		sg_io64.dxferp = kmalloc(sg_io64.dxfer_len, GFP_KERNEL);
-		if (!sg_io64.dxferp) {
-			err = -ENOMEM;
-			goto out;
-		}
-		if (copy_from_user(sg_io64.dxferp,
-				   (void *) A(dxferp32),
-				   sg_io64.dxfer_len)) {
-			err = -EFAULT;
+		err = verify_area(VERIFY_WRITE, (void *)A(dxferp32), sg_io64.dxfer_len);
+		if (err) 
 			goto out;
-		}
+
+		sg_io64.dxferp = A(dxferp32); 
 	}
 
 	/* Unused internally, do not even bother to copy it over. */
@@ -1544,14 +1511,6 @@
 	err |= __put_user(sg_io64.duration, &sg_io32->duration);
 	err |= __put_user(sg_io64.info, &sg_io32->info);
 	err |= copy_to_user((void *)A(sbp32), sg_io64.sbp, sg_io64.mx_sb_len);
-	if (sg_io64.dxferp) {
-		if (sg_io64.iovec_count)
-			err |= copy_back_sg_iovec(&sg_io64, dxferp32);
-		else
-			err |= copy_to_user((void *)A(dxferp32),
-					    sg_io64.dxferp,
-					    sg_io64.dxfer_len);
-	}
 	if (err)
 		err = -EFAULT;
 
@@ -1560,13 +1519,8 @@
 		kfree(sg_io64.cmdp);
 	if (sg_io64.sbp)
 		kfree(sg_io64.sbp);
-	if (sg_io64.dxferp) {
-		if (sg_io64.iovec_count) {
+	if (sg_io64.dxferp && sg_io64.iovec_count)
 			free_sg_iovec(&sg_io64);
-		} else {
-			kfree(sg_io64.dxferp);
-		}
-	}
 	return err;
 }
 
@@ -1636,6 +1590,8 @@
 	case PPPIOCSCOMPRESS32:
 		if (copy_from_user(&data32, (struct ppp_option_data32 *)arg, sizeof(struct ppp_option_data32)))
 			return -EFAULT;
+		if (data32.length > PAGE_SIZE) 
+			return -EINVAL;
 		data.ptr = kmalloc (data32.length, GFP_KERNEL);
 		if (!data.ptr)
 			return -ENOMEM;
@@ -1832,7 +1788,6 @@
 	struct cdrom_read_audio cdreadaudio;
 	struct cdrom_generic_command cgc;
 	__kernel_caddr_t32 addr;
-	char *data = 0;
 	void *karg;
 	int err = 0;
 
@@ -1847,10 +1802,9 @@
 		err |= __get_user(cdread.cdread_buflen, &((struct cdrom_read32 *)arg)->cdread_buflen);
 		if (err)
 			return -EFAULT;
-		data = kmalloc(cdread.cdread_buflen, GFP_KERNEL);
-		if (!data)
-			return -ENOMEM;
-		cdread.cdread_bufaddr = data;
+		if (verify_area(VERIFY_WRITE, (void *)A(addr), cdread.cdread_buflen))
+			return -EFAULT;
+		cdread.cdread_bufaddr = (void *)A(addr);
 		break;
 	case CDROMREADAUDIO:
 		karg = &cdreadaudio;
@@ -1860,10 +1814,11 @@
 		err |= __get_user(addr, &((struct cdrom_read_audio32 *)arg)->buf);
 		if (err)
 			return -EFAULT;
-		data = kmalloc(cdreadaudio.nframes * 2352, GFP_KERNEL);
-		if (!data)
-			return -ENOMEM;
-		cdreadaudio.buf = data;
+		
+
+		if (verify_area(VERIFY_WRITE, (void *)A(addr), cdreadaudio.nframes*2352))
+			return -EFAULT;
+		cdreadaudio.buf = (void *)A(addr);
 		break;
 	case CDROM_SEND_PACKET:
 		karg = &cgc;
@@ -1872,9 +1827,9 @@
 		err |= __get_user(cgc.buflen, &((struct cdrom_generic_command32 *)arg)->buflen);
 		if (err)
 			return -EFAULT;
-		if ((data = kmalloc(cgc.buflen, GFP_KERNEL)) == NULL)
-			return -ENOMEM;
-		cgc.buffer = data;
+		if (verify_area(VERIFY_WRITE, (void *)A(addr), cgc.buflen))
+			return -EFAULT;
+		cgc.buffer = (void *)A(addr);
 		break;
 	default:
 		do {
@@ -1889,26 +1844,6 @@
 	set_fs (KERNEL_DS);
 	err = sys_ioctl (fd, cmd, (unsigned long)karg);
 	set_fs (old_fs);
-	if (err)
-		goto out;
-	switch (cmd) {
-	case CDROMREADMODE2:
-	case CDROMREADMODE1:
-	case CDROMREADRAW:
-	case CDROMREADCOOKED:
-		err = copy_to_user((char *)A(addr), data, cdread.cdread_buflen);
-		break;
-	case CDROMREADAUDIO:
-		err = copy_to_user((char *)A(addr), data, cdreadaudio.nframes * 2352);
-		break;
-	case CDROM_SEND_PACKET:
-		err = copy_to_user((char *)A(addr), data, cgc.buflen);
-		break;
-	default:
-		break;
-	}
-out:	if (data)
-		kfree(data);
 	return err ? -EFAULT : 0;
 }
 
@@ -1939,6 +1874,7 @@
 		err |= __get_user(l.lo_device, &((struct loop_info32 *)arg)->lo_device);
 		err |= __get_user(l.lo_inode, &((struct loop_info32 *)arg)->lo_inode);
 		err |= __get_user(l.lo_rdevice, &((struct loop_info32 *)arg)->lo_rdevice);
+		
 		err |= __copy_from_user((char *)&l.lo_offset, (char *)&((struct loop_info32 *)arg)->lo_offset,
 					   8 + (unsigned long)l.lo_init - (unsigned long)&l.lo_offset);
 		if (err) {
@@ -2198,38 +2134,17 @@
 	if (iobuf32.buffer == (__kernel_caddr_t32) NULL || iobuf32.length == 0) {
 		iobuf.buffer = (void*)(unsigned long)iobuf32.buffer;
 	} else {
-		iobuf.buffer = kmalloc(iobuf.length, GFP_KERNEL);
-		if (iobuf.buffer == NULL) {
-			err = -ENOMEM;
-			goto out;
-		}
-
-		err = copy_from_user(iobuf.buffer, A(iobuf32.buffer), iobuf.length);
-		if (err) {
-			err = -EFAULT;
-			goto out;
-		}
+		iobuf.buffer = A(iobuf32.buffer);
+		if (verify_area(VERIFY_WRITE, iobuf.buffer, iobuf.length))
+			return -EINVAL;
 	}
 
 	old_fs = get_fs(); set_fs (KERNEL_DS);
 	err = sys_ioctl (fd, cmd, (unsigned long)&iobuf);      
 	set_fs (old_fs);
-        if(err)
-		goto out;
-
-        if(iobuf.buffer && iobuf.length > 0) {
-		err = copy_to_user(A(iobuf32.buffer), iobuf.buffer, iobuf.length);
-		if (err) {
-			err = -EFAULT;
-			goto out;
-		}
-	}
+        if(!err)
 	err = __put_user(iobuf.length, &(((struct atm_iobuf32*)arg)->length));
 
- out:
-        if(iobuf32.buffer && iobuf32.length > 0)
-		kfree(iobuf.buffer);
-
 	return err;
 }
 
@@ -2252,39 +2167,16 @@
 	if (sioc32.arg == (__kernel_caddr_t32) NULL || sioc32.length == 0) {
 		sioc.arg = (void*)(unsigned long)sioc32.arg;
         } else {
-                sioc.arg = kmalloc(sioc.length, GFP_KERNEL);
-                if (sioc.arg == NULL) {
-                        err = -ENOMEM;
-			goto out;
-		}
-                
-                err = copy_from_user(sioc.arg, A(sioc32.arg), sioc32.length);
-                if (err) {
-                        err = -EFAULT;
-                        goto out;
-                }
+		sioc.arg = A(sioc32.arg);
+		if (verify_area(VERIFY_WRITE, sioc.arg, sioc32.length))
+			return -EFAULT;
         }
         
         old_fs = get_fs(); set_fs (KERNEL_DS);
         err = sys_ioctl (fd, cmd, (unsigned long)&sioc);	
         set_fs (old_fs);
-        if(err) {
-                goto out;
-	}
-        
-        if(sioc.arg && sioc.length > 0) {
-                err = copy_to_user(A(sioc32.arg), sioc.arg, sioc.length);
-                if (err) {
-                        err = -EFAULT;
-                        goto out;
-                }
-        }
+	if (!err)
         err = __put_user(sioc.length, &(((struct atmif_sioc32*)arg)->length));
-        
- out:
-        if(sioc32.arg && sioc32.length > 0)
-		kfree(sioc.arg);
-        
 	return err;
 }
 
@@ -2500,12 +2392,24 @@
 		return NULL;
 	}
 	if (ptr1) {
+		if (l->lv_allocated_le > 2*PAGE_SIZE/sizeof(pe_t)) { 
+			kfree(l);
+			*errp = -EINVAL;
+			return NULL;
+		}
 		size = l->lv_allocated_le * sizeof(pe_t);
 		l->lv_current_pe = vmalloc(size);
 		if (l->lv_current_pe)
 			err = copy_from_user(l->lv_current_pe, (void *)A(ptr1), size);
 	}
 	if (!err && ptr2) {
+		/* small limit */
+		/* just verify area it? */
+		if (l->lv_remap_end > 256*PAGE_SIZE/sizeof(lv_block_exception_t)) { 
+			put_lv_t(l);
+			*errp = -EINVAL;
+			return NULL;
+		}
 		size = l->lv_remap_end * sizeof(lv_block_exception_t);
 		l->lv_block_exception = lbe = vmalloc(size);
 		if (l->lv_block_exception) {
@@ -3369,17 +3273,11 @@
 		goto out;
 	uptr = (void *) A(udata);
 
-	err = -ENOMEM;
 	buflen = kurb->buffer_length;
-	kptr = kmalloc(buflen, GFP_KERNEL);
-	if (!kptr)
+	err = verify_area(VERIFY_WRITE, uptr, buflen);
+	if (err) 
 		goto out;
 
-	kurb->buffer = kptr;
-
-	err = -EFAULT;
-	if (copy_from_user(kptr, uptr, buflen))
-		goto out_kptr;
 
 	old_fs = get_fs();
 	set_fs(KERNEL_DS);
@@ -3390,15 +3288,9 @@
 		/* XXX Shit, this doesn't work for async URBs :-( XXX */
 		if (put_urb32(kurb, uurb)) {
 			err = -EFAULT;
-		} else if ((kurb->endpoint & USB_DIR_IN) != 0) {
-			if (copy_to_user(uptr, kptr, buflen))
-				err = -EFAULT;
 		}
 	}
 
-out_kptr:
-	kfree(kptr);
-
 out:
 	kfree(kurb);
 	return err;
@@ -3476,7 +3368,6 @@
 	struct mtd_oob_buf32	*uarg 	= (struct mtd_oob_buf32 *)arg;
 	struct mtd_oob_buf		karg;
 	u32 tmp;
-	char *ptr;
 	int ret;
 
 	if (get_user(karg.start, &uarg->start) 		||
@@ -3484,18 +3375,9 @@
 	    get_user(tmp, &uarg->ptr))
 		return -EFAULT;
 
-	ptr = (char *)A(tmp);
-	if (0 >= karg.length) 
-		return -EINVAL;
-
-	karg.ptr = kmalloc(karg.length, GFP_KERNEL);
-	if (NULL == karg.ptr)
-		return -ENOMEM;
-
-	if (copy_from_user(karg.ptr, ptr, karg.length)) {
-		kfree(karg.ptr);
+	karg.ptr = A(tmp); 
+	if (verify_area(VERIFY_WRITE, karg.ptr, karg.length))
 		return -EFAULT;
-	}
 
 	set_fs(KERNEL_DS);
 	if (MEMREADOOB32 == cmd) 
@@ -3507,13 +3389,11 @@
 	set_fs(old_fs);
 
 	if (0 == ret && cmd == MEMREADOOB32) {
-		ret = copy_to_user(ptr, karg.ptr, karg.length);
-		ret |= put_user(karg.start, &uarg->start);
+		ret = put_user(karg.start, &uarg->start);
 		ret |= put_user(karg.length, &uarg->length);
 	}
 
-	kfree(karg.ptr);
-	return ((0 == ret) ? 0 : -EFAULT);
+	return ret;
 }	
 
 /* /proc/mtrr ioctls */
diff -urN linux-2.4.21-rc4/arch/x86_64/ia32/socket32.c linux-2.4.21-rc5/arch/x86_64/ia32/socket32.c
--- linux-2.4.21-rc4/arch/x86_64/ia32/socket32.c	2003-05-27 12:43:45.000000000 -0700
+++ linux-2.4.21-rc5/arch/x86_64/ia32/socket32.c	2003-05-27 12:43:58.000000000 -0700
@@ -97,6 +97,8 @@
 		kern_msg->msg_name = NULL;
 
 	if(kern_msg->msg_iovlen > UIO_FASTIOV) {
+		if (kern_msg->msg_iovlen > (2*PAGE_SIZE)/ sizeof(struct iovec))
+			return -EINVAL; 
 		kern_iov = kmalloc(kern_msg->msg_iovlen * sizeof(struct iovec),
 				   GFP_KERNEL);
 		if(!kern_iov)
@@ -140,6 +142,8 @@
 		if((unsigned long)(((char *)ucmsg - (char *)kmsg->msg_control)
 				   + ucmlen) > kmsg->msg_controllen)
 			return -EINVAL;
+		if (kmsg->msg_controllen > 65536) 
+			return -EINVAL;
 
 		tmp = ((ucmlen - CMSG32_ALIGN(sizeof(*ucmsg))) +
 		       CMSG_ALIGN(sizeof(struct cmsghdr)));
@@ -499,7 +503,6 @@
 		__u32 filter;
 	} *fprog32 = (struct sock_fprog32 *)optval;
 	struct sock_fprog kfprog;
-	struct sock_filter *kfilter;
 	unsigned int fsize;
 	mm_segment_t old_fs;
 	__u32 uptr;
@@ -510,18 +513,9 @@
 		return -EFAULT;
 
 	kfprog.filter = (struct sock_filter *)A(uptr);
-	fsize = kfprog.len * sizeof(struct sock_filter);
-
-	kfilter = (struct sock_filter *)kmalloc(fsize, GFP_KERNEL);
-	if (kfilter == NULL)
-		return -ENOMEM;
 
-	if (copy_from_user(kfilter, kfprog.filter, fsize)) {
-		kfree(kfilter);
+	if (verify_area(VERIFY_WRITE, kfprog.filter, kfprog.len*sizeof(struct sock_filter)))
 		return -EFAULT;
-	}
-
-	kfprog.filter = kfilter;
 
 	old_fs = get_fs();
 	set_fs(KERNEL_DS);
@@ -529,8 +523,6 @@
 			     (char *)&kfprog, sizeof(kfprog));
 	set_fs(old_fs);
 
-	kfree(kfilter);
-
 	return ret;
 }
 
diff -urN linux-2.4.21-rc4/arch/x86_64/kernel/entry.S linux-2.4.21-rc5/arch/x86_64/kernel/entry.S
--- linux-2.4.21-rc4/arch/x86_64/kernel/entry.S	2003-05-27 12:43:45.000000000 -0700
+++ linux-2.4.21-rc5/arch/x86_64/kernel/entry.S	2003-05-27 12:43:58.000000000 -0700
@@ -5,7 +5,7 @@
  *  Copyright (C) 2000, 2001, 2002  Andi Kleen SuSE Labs
  *  Copyright (C) 2000  Pavel Machek <pavel@suse.cz>
  * 
- *  $Id: entry.S,v 1.95 2003/04/03 09:46:54 ak Exp $		
+ *  $Id: entry.S,v 1.98 2003/05/12 14:39:00 ak Exp $		
  */
 
 /*
@@ -454,10 +454,10 @@
 	pushq %r11
 	cld
 	SAVE_REST
+	xorl %r15d,%r15d	
 	testl $3,CS(%rsp)
 	je error_kernelspace
 	swapgs	
-	movl $1,%r15d	
 error_action:
 	movq  %rdi,RDI(%rsp) 	
 	movq %rsp,%rdi
@@ -467,7 +467,7 @@
 	/* r15d: swapgs flag */
 error_exit:
 	testl %r15d,%r15d
-	jz   error_restore
+	jnz   error_restore
 error_test:		
 	cli	
 	GET_CURRENT(%rcx)
@@ -482,15 +482,11 @@
 	jmp retint_restore_args
 	
 error_reschedule:
-	cmpl $2,%r15d
-	je  error_restore_swapgs
 	sti
 	call schedule
 	jmp  error_test
 
 error_signal:	
-	cmpl $2,%r15d
-	je  error_restore_swapgs	
 	sti
 	xorq %rsi,%rsi
 	movq %rsp,%rdi
@@ -505,15 +501,16 @@
 	jmp  error_signal_test
 	
 error_kernelspace:	
-	xorl %r15d,%r15d
+	incl %r15d
 	/* There are two places in the kernel that can potentially fault with
 	   usergs. Handle them here. */	   
 	cmpq $iret_label,RIP(%rsp)
 	je   1f
 	cmpq $gs_change,RIP(%rsp)
 	jne  error_action
-1:	movl $2,%r15d
-	swapgs
+	/* iret_label and gs_change are handled by exception handlers
+	   and the exit points run with kernelgs again */
+1:	swapgs
 	jmp error_action
 
 	/* Reload gs selector with exception handling */
@@ -524,7 +521,7 @@
 	swapgs
 gs_change:	
 	movl %edi,%gs	
-2:	mfence
+2:	mfence		/* workaround for opteron errata #88 */
 	swapgs
 	popf
 	ret
@@ -535,6 +532,7 @@
 	.previous
 
 bad_gs:
+	swapgs
 	xorl %eax,%eax
 	movl %eax,%gs
 	jmp 2b
@@ -630,15 +628,15 @@
 	testl $3,CS(%rsp)
 	jz 1f
 	swapgs 
-	movl $1,%r15d
-1:	
-	movq  %cr0,%rax
+2:	movq  %cr0,%rax
 	leaq  math_state_restore(%rip),%rcx
 	leaq  math_emulate(%rip),%rbx
 	testl $0x4,%eax
 	cmoveq %rcx,%rbx
 	call  *%rbx
 	jmp  error_exit
+1:	incl %r15d
+	jmp  2b
 
 ENTRY(debug)
 	zeroentry do_debug
diff -urN linux-2.4.21-rc4/arch/x86_64/lib/csum-copy.S linux-2.4.21-rc5/arch/x86_64/lib/csum-copy.S
--- linux-2.4.21-rc4/arch/x86_64/lib/csum-copy.S	2003-05-27 12:43:45.000000000 -0700
+++ linux-2.4.21-rc5/arch/x86_64/lib/csum-copy.S	2003-05-27 12:43:58.000000000 -0700
@@ -44,34 +44,43 @@
 	.previous
 	.endm
 			
+	.macro ignore L=.Lignore
+30:
+	.section __ex_table,"a"
+	.align 8
+	.quad 30b,\L
+	.previous
+	.endm
+	
+				
 	.globl csum_partial_copy_generic
 	.p2align 4
 csum_partial_copy_generic:
 	cmpl	 $3*64,%edx
-	jle	 1f
+	jle	 .Lignore
 
-	source
+	ignore
 	prefetch (%rdi)
-	source
+	ignore
 	prefetch 1*64(%rdi)
-	source
+	ignore
 	prefetch 2*64(%rdi)
-	source
+	ignore
 	prefetch 3*64(%rdi)
-	source
+	ignore
 	prefetch 4*64(%rdi)
-	dest
+	ignore
 	prefetchw (%rsi)
-	dest
+	ignore
 	prefetchw 1*64(%rsi)
-	dest
+	ignore
 	prefetchw 2*64(%rsi)
-	dest
+	ignore
 	prefetchw 3*64(%rsi)
-	dest
+	ignore
 	prefetchw 4*64(%rsi)
 
-1:			
+.Lignore:		
 	subq  $7*8,%rsp
 	movq  %rbx,2*8(%rsp)
 	movq  %r12,3*8(%rsp)
@@ -117,9 +126,9 @@
 	source
 	movq  56(%rdi),%r13
 		
-	source
+	ignore 2f
 	prefetch 5*64(%rdi)
-						
+2:							
 	adcq  %rbx,%rax
 	adcq  %r8,%rax
 	adcq  %r11,%rax
@@ -149,8 +158,9 @@
 	dest
 	movq %r13,56(%rsi)
 	
-	dest
+	ignore 3f
 	prefetchw 5*64(%rsi)
+3:
 	
 	leaq 64(%rdi),%rdi
 	leaq 64(%rsi),%rsi
diff -urN linux-2.4.21-rc4/drivers/ide/Config.in linux-2.4.21-rc5/drivers/ide/Config.in
--- linux-2.4.21-rc4/drivers/ide/Config.in	2003-05-27 12:43:46.000000000 -0700
+++ linux-2.4.21-rc5/drivers/ide/Config.in	2003-05-27 12:43:58.000000000 -0700
@@ -65,10 +65,9 @@
 	    dep_tristate '    PROMISE PDC202{46|62|65|67} support' CONFIG_BLK_DEV_PDC202XX_OLD $CONFIG_BLK_DEV_IDEDMA_PCI
 	    dep_bool     '      Special UDMA Feature' CONFIG_PDC202XX_BURST $CONFIG_BLK_DEV_PDC202XX_OLD $CONFI_BLK_DEV_IDEDMA_PCI
 	    dep_tristate '    PROMISE PDC202{68|69|70|71|75|76|77} support' CONFIG_BLK_DEV_PDC202XX_NEW $CONFIG_BLK_DEV_IDEDMA_PCI
-		# FIXME - probably wants to be one for old and for new
-if [ "$CONFIG_BLK_DEV_PDC202XX_OLD" = "y" -o "$CONFIG_BLK_DEV_PDC202XX_OLD" = "m" -o "$CONFIG_BLK_DEV_PDC202XX_NEW" = "y" -o "$CONFIG_BLK_DEV_PDC202XX_NEW" = "m" ]; then
-	    bool     '    Special FastTrak Feature' CONFIG_PDC202XX_FORCE
-fi
+	    if [ "$CONFIG_BLK_DEV_PDC202XX_OLD" = "y" -o "$CONFIG_BLK_DEV_PDC202XX_OLD" = "m" -o "$CONFIG_BLK_DEV_PDC202XX_NEW" = "y" -o "$CONFIG_BLK_DEV_PDC202XX_NEW" = "m" ]; then
+	        bool     '    Special FastTrak Feature' CONFIG_PDC202XX_FORCE
+	    fi
 	    dep_tristate '    RZ1000 chipset bugfix/support' CONFIG_BLK_DEV_RZ1000 $CONFIG_X86
 	    dep_tristate '    SCx200 chipset support' CONFIG_BLK_DEV_SC1200 $CONFIG_BLK_DEV_IDEDMA_PCI
 	    dep_tristate '    ServerWorks OSB4/CSB5/CSB6 chipsets support' CONFIG_BLK_DEV_SVWKS $CONFIG_BLK_DEV_IDEDMA_PCI
diff -urN linux-2.4.21-rc4/drivers/ide/ide-dma.c linux-2.4.21-rc5/drivers/ide/ide-dma.c
--- linux-2.4.21-rc4/drivers/ide/ide-dma.c	2003-05-27 12:43:46.000000000 -0700
+++ linux-2.4.21-rc5/drivers/ide/ide-dma.c	2003-05-27 12:43:58.000000000 -0700
@@ -1,8 +1,10 @@
 /*
- *  linux/drivers/ide/ide-dma.c		Version 4.10	June 9, 2000
+ *  linux/drivers/ide/ide-dma.c		Version 4.13	May 21, 2003
  *
  *  Copyright (c) 1999-2000	Andre Hedrick <andre@linux-ide.org>
  *  May be copied or modified under the terms of the GNU General Public License
+ *
+ *  Portions Copyright Red Hat 2003
  */
 
 /*
@@ -1015,6 +1017,9 @@
 		return 1;
 
 	ide_release_dma_engine(hwif);
+	
+	if (hwif->mmio==2)
+		return 1;
 	if (hwif->mmio)
 		return ide_release_mmio_dma(hwif);
 	return ide_release_iomio_dma(hwif);
@@ -1040,6 +1045,24 @@
 	return 1;
 }
 
+int ide_mapped_mmio_dma (ide_hwif_t *hwif, unsigned long base, unsigned int ports)
+{
+	printk(KERN_INFO "    %s: MMIO-DMA ", hwif->name);
+	hwif->dma_base = base;
+	if ((hwif->cds->extra) && (hwif->channel == 0))
+		hwif->dma_extra = hwif->cds->extra;
+	
+	/* There is an issue to watch here. The master might not be 
+	   registered because the BIOS disabled it. Eventually this should
+	   be fixed by always registering the mate */
+	   
+	if(hwif->mate == NULL)
+		hwif->dma_master = base;
+	else
+		hwif->dma_master = (hwif->channel) ? hwif->mate->dma_base : base;
+	return 0;
+}
+
 int ide_mmio_dma (ide_hwif_t *hwif, unsigned long base, unsigned int ports)
 {
 	printk(KERN_INFO "    %s: MMIO-DMA at 0x%08lx-0x%08lx",
@@ -1107,6 +1130,8 @@
  */
 int ide_dma_iobase (ide_hwif_t *hwif, unsigned long base, unsigned int ports)
 {
+	if (hwif->mmio == 2)
+		return ide_mapped_mmio_dma(hwif, base, ports);
 	if (hwif->mmio)
 		return ide_mmio_dma(hwif, base, ports);
 	return ide_iomio_dma(hwif, base, ports);
diff -urN linux-2.4.21-rc4/drivers/ide/ide.c linux-2.4.21-rc5/drivers/ide/ide.c
--- linux-2.4.21-rc4/drivers/ide/ide.c	2003-05-27 12:43:46.000000000 -0700
+++ linux-2.4.21-rc5/drivers/ide/ide.c	2003-05-27 12:43:58.000000000 -0700
@@ -121,8 +121,8 @@
  *
  */
 
-#define	REVISION	"Revision: 7.00beta3-.2.4"
-#define	VERSION		"Id: ide.c 7.00b3 20030422"
+#define	REVISION	"Revision: 7.00beta4-2.4"
+#define	VERSION		"Id: ide.c 7.00b4 20030520"
 
 #undef REALLY_SLOW_IO		/* most systems can safely undef this */
 
@@ -2015,13 +2015,8 @@
 				drive->remap_0_to_1 = 2;
 				goto done;
 			case -14: /* "scsi" */
-#if defined(CONFIG_BLK_DEV_IDESCSI) && defined(CONFIG_SCSI)
 				drive->scsi = 1;
 				goto done;
-#else
-				drive->scsi = 0;
-				goto bad_option;
-#endif /* defined(CONFIG_BLK_DEV_IDESCSI) && defined(CONFIG_SCSI) */
 			case 3: /* cyl,head,sect */
 				drive->media	= ide_disk;
 				drive->cyl	= drive->bios_cyl  = vals[0];
diff -urN linux-2.4.21-rc4/drivers/ide/pci/siimage.c linux-2.4.21-rc5/drivers/ide/pci/siimage.c
--- linux-2.4.21-rc4/drivers/ide/pci/siimage.c	2003-05-27 12:43:47.000000000 -0700
+++ linux-2.4.21-rc5/drivers/ide/pci/siimage.c	2003-05-27 12:43:58.000000000 -0700
@@ -573,7 +573,7 @@
 static unsigned int setup_mmio_siimage (struct pci_dev *dev, const char *name)
 {
 	unsigned long bar5	= pci_resource_start(dev, 5);
-	unsigned long end5	= pci_resource_end(dev, 5);
+	unsigned long len5	= pci_resource_len(dev, 5);
 	u8 tmpbyte	= 0;
 	unsigned long addr;
 	void *ioaddr;
@@ -584,13 +584,13 @@
 	 *	spaces.
 	 */
 	 
-	if(check_mem_region(bar5, (end5-bar5)+1)!=0)
+	if(check_mem_region(bar5, len5)!=0)
 	{
 		printk(KERN_WARNING "siimage: IDE controller MMIO ports not available.\n");
 		return 0;
 	}
 		
-	ioaddr = ioremap_nocache(bar5, (end5 - bar5)+1);
+	ioaddr = ioremap_nocache(bar5, len5);
 
 	if (ioaddr == NULL)
 		return 0;
@@ -792,7 +792,7 @@
 	hwif->dma_base			= DEVADDR((ch) ? 0x08 : 0x00);
 	hwif->dma_base2			= DEVADDR((ch) ? 0x18 : 0x10);
 #endif /* SIIMAGE_LARGE_DMA */
-	hwif->mmio			= 1;
+	hwif->mmio			= 2;
 }
 
 static void __init init_iops_siimage (ide_hwif_t *hwif)
diff -urN linux-2.4.21-rc4/drivers/ide/pci/siimage.h linux-2.4.21-rc5/drivers/ide/pci/siimage.h
--- linux-2.4.21-rc4/drivers/ide/pci/siimage.h	2003-05-27 12:43:47.000000000 -0700
+++ linux-2.4.21-rc5/drivers/ide/pci/siimage.h	2003-05-27 12:43:58.000000000 -0700
@@ -27,10 +27,10 @@
 #define siiprintk(x...)
 #endif
 
-#define ADJREG(B,R)	((B)|(R)|((hwif->channel)<<(4+(2*(hwif->mmio)))))
+#define ADJREG(B,R)	((B)|(R)|((hwif->channel)<<(4+(2*(!!hwif->mmio)))))
 #define SELREG(R)	ADJREG((0xA0),(R))
-#define SELADDR(R)	((((unsigned long)hwif->hwif_data)*(hwif->mmio))|SELREG((R)))
-#define HWIFADDR(R)	((((unsigned long)hwif->hwif_data)*(hwif->mmio))|(R))
+#define SELADDR(R)	((((unsigned long)hwif->hwif_data)*(!!hwif->mmio))|SELREG((R)))
+#define HWIFADDR(R)	((((unsigned long)hwif->hwif_data)*(!!hwif->mmio))|(R))
 #define DEVADDR(R)	(((unsigned long) pci_get_drvdata(dev))|(R))
 
 
diff -urN linux-2.4.21-rc4/drivers/ide/pci/via82cxxx.c linux-2.4.21-rc5/drivers/ide/pci/via82cxxx.c
--- linux-2.4.21-rc4/drivers/ide/pci/via82cxxx.c	2003-05-27 12:43:47.000000000 -0700
+++ linux-2.4.21-rc5/drivers/ide/pci/via82cxxx.c	2003-05-27 12:43:58.000000000 -0700
@@ -1,12 +1,12 @@
 /*
  *
- * Version 3.36
+ * Version 3.37
  *
  * VIA IDE driver for Linux. Supported southbridges:
  *
  *   vt82c576, vt82c586, vt82c586a, vt82c586b, vt82c596a, vt82c596b,
  *   vt82c686, vt82c686a, vt82c686b, vt8231, vt8233, vt8233c, vt8233a,
- *   vt8235
+ *   vt8235, vt8237
  *
  * Copyright (c) 2000-2002 Vojtech Pavlik
  *
@@ -74,9 +74,7 @@
 	u8 rev_max;
 	u16 flags;
 } via_isa_bridges[] = {
-#ifdef FUTURE_BRIDGES
-	{ "vt8237",	PCI_DEVICE_ID_VIA_8237,     0x00, 0x2f, VIA_UDMA_133 },
-#endif
+	{ "vt8237",	PCI_DEVICE_ID_VIA_8237,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
 	{ "vt8235",	PCI_DEVICE_ID_VIA_8235,     0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
 	{ "vt8233a",	PCI_DEVICE_ID_VIA_8233A,    0x00, 0x2f, VIA_UDMA_133 | VIA_BAD_AST },
 	{ "vt8233c",	PCI_DEVICE_ID_VIA_8233C_0,  0x00, 0x2f, VIA_UDMA_100 },
@@ -148,7 +146,7 @@
 	via_print("----------VIA BusMastering IDE Configuration"
 		"----------------");
 
-	via_print("Driver Version:                     3.36");
+	via_print("Driver Version:                     3.37");
 	via_print("South Bridge:                       VIA %s",
 		via_config->name);
 
diff -urN linux-2.4.21-rc4/include/asm-x86_64/system.h linux-2.4.21-rc5/include/asm-x86_64/system.h
--- linux-2.4.21-rc4/include/asm-x86_64/system.h	2003-05-27 12:43:55.000000000 -0700
+++ linux-2.4.21-rc5/include/asm-x86_64/system.h	2003-05-27 12:44:05.000000000 -0700
@@ -81,14 +81,14 @@
 		"2:\n"				\
 		".section .fixup,\"ax\"\n"	\
 		"3:\t"				\
-		"pushq $0 ; popq %% " #seg "\n\t"	\
+		"movl %1,%%" #seg "\n\t" \
 		"jmp 2b\n"			\
 		".previous\n"			\
 		".section __ex_table,\"a\"\n\t"	\
 		".align 4\n\t"			\
 		".quad 1b,3b\n"			\
 		".previous"			\
-		: :"r" ((int)(value)))
+		: :"r" ((int)(value)), "r" (0))
 
 #define set_debug(value,register) \
                 __asm__("movq %0,%%db" #register  \
