Update Grsec/PaX20110125

 2.2.1-2.6.32.28-201101252237
 2.2.1-2.6.37-201101252237

4 files changed, 945 insertions, 367 deletions

diff --git a/2.6.32/0000_README b/2.6.32/0000_README
index ebbdde9..fc19bc6 100644
--- a/2.6.32/0000_README
+++ b/2.6.32/0000_README
@@ -3,7 +3,7 @@ README
 
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.2.1-2.6.32.28-201101170305.patch
+Patch:	4420_grsecurity-2.2.1-2.6.32.28-201101252237.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.32/4420_grsecurity-2.2.1-2.6.32.28-201101170305.patch b/2.6.32/4420_grsecurity-2.2.1-2.6.32.28-201101252237.patch
index ead21d1..7797cef 100644
--- a/2.6.32/4420_grsecurity-2.2.1-2.6.32.28-201101170305.patch
+++ b/2.6.32/4420_grsecurity-2.2.1-2.6.32.28-201101252237.patch
@@ -7603,7 +7603,7 @@ diff -urNp linux-2.6.32.28/arch/x86/include/asm/elf.h linux-2.6.32.28/arch/x86/i
  #endif /* _ASM_X86_ELF_H */
 diff -urNp linux-2.6.32.28/arch/x86/include/asm/futex.h linux-2.6.32.28/arch/x86/include/asm/futex.h
 --- linux-2.6.32.28/arch/x86/include/asm/futex.h	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/arch/x86/include/asm/futex.h	2010-12-31 14:47:00.000000000 -0500
++++ linux-2.6.32.28/arch/x86/include/asm/futex.h	2011-01-25 20:24:47.000000000 -0500
 @@ -12,16 +12,18 @@
  #include <asm/system.h>
  
@@ -7616,7 +7616,7 @@ diff -urNp linux-2.6.32.28/arch/x86/include/asm/futex.h linux-2.6.32.28/arch/x86
  		     "\t.previous\n"				\
  		     _ASM_EXTABLE(1b, 3b)			\
 -		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
-+		     : "=r" (oldval), "=r" (ret), "+m" (*____m(uaddr))\
++		     : "=r" (oldval), "=r" (ret), "+m" (*(u32 *)____m(uaddr))\
  		     : "i" (-EFAULT), "0" (oparg), "1" (0))
  
  #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
@@ -7629,7 +7629,7 @@ diff -urNp linux-2.6.32.28/arch/x86/include/asm/futex.h linux-2.6.32.28/arch/x86
  		     _ASM_EXTABLE(2b, 4b)			\
  		     : "=&a" (oldval), "=&r" (ret),		\
 -		       "+m" (*uaddr), "=&r" (tem)		\
-+		       "+m" (*(____m(uaddr))), "=&r" (tem)	\
++		       "+m" (*(u32 *)____m(uaddr)), "=&r" (tem)	\
  		     : "r" (oparg), "i" (-EFAULT), "1" (0))
  
 -static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
@@ -7675,7 +7675,7 @@ diff -urNp linux-2.6.32.28/arch/x86/include/asm/futex.h linux-2.6.32.28/arch/x86
  		     "\t.previous\n"
  		     _ASM_EXTABLE(1b, 3b)
 -		     : "=a" (oldval), "+m" (*uaddr)
-+		     : "=a" (oldval), "+m" (*____m(uaddr))
++		     : "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
  		     : "i" (-EFAULT), "r" (newval), "0" (oldval)
  		     : "memory"
  	);
@@ -10724,8 +10724,16 @@ diff -urNp linux-2.6.32.28/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.28/
  };
 diff -urNp linux-2.6.32.28/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.28/arch/x86/kernel/cpu/mcheck/mce.c
 --- linux-2.6.32.28/arch/x86/kernel/cpu/mcheck/mce.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/arch/x86/kernel/cpu/mcheck/mce.c	2010-12-31 14:46:53.000000000 -0500
-@@ -187,7 +187,7 @@ static void print_mce(struct mce *m)
++++ linux-2.6.32.28/arch/x86/kernel/cpu/mcheck/mce.c	2011-01-25 20:24:47.000000000 -0500
+@@ -43,6 +43,7 @@
+ #include <asm/ipi.h>
+ #include <asm/mce.h>
+ #include <asm/msr.h>
++#include <asm/local.h>
+ 
+ #include "mce-internal.h"
+ 
+@@ -187,7 +188,7 @@ static void print_mce(struct mce *m)
  			!(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
  				m->cs, m->ip);
  
@@ -10734,12 +10742,12 @@ diff -urNp linux-2.6.32.28/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.28/arch
  			print_symbol("{%s}", m->ip);
  		pr_cont("\n");
  	}
-@@ -1429,14 +1429,14 @@ void __cpuinit mcheck_init(struct cpuinf
+@@ -1429,14 +1430,14 @@ void __cpuinit mcheck_init(struct cpuinf
   */
  
  static DEFINE_SPINLOCK(mce_state_lock);
 -static int		open_count;		/* #times opened */
-+static atomic_t		open_count;		/* #times opened */
++static local_t		open_count;		/* #times opened */
  static int		open_exclu;		/* already open exclusive? */
  
  static int mce_open(struct inode *inode, struct file *file)
@@ -10747,29 +10755,29 @@ diff -urNp linux-2.6.32.28/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.28/arch
  	spin_lock(&mce_state_lock);
  
 -	if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
-+	if (open_exclu || (atomic_read(&open_count) && (file->f_flags & O_EXCL))) {
++	if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
  		spin_unlock(&mce_state_lock);
  
  		return -EBUSY;
-@@ -1444,7 +1444,7 @@ static int mce_open(struct inode *inode,
+@@ -1444,7 +1445,7 @@ static int mce_open(struct inode *inode,
  
  	if (file->f_flags & O_EXCL)
  		open_exclu = 1;
 -	open_count++;
-+	atomic_inc(&open_count);
++	local_inc(&open_count);
  
  	spin_unlock(&mce_state_lock);
  
-@@ -1455,7 +1455,7 @@ static int mce_release(struct inode *ino
+@@ -1455,7 +1456,7 @@ static int mce_release(struct inode *ino
  {
  	spin_lock(&mce_state_lock);
  
 -	open_count--;
-+	atomic_dec(&open_count);
++	local_dec(&open_count);
  	open_exclu = 0;
  
  	spin_unlock(&mce_state_lock);
-@@ -1595,6 +1595,7 @@ static struct miscdevice mce_log_device 
+@@ -1595,6 +1596,7 @@ static struct miscdevice mce_log_device 
  	MISC_MCELOG_MINOR,
  	"mcelog",
  	&mce_chrdev_ops,
@@ -23970,98 +23978,106 @@ diff -urNp linux-2.6.32.28/drivers/char/hvc_rtas.c linux-2.6.32.28/drivers/char/
  };
 diff -urNp linux-2.6.32.28/drivers/char/hvcs.c linux-2.6.32.28/drivers/char/hvcs.c
 --- linux-2.6.32.28/drivers/char/hvcs.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/drivers/char/hvcs.c	2010-12-31 14:46:53.000000000 -0500
-@@ -269,7 +269,7 @@ struct hvcs_struct {
++++ linux-2.6.32.28/drivers/char/hvcs.c	2011-01-25 20:24:47.000000000 -0500
+@@ -82,6 +82,7 @@
+ #include <asm/hvcserver.h>
+ #include <asm/uaccess.h>
+ #include <asm/vio.h>
++#include <asm/local.h>
+ 
+ /*
+  * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
+@@ -269,7 +270,7 @@ struct hvcs_struct {
  	unsigned int index;
  
  	struct tty_struct *tty;
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  
  	/*
  	 * Used to tell the driver kernel_thread what operations need to take
-@@ -419,7 +419,7 @@ static ssize_t hvcs_vterm_state_store(st
+@@ -419,7 +420,7 @@ static ssize_t hvcs_vterm_state_store(st
  
  	spin_lock_irqsave(&hvcsd->lock, flags);
  
 -	if (hvcsd->open_count > 0) {
-+	if (atomic_read(&hvcsd->open_count) > 0) {
++	if (local_read(&hvcsd->open_count) > 0) {
  		spin_unlock_irqrestore(&hvcsd->lock, flags);
  		printk(KERN_INFO "HVCS: vterm state unchanged.  "
  				"The hvcs device node is still in use.\n");
-@@ -1135,7 +1135,7 @@ static int hvcs_open(struct tty_struct *
+@@ -1135,7 +1136,7 @@ static int hvcs_open(struct tty_struct *
  		if ((retval = hvcs_partner_connect(hvcsd)))
  			goto error_release;
  
 -	hvcsd->open_count = 1;
-+	atomic_set(&hvcsd->open_count, 1);
++	local_set(&hvcsd->open_count, 1);
  	hvcsd->tty = tty;
  	tty->driver_data = hvcsd;
  
-@@ -1169,7 +1169,7 @@ fast_open:
+@@ -1169,7 +1170,7 @@ fast_open:
  
  	spin_lock_irqsave(&hvcsd->lock, flags);
  	kref_get(&hvcsd->kref);
 -	hvcsd->open_count++;
-+	atomic_inc(&hvcsd->open_count);
++	local_inc(&hvcsd->open_count);
  	hvcsd->todo_mask |= HVCS_SCHED_READ;
  	spin_unlock_irqrestore(&hvcsd->lock, flags);
  
-@@ -1213,7 +1213,7 @@ static void hvcs_close(struct tty_struct
+@@ -1213,7 +1214,7 @@ static void hvcs_close(struct tty_struct
  	hvcsd = tty->driver_data;
  
  	spin_lock_irqsave(&hvcsd->lock, flags);
 -	if (--hvcsd->open_count == 0) {
-+	if (atomic_dec_and_test(&hvcsd->open_count)) {
++	if (local_dec_and_test(&hvcsd->open_count)) {
  
  		vio_disable_interrupts(hvcsd->vdev);
  
-@@ -1239,10 +1239,10 @@ static void hvcs_close(struct tty_struct
+@@ -1239,10 +1240,10 @@ static void hvcs_close(struct tty_struct
  		free_irq(irq, hvcsd);
  		kref_put(&hvcsd->kref, destroy_hvcs_struct);
  		return;
 -	} else if (hvcsd->open_count < 0) {
-+	} else if (atomic_read(&hvcsd->open_count) < 0) {
++	} else if (local_read(&hvcsd->open_count) < 0) {
  		printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
  				" is missmanaged.\n",
 -		hvcsd->vdev->unit_address, hvcsd->open_count);
-+		hvcsd->vdev->unit_address, atomic_read(&hvcsd->open_count));
++		hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
  	}
  
  	spin_unlock_irqrestore(&hvcsd->lock, flags);
-@@ -1258,7 +1258,7 @@ static void hvcs_hangup(struct tty_struc
+@@ -1258,7 +1259,7 @@ static void hvcs_hangup(struct tty_struc
  
  	spin_lock_irqsave(&hvcsd->lock, flags);
  	/* Preserve this so that we know how many kref refs to put */
 -	temp_open_count = hvcsd->open_count;
-+	temp_open_count = atomic_read(&hvcsd->open_count);
++	temp_open_count = local_read(&hvcsd->open_count);
  
  	/*
  	 * Don't kref put inside the spinlock because the destruction
-@@ -1273,7 +1273,7 @@ static void hvcs_hangup(struct tty_struc
+@@ -1273,7 +1274,7 @@ static void hvcs_hangup(struct tty_struc
  	hvcsd->tty->driver_data = NULL;
  	hvcsd->tty = NULL;
  
 -	hvcsd->open_count = 0;
-+	atomic_set(&hvcsd->open_count, 0);
++	local_set(&hvcsd->open_count, 0);
  
  	/* This will drop any buffered data on the floor which is OK in a hangup
  	 * scenario. */
-@@ -1344,7 +1344,7 @@ static int hvcs_write(struct tty_struct 
+@@ -1344,7 +1345,7 @@ static int hvcs_write(struct tty_struct 
  	 * the middle of a write operation?  This is a crummy place to do this
  	 * but we want to keep it all in the spinlock.
  	 */
 -	if (hvcsd->open_count <= 0) {
-+	if (atomic_read(&hvcsd->open_count) <= 0) {
++	if (local_read(&hvcsd->open_count) <= 0) {
  		spin_unlock_irqrestore(&hvcsd->lock, flags);
  		return -ENODEV;
  	}
-@@ -1418,7 +1418,7 @@ static int hvcs_write_room(struct tty_st
+@@ -1418,7 +1419,7 @@ static int hvcs_write_room(struct tty_st
  {
  	struct hvcs_struct *hvcsd = tty->driver_data;
  
 -	if (!hvcsd || hvcsd->open_count <= 0)
-+	if (!hvcsd || atomic_read(&hvcsd->open_count) <= 0)
++	if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
  		return 0;
  
  	return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
@@ -24392,118 +24408,126 @@ diff -urNp linux-2.6.32.28/drivers/char/nvram.c linux-2.6.32.28/drivers/char/nvr
  static int __init nvram_init(void)
 diff -urNp linux-2.6.32.28/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.28/drivers/char/pcmcia/ipwireless/tty.c
 --- linux-2.6.32.28/drivers/char/pcmcia/ipwireless/tty.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/drivers/char/pcmcia/ipwireless/tty.c	2010-12-31 14:46:53.000000000 -0500
-@@ -51,7 +51,7 @@ struct ipw_tty {
++++ linux-2.6.32.28/drivers/char/pcmcia/ipwireless/tty.c	2011-01-25 20:24:47.000000000 -0500
+@@ -29,6 +29,7 @@
+ #include <linux/tty_driver.h>
+ #include <linux/tty_flip.h>
+ #include <linux/uaccess.h>
++#include <asm/local.h>
+ 
+ #include "tty.h"
+ #include "network.h"
+@@ -51,7 +52,7 @@ struct ipw_tty {
  	int tty_type;
  	struct ipw_network *network;
  	struct tty_struct *linux_tty;
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	unsigned int control_lines;
  	struct mutex ipw_tty_mutex;
  	int tx_bytes_queued;
-@@ -127,10 +127,10 @@ static int ipw_open(struct tty_struct *l
+@@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l
  		mutex_unlock(&tty->ipw_tty_mutex);
  		return -ENODEV;
  	}
 -	if (tty->open_count == 0)
-+	if (atomic_read(&tty->open_count) == 0)
++	if (local_read(&tty->open_count) == 0)
  		tty->tx_bytes_queued = 0;
  
 -	tty->open_count++;
-+	atomic_inc(&tty->open_count);
++	local_inc(&tty->open_count);
  
  	tty->linux_tty = linux_tty;
  	linux_tty->driver_data = tty;
-@@ -146,9 +146,7 @@ static int ipw_open(struct tty_struct *l
+@@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l
  
  static void do_ipw_close(struct ipw_tty *tty)
  {
 -	tty->open_count--;
 -
 -	if (tty->open_count == 0) {
-+	if (atomic_dec_return(&tty->open_count) == 0) {
++	if (local_dec_return(&tty->open_count) == 0) {
  		struct tty_struct *linux_tty = tty->linux_tty;
  
  		if (linux_tty != NULL) {
-@@ -169,7 +167,7 @@ static void ipw_hangup(struct tty_struct
+@@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct
  		return;
  
  	mutex_lock(&tty->ipw_tty_mutex);
 -	if (tty->open_count == 0) {
-+	if (atomic_read(&tty->open_count) == 0) {
++	if (local_read(&tty->open_count) == 0) {
  		mutex_unlock(&tty->ipw_tty_mutex);
  		return;
  	}
-@@ -198,7 +196,7 @@ void ipwireless_tty_received(struct ipw_
+@@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_
  		return;
  	}
  
 -	if (!tty->open_count) {
-+	if (!atomic_read(&tty->open_count)) {
++	if (!local_read(&tty->open_count)) {
  		mutex_unlock(&tty->ipw_tty_mutex);
  		return;
  	}
-@@ -240,7 +238,7 @@ static int ipw_write(struct tty_struct *
+@@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *
  		return -ENODEV;
  
  	mutex_lock(&tty->ipw_tty_mutex);
 -	if (!tty->open_count) {
-+	if (!atomic_read(&tty->open_count)) {
++	if (!local_read(&tty->open_count)) {
  		mutex_unlock(&tty->ipw_tty_mutex);
  		return -EINVAL;
  	}
-@@ -280,7 +278,7 @@ static int ipw_write_room(struct tty_str
+@@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str
  	if (!tty)
  		return -ENODEV;
  
 -	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
++	if (!local_read(&tty->open_count))
  		return -EINVAL;
  
  	room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
-@@ -322,7 +320,7 @@ static int ipw_chars_in_buffer(struct tt
+@@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt
  	if (!tty)
  		return 0;
  
 -	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
++	if (!local_read(&tty->open_count))
  		return 0;
  
  	return tty->tx_bytes_queued;
-@@ -403,7 +401,7 @@ static int ipw_tiocmget(struct tty_struc
+@@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc
  	if (!tty)
  		return -ENODEV;
  
 -	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
++	if (!local_read(&tty->open_count))
  		return -EINVAL;
  
  	return get_control_lines(tty);
-@@ -419,7 +417,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
+@@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
  	if (!tty)
  		return -ENODEV;
  
 -	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
++	if (!local_read(&tty->open_count))
  		return -EINVAL;
  
  	return set_control_lines(tty, set, clear);
-@@ -433,7 +431,7 @@ static int ipw_ioctl(struct tty_struct *
+@@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *
  	if (!tty)
  		return -ENODEV;
  
 -	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
++	if (!local_read(&tty->open_count))
  		return -EINVAL;
  
  	/* FIXME: Exactly how is the tty object locked here .. */
-@@ -591,7 +589,7 @@ void ipwireless_tty_free(struct ipw_tty 
+@@ -591,7 +590,7 @@ void ipwireless_tty_free(struct ipw_tty 
  				   against a parallel ioctl etc */
  				mutex_lock(&ttyj->ipw_tty_mutex);
  			}
 -			while (ttyj->open_count)
-+			while (atomic_read(&ttyj->open_count))
++			while (local_read(&ttyj->open_count))
  				do_ipw_close(ttyj);
  			ipwireless_disassociate_network_ttys(network,
  							     ttyj->channel_idx);
@@ -24586,34 +24610,42 @@ diff -urNp linux-2.6.32.28/drivers/char/random.c linux-2.6.32.28/drivers/char/ra
  
 diff -urNp linux-2.6.32.28/drivers/char/sonypi.c linux-2.6.32.28/drivers/char/sonypi.c
 --- linux-2.6.32.28/drivers/char/sonypi.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/drivers/char/sonypi.c	2010-12-31 14:46:53.000000000 -0500
-@@ -491,7 +491,7 @@ static struct sonypi_device {
++++ linux-2.6.32.28/drivers/char/sonypi.c	2011-01-25 20:24:47.000000000 -0500
+@@ -55,6 +55,7 @@
+ #include <asm/uaccess.h>
+ #include <asm/io.h>
+ #include <asm/system.h>
++#include <asm/local.h>
+ 
+ #include <linux/sonypi.h>
+ 
+@@ -491,7 +492,7 @@ static struct sonypi_device {
  	spinlock_t fifo_lock;
  	wait_queue_head_t fifo_proc_list;
  	struct fasync_struct *fifo_async;
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	int model;
  	struct input_dev *input_jog_dev;
  	struct input_dev *input_key_dev;
-@@ -895,7 +895,7 @@ static int sonypi_misc_fasync(int fd, st
+@@ -895,7 +896,7 @@ static int sonypi_misc_fasync(int fd, st
  static int sonypi_misc_release(struct inode *inode, struct file *file)
  {
  	mutex_lock(&sonypi_device.lock);
 -	sonypi_device.open_count--;
-+	atomic_dec(&sonypi_device.open_count);
++	local_dec(&sonypi_device.open_count);
  	mutex_unlock(&sonypi_device.lock);
  	return 0;
  }
-@@ -905,9 +905,9 @@ static int sonypi_misc_open(struct inode
+@@ -905,9 +906,9 @@ static int sonypi_misc_open(struct inode
  	lock_kernel();
  	mutex_lock(&sonypi_device.lock);
  	/* Flush input queue on first open */
 -	if (!sonypi_device.open_count)
-+	if (!atomic_read(&sonypi_device.open_count))
++	if (!local_read(&sonypi_device.open_count))
  		kfifo_reset(sonypi_device.fifo);
 -	sonypi_device.open_count++;
-+	atomic_inc(&sonypi_device.open_count);
++	local_inc(&sonypi_device.open_count);
  	mutex_unlock(&sonypi_device.lock);
  	unlock_kernel();
  	return 0;
@@ -25166,7 +25198,7 @@ diff -urNp linux-2.6.32.28/drivers/gpu/drm/drm_drv.c linux-2.6.32.28/drivers/gpu
  	DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
 diff -urNp linux-2.6.32.28/drivers/gpu/drm/drm_fops.c linux-2.6.32.28/drivers/gpu/drm/drm_fops.c
 --- linux-2.6.32.28/drivers/gpu/drm/drm_fops.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/drivers/gpu/drm/drm_fops.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/drivers/gpu/drm/drm_fops.c	2011-01-24 18:05:30.000000000 -0500
 @@ -66,7 +66,7 @@ static int drm_setup(struct drm_device *
  	}
  
@@ -25184,7 +25216,7 @@ diff -urNp linux-2.6.32.28/drivers/gpu/drm/drm_fops.c linux-2.6.32.28/drivers/gp
 +		atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
  		spin_lock(&dev->count_lock);
 -		if (!dev->open_count++) {
-+		if (atomic_inc_return(&dev->open_count) == 1) {
++		if (local_inc_return(&dev->open_count) == 1) {
  			spin_unlock(&dev->count_lock);
  			retcode = drm_setup(dev);
  			goto out;
@@ -25193,7 +25225,7 @@ diff -urNp linux-2.6.32.28/drivers/gpu/drm/drm_fops.c linux-2.6.32.28/drivers/gp
  	lock_kernel();
  
 -	DRM_DEBUG("open_count = %d\n", dev->open_count);
-+	DRM_DEBUG("open_count = %d\n", atomic_read(&dev->open_count));
++	DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
  
  	if (dev->driver->preclose)
  		dev->driver->preclose(dev, file_priv);
@@ -25202,7 +25234,7 @@ diff -urNp linux-2.6.32.28/drivers/gpu/drm/drm_fops.c linux-2.6.32.28/drivers/gp
  		  task_pid_nr(current),
  		  (long)old_encode_dev(file_priv->minor->device),
 -		  dev->open_count);
-+		  atomic_read(&dev->open_count));
++		  local_read(&dev->open_count));
  
  	/* if the master has gone away we can't do anything with the lock */
  	if (file_priv->minor->master)
@@ -25214,13 +25246,49 @@ diff -urNp linux-2.6.32.28/drivers/gpu/drm/drm_fops.c linux-2.6.32.28/drivers/gp
 +	atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
  	spin_lock(&dev->count_lock);
 -	if (!--dev->open_count) {
-+	if (atomic_dec_and_test(&dev->open_count)) {
++	if (local_dec_and_test(&dev->open_count)) {
  		if (atomic_read(&dev->ioctl_count)) {
  			DRM_ERROR("Device busy: %d\n",
  				  atomic_read(&dev->ioctl_count));
+diff -urNp linux-2.6.32.28/drivers/gpu/drm/drm_gem.c linux-2.6.32.28/drivers/gpu/drm/drm_gem.c
+--- linux-2.6.32.28/drivers/gpu/drm/drm_gem.c	2010-08-13 16:24:37.000000000 -0400
++++ linux-2.6.32.28/drivers/gpu/drm/drm_gem.c	2011-01-24 18:05:37.000000000 -0500
+@@ -83,11 +83,11 @@ drm_gem_init(struct drm_device *dev)
+ 	spin_lock_init(&dev->object_name_lock);
+ 	idr_init(&dev->object_name_idr);
+ 	atomic_set(&dev->object_count, 0);
+-	atomic_set(&dev->object_memory, 0);
++	atomic_set_unchecked(&dev->object_memory, 0);
+ 	atomic_set(&dev->pin_count, 0);
+-	atomic_set(&dev->pin_memory, 0);
++	atomic_set_unchecked(&dev->pin_memory, 0);
+ 	atomic_set(&dev->gtt_count, 0);
+-	atomic_set(&dev->gtt_memory, 0);
++	atomic_set_unchecked(&dev->gtt_memory, 0);
+ 
+ 	mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL);
+ 	if (!mm) {
+@@ -150,7 +150,7 @@ drm_gem_object_alloc(struct drm_device *
+ 		goto fput;
+ 	}
+ 	atomic_inc(&dev->object_count);
+-	atomic_add(obj->size, &dev->object_memory);
++	atomic_add_unchecked(obj->size, &dev->object_memory);
+ 	return obj;
+ fput:
+ 	fput(obj->filp);
+@@ -429,7 +429,7 @@ drm_gem_object_free(struct kref *kref)
+ 
+ 	fput(obj->filp);
+ 	atomic_dec(&dev->object_count);
+-	atomic_sub(obj->size, &dev->object_memory);
++	atomic_sub_unchecked(obj->size, &dev->object_memory);
+ 	kfree(obj);
+ }
+ EXPORT_SYMBOL(drm_gem_object_free);
 diff -urNp linux-2.6.32.28/drivers/gpu/drm/drm_info.c linux-2.6.32.28/drivers/gpu/drm/drm_info.c
 --- linux-2.6.32.28/drivers/gpu/drm/drm_info.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/drivers/gpu/drm/drm_info.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/drivers/gpu/drm/drm_info.c	2011-01-24 18:05:30.000000000 -0500
 @@ -75,10 +75,14 @@ int drm_vm_info(struct seq_file *m, void
  	struct drm_local_map *map;
  	struct drm_map_list *r_list;
@@ -25249,6 +25317,20 @@ diff -urNp linux-2.6.32.28/drivers/gpu/drm/drm_info.c linux-2.6.32.28/drivers/gp
  			type = "??";
  		else
  			type = types[map->type];
+@@ -265,10 +269,10 @@ int drm_gem_object_info(struct seq_file 
+ 	struct drm_device *dev = node->minor->dev;
+ 
+ 	seq_printf(m, "%d objects\n", atomic_read(&dev->object_count));
+-	seq_printf(m, "%d object bytes\n", atomic_read(&dev->object_memory));
++	seq_printf(m, "%d object bytes\n", atomic_read_unchecked(&dev->object_memory));
+ 	seq_printf(m, "%d pinned\n", atomic_read(&dev->pin_count));
+-	seq_printf(m, "%d pin bytes\n", atomic_read(&dev->pin_memory));
+-	seq_printf(m, "%d gtt bytes\n", atomic_read(&dev->gtt_memory));
++	seq_printf(m, "%d pin bytes\n", atomic_read_unchecked(&dev->pin_memory));
++	seq_printf(m, "%d gtt bytes\n", atomic_read_unchecked(&dev->gtt_memory));
+ 	seq_printf(m, "%d gtt total\n", dev->gtt_total);
+ 	return 0;
+ }
 diff -urNp linux-2.6.32.28/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.28/drivers/gpu/drm/drm_ioctl.c
 --- linux-2.6.32.28/drivers/gpu/drm/drm_ioctl.c	2010-08-13 16:24:37.000000000 -0400
 +++ linux-2.6.32.28/drivers/gpu/drm/drm_ioctl.c	2010-12-31 14:46:53.000000000 -0500
@@ -25416,7 +25498,16 @@ diff -urNp linux-2.6.32.28/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.28/drive
  	.close = drm_gem_vm_close,
 diff -urNp linux-2.6.32.28/drivers/gpu/drm/i915/i915_gem.c linux-2.6.32.28/drivers/gpu/drm/i915/i915_gem.c
 --- linux-2.6.32.28/drivers/gpu/drm/i915/i915_gem.c	2010-09-20 17:26:42.000000000 -0400
-+++ linux-2.6.32.28/drivers/gpu/drm/i915/i915_gem.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/drivers/gpu/drm/i915/i915_gem.c	2011-01-24 18:05:30.000000000 -0500
+@@ -102,7 +102,7 @@ i915_gem_get_aperture_ioctl(struct drm_d
+ 
+ 	args->aper_size = dev->gtt_total;
+ 	args->aper_available_size = (args->aper_size -
+-				     atomic_read(&dev->pin_memory));
++				     atomic_read_unchecked(&dev->pin_memory));
+ 
+ 	return 0;
+ }
 @@ -492,6 +492,11 @@ i915_gem_pread_ioctl(struct drm_device *
  		return -EINVAL;
  	}
@@ -25441,6 +25532,55 @@ diff -urNp linux-2.6.32.28/drivers/gpu/drm/i915/i915_gem.c linux-2.6.32.28/drive
  	/* We can only do the GTT pwrite on untiled buffers, as otherwise
  	 * it would end up going through the fenced access, and we'll get
  	 * different detiling behavior between reading and writing.
+@@ -2054,7 +2064,7 @@ i915_gem_object_unbind(struct drm_gem_ob
+ 
+ 	if (obj_priv->gtt_space) {
+ 		atomic_dec(&dev->gtt_count);
+-		atomic_sub(obj->size, &dev->gtt_memory);
++		atomic_sub_unchecked(obj->size, &dev->gtt_memory);
+ 
+ 		drm_mm_put_block(obj_priv->gtt_space);
+ 		obj_priv->gtt_space = NULL;
+@@ -2697,7 +2707,7 @@ i915_gem_object_bind_to_gtt(struct drm_g
+ 		goto search_free;
+ 	}
+ 	atomic_inc(&dev->gtt_count);
+-	atomic_add(obj->size, &dev->gtt_memory);
++	atomic_add_unchecked(obj->size, &dev->gtt_memory);
+ 
+ 	/* Assert that the object is not currently in any GPU domain. As it
+ 	 * wasn't in the GTT, there shouldn't be any way it could have been in
+@@ -3751,9 +3761,9 @@ i915_gem_execbuffer(struct drm_device *d
+ 					  "%d/%d gtt bytes\n",
+ 					  atomic_read(&dev->object_count),
+ 					  atomic_read(&dev->pin_count),
+-					  atomic_read(&dev->object_memory),
+-					  atomic_read(&dev->pin_memory),
+-					  atomic_read(&dev->gtt_memory),
++					  atomic_read_unchecked(&dev->object_memory),
++					  atomic_read_unchecked(&dev->pin_memory),
++					  atomic_read_unchecked(&dev->gtt_memory),
+ 					  dev->gtt_total);
+ 			}
+ 			goto err;
+@@ -3985,7 +3995,7 @@ i915_gem_object_pin(struct drm_gem_objec
+ 	 */
+ 	if (obj_priv->pin_count == 1) {
+ 		atomic_inc(&dev->pin_count);
+-		atomic_add(obj->size, &dev->pin_memory);
++		atomic_add_unchecked(obj->size, &dev->pin_memory);
+ 		if (!obj_priv->active &&
+ 		    (obj->write_domain & I915_GEM_GPU_DOMAINS) == 0 &&
+ 		    !list_empty(&obj_priv->list))
+@@ -4018,7 +4028,7 @@ i915_gem_object_unpin(struct drm_gem_obj
+ 			list_move_tail(&obj_priv->list,
+ 				       &dev_priv->mm.inactive_list);
+ 		atomic_dec(&dev->pin_count);
+-		atomic_sub(obj->size, &dev->pin_memory);
++		atomic_sub_unchecked(obj->size, &dev->pin_memory);
+ 	}
+ 	i915_verify_inactive(dev, __FILE__, __LINE__);
+ }
 diff -urNp linux-2.6.32.28/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.28/drivers/gpu/drm/radeon/mkregtable.c
 --- linux-2.6.32.28/drivers/gpu/drm/radeon/mkregtable.c	2010-08-13 16:24:37.000000000 -0400
 +++ linux-2.6.32.28/drivers/gpu/drm/radeon/mkregtable.c	2010-12-31 14:46:53.000000000 -0500
@@ -26279,31 +26419,39 @@ diff -urNp linux-2.6.32.28/drivers/input/serio/serio_raw.c linux-2.6.32.28/drive
  MODULE_DEVICE_TABLE(serio, serio_raw_serio_ids);
 diff -urNp linux-2.6.32.28/drivers/isdn/gigaset/common.c linux-2.6.32.28/drivers/isdn/gigaset/common.c
 --- linux-2.6.32.28/drivers/isdn/gigaset/common.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/drivers/isdn/gigaset/common.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/drivers/isdn/gigaset/common.c	2011-01-24 18:05:30.000000000 -0500
 @@ -712,7 +712,7 @@ struct cardstate *gigaset_initcs(struct 
  	cs->commands_pending = 0;
  	cs->cur_at_seq = 0;
  	cs->gotfwver = -1;
 -	cs->open_count = 0;
-+	atomic_set(&cs->open_count, 0);
++	local_set(&cs->open_count, 0);
  	cs->dev = NULL;
  	cs->tty = NULL;
  	cs->tty_dev = NULL;
 diff -urNp linux-2.6.32.28/drivers/isdn/gigaset/gigaset.h linux-2.6.32.28/drivers/isdn/gigaset/gigaset.h
 --- linux-2.6.32.28/drivers/isdn/gigaset/gigaset.h	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/drivers/isdn/gigaset/gigaset.h	2010-12-31 14:46:53.000000000 -0500
-@@ -446,7 +446,7 @@ struct cardstate {
++++ linux-2.6.32.28/drivers/isdn/gigaset/gigaset.h	2011-01-25 20:24:47.000000000 -0500
+@@ -34,6 +34,7 @@
+ #include <linux/tty_driver.h>
+ #include <linux/list.h>
+ #include <asm/atomic.h>
++#include <asm/local.h>
+ 
+ #define GIG_VERSION {0,5,0,0}
+ #define GIG_COMPAT  {0,4,0,0}
+@@ -446,7 +447,7 @@ struct cardstate {
  	spinlock_t cmdlock;
  	unsigned curlen, cmdbytes;
  
 -	unsigned open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	struct tty_struct *tty;
  	struct tasklet_struct if_wake_tasklet;
  	unsigned control_state;
 diff -urNp linux-2.6.32.28/drivers/isdn/gigaset/interface.c linux-2.6.32.28/drivers/isdn/gigaset/interface.c
 --- linux-2.6.32.28/drivers/isdn/gigaset/interface.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/drivers/isdn/gigaset/interface.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/drivers/isdn/gigaset/interface.c	2011-01-24 18:05:30.000000000 -0500
 @@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tt
  		return -ERESTARTSYS; // FIXME -EINTR?
  	tty->driver_data = cs;
@@ -26311,7 +26459,7 @@ diff -urNp linux-2.6.32.28/drivers/isdn/gigaset/interface.c linux-2.6.32.28/driv
 -	++cs->open_count;
 -
 -	if (cs->open_count == 1) {
-+	if (atomic_inc_return(&cs->open_count) == 1) {
++	if (local_inc_return(&cs->open_count) == 1) {
  		spin_lock_irqsave(&cs->lock, flags);
  		cs->tty = tty;
  		spin_unlock_irqrestore(&cs->lock, flags);
@@ -26320,11 +26468,11 @@ diff -urNp linux-2.6.32.28/drivers/isdn/gigaset/interface.c linux-2.6.32.28/driv
  	if (!cs->connected)
  		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
 -	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
++	else if (!local_read(&cs->open_count))
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  	else {
 -		if (!--cs->open_count) {
-+		if (!atomic_dec_return(&cs->open_count)) {
++		if (!local_dec_return(&cs->open_count)) {
  			spin_lock_irqsave(&cs->lock, flags);
  			cs->tty = NULL;
  			spin_unlock_irqrestore(&cs->lock, flags);
@@ -26333,7 +26481,7 @@ diff -urNp linux-2.6.32.28/drivers/isdn/gigaset/interface.c linux-2.6.32.28/driv
  		gig_dbg(DEBUG_IF, "not connected");
  		retval = -ENODEV;
 -	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
++	} else if (!local_read(&cs->open_count))
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  	else {
  		retval = 0;
@@ -26342,7 +26490,7 @@ diff -urNp linux-2.6.32.28/drivers/isdn/gigaset/interface.c linux-2.6.32.28/driv
  		gig_dbg(DEBUG_IF, "not connected");
  		retval = -ENODEV;
 -	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
++	} else if (!local_read(&cs->open_count))
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  	else if (cs->mstate != MS_LOCKED) {
  		dev_warn(cs->dev, "can't write to unlocked device\n");
@@ -26351,7 +26499,7 @@ diff -urNp linux-2.6.32.28/drivers/isdn/gigaset/interface.c linux-2.6.32.28/driv
  		gig_dbg(DEBUG_IF, "not connected");
  		retval = -ENODEV;
 -	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
++	} else if (!local_read(&cs->open_count))
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  	else if (cs->mstate != MS_LOCKED) {
  		dev_warn(cs->dev, "can't write to unlocked device\n");
@@ -26360,7 +26508,7 @@ diff -urNp linux-2.6.32.28/drivers/isdn/gigaset/interface.c linux-2.6.32.28/driv
  	if (!cs->connected)
  		gig_dbg(DEBUG_IF, "not connected");
 -	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
++	else if (!local_read(&cs->open_count))
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  	else if (cs->mstate != MS_LOCKED)
  		dev_warn(cs->dev, "can't write to unlocked device\n");
@@ -26369,7 +26517,7 @@ diff -urNp linux-2.6.32.28/drivers/isdn/gigaset/interface.c linux-2.6.32.28/driv
  	if (!cs->connected)
  		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
 -	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
++	else if (!local_read(&cs->open_count))
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  	else {
  		//FIXME
@@ -26378,7 +26526,7 @@ diff -urNp linux-2.6.32.28/drivers/isdn/gigaset/interface.c linux-2.6.32.28/driv
  	if (!cs->connected)
  		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
 -	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
++	else if (!local_read(&cs->open_count))
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  	else {
  		//FIXME
@@ -26387,7 +26535,7 @@ diff -urNp linux-2.6.32.28/drivers/isdn/gigaset/interface.c linux-2.6.32.28/driv
  	}
  
 -	if (!cs->open_count) {
-+	if (!atomic_read(&cs->open_count)) {
++	if (!local_read(&cs->open_count)) {
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  		goto out;
  	}
@@ -26756,6 +26904,18 @@ diff -urNp linux-2.6.32.28/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.28/d
  	struct file_operations *dvbdevfops;
  	struct device *clsdev;
  	int minor;
+diff -urNp linux-2.6.32.28/drivers/media/dvb/ttpci/av7110_ca.c linux-2.6.32.28/drivers/media/dvb/ttpci/av7110_ca.c
+--- linux-2.6.32.28/drivers/media/dvb/ttpci/av7110_ca.c	2010-08-13 16:24:37.000000000 -0400
++++ linux-2.6.32.28/drivers/media/dvb/ttpci/av7110_ca.c	2011-01-24 18:12:30.000000000 -0500
+@@ -277,7 +277,7 @@ static int dvb_ca_ioctl(struct inode *in
+ 	{
+ 		ca_slot_info_t *info=(ca_slot_info_t *)parg;
+ 
+-		if (info->num > 1)
++		if (info->num < 0 || info->num > 1)
+ 			return -EINVAL;
+ 		av7110->ci_slot[info->num].num = info->num;
+ 		av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?
 diff -urNp linux-2.6.32.28/drivers/media/radio/radio-cadet.c linux-2.6.32.28/drivers/media/radio/radio-cadet.c
 --- linux-2.6.32.28/drivers/media/radio/radio-cadet.c	2010-08-13 16:24:37.000000000 -0400
 +++ linux-2.6.32.28/drivers/media/radio/radio-cadet.c	2010-12-31 14:46:53.000000000 -0500
@@ -27692,13 +27852,22 @@ diff -urNp linux-2.6.32.28/drivers/net/tulip/de4x5.c linux-2.6.32.28/drivers/net
  #define DE4X5_DUMP              0x0f /* Dump the DE4X5 Status */
 diff -urNp linux-2.6.32.28/drivers/net/usb/hso.c linux-2.6.32.28/drivers/net/usb/hso.c
 --- linux-2.6.32.28/drivers/net/usb/hso.c	2010-09-26 17:26:05.000000000 -0400
-+++ linux-2.6.32.28/drivers/net/usb/hso.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/drivers/net/usb/hso.c	2011-01-24 18:05:30.000000000 -0500
+@@ -71,7 +71,7 @@
+ #include <asm/byteorder.h>
+ #include <linux/serial_core.h>
+ #include <linux/serial.h>
+-
++#include <asm/local.h>
+ 
+ #define DRIVER_VERSION			"1.2"
+ #define MOD_AUTHOR			"Option Wireless"
 @@ -258,7 +258,7 @@ struct hso_serial {
  
  	/* from usb_serial_port */
  	struct tty_struct *tty;
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	spinlock_t serial_lock;
  
  	int (*write_data) (struct hso_serial *serial);
@@ -27707,7 +27876,7 @@ diff -urNp linux-2.6.32.28/drivers/net/usb/hso.c linux-2.6.32.28/drivers/net/usb
  
  	urb = serial->rx_urb[0];
 -	if (serial->open_count > 0) {
-+	if (atomic_read(&serial->open_count) > 0) {
++	if (local_read(&serial->open_count) > 0) {
  		count = put_rxbuf_data(urb, serial);
  		if (count == -1)
  			return;
@@ -27716,7 +27885,7 @@ diff -urNp linux-2.6.32.28/drivers/net/usb/hso.c linux-2.6.32.28/drivers/net/usb
  
  	/* Anyone listening? */
 -	if (serial->open_count == 0)
-+	if (atomic_read(&serial->open_count) == 0)
++	if (local_read(&serial->open_count) == 0)
  		return;
  
  	if (status == 0) {
@@ -27726,7 +27895,7 @@ diff -urNp linux-2.6.32.28/drivers/net/usb/hso.c linux-2.6.32.28/drivers/net/usb
  	/* check for port already opened, if not set the termios */
 -	serial->open_count++;
 -	if (serial->open_count == 1) {
-+	if (atomic_inc_return(&serial->open_count) == 1) {
++	if (local_inc_return(&serial->open_count) == 1) {
  		tty->low_latency = 1;
  		serial->rx_state = RX_IDLE;
  		/* Force default termio settings */
@@ -27735,7 +27904,7 @@ diff -urNp linux-2.6.32.28/drivers/net/usb/hso.c linux-2.6.32.28/drivers/net/usb
  		if (result) {
  			hso_stop_serial_device(serial->parent);
 -			serial->open_count--;
-+			atomic_dec(&serial->open_count);
++			local_dec(&serial->open_count);
  			kref_put(&serial->parent->ref, hso_serial_ref_free);
  		}
  	} else {
@@ -27744,12 +27913,12 @@ diff -urNp linux-2.6.32.28/drivers/net/usb/hso.c linux-2.6.32.28/drivers/net/usb
  	/* reset the rts and dtr */
  	/* do the actual close */
 -	serial->open_count--;
-+	atomic_dec(&serial->open_count);
++	local_dec(&serial->open_count);
  
 -	if (serial->open_count <= 0) {
 -		serial->open_count = 0;
-+	if (atomic_read(&serial->open_count) <= 0) {
-+		atomic_set(&serial->open_count,  0);
++	if (local_read(&serial->open_count) <= 0) {
++		local_set(&serial->open_count,  0);
  		spin_lock_irq(&serial->serial_lock);
  		if (serial->tty == tty) {
  			serial->tty->driver_data = NULL;
@@ -27758,7 +27927,7 @@ diff -urNp linux-2.6.32.28/drivers/net/usb/hso.c linux-2.6.32.28/drivers/net/usb
  	/* the actual setup */
  	spin_lock_irqsave(&serial->serial_lock, flags);
 -	if (serial->open_count)
-+	if (atomic_read(&serial->open_count))
++	if (local_read(&serial->open_count))
  		_hso_serial_set_termios(tty, old);
  	else
  		tty->termios = old;
@@ -27781,7 +27950,7 @@ diff -urNp linux-2.6.32.28/drivers/net/usb/hso.c linux-2.6.32.28/drivers/net/usb
  	for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
  		if (serial_table[i] && (serial_table[i]->interface == iface)) {
 -			if (dev2ser(serial_table[i])->open_count) {
-+			if (atomic_read(&dev2ser(serial_table[i])->open_count)) {
++			if (local_read(&dev2ser(serial_table[i])->open_count)) {
  				result =
  				    hso_start_serial_device(serial_table[i], GFP_NOIO);
  				hso_kick_transmit(dev2ser(serial_table[i]));
@@ -29306,8 +29475,25 @@ diff -urNp linux-2.6.32.28/drivers/staging/vme/devices/vme_user.c linux-2.6.32.2
          .read = vme_user_read,
 diff -urNp linux-2.6.32.28/drivers/uio/uio.c linux-2.6.32.28/drivers/uio/uio.c
 --- linux-2.6.32.28/drivers/uio/uio.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/drivers/uio/uio.c	2010-12-31 14:46:53.000000000 -0500
-@@ -129,7 +129,7 @@ static ssize_t map_type_show(struct kobj
++++ linux-2.6.32.28/drivers/uio/uio.c	2011-01-24 18:05:34.000000000 -0500
+@@ -23,6 +23,7 @@
+ #include <linux/string.h>
+ #include <linux/kobject.h>
+ #include <linux/uio_driver.h>
++#include <asm/local.h>
+ 
+ #define UIO_MAX_DEVICES 255
+ 
+@@ -33,7 +34,7 @@ struct uio_device {
+ 	atomic_t		event;
+ 	struct fasync_struct	*async_queue;
+ 	wait_queue_head_t	wait;
+-	int			vma_count;
++	local_t			vma_count;
+ 	struct uio_info		*info;
+ 	struct kobject		*map_dir;
+ 	struct kobject		*portio_dir;
+@@ -129,7 +130,7 @@ static ssize_t map_type_show(struct kobj
  	return entry->show(mem, buf);
  }
  
@@ -29316,7 +29502,7 @@ diff -urNp linux-2.6.32.28/drivers/uio/uio.c linux-2.6.32.28/drivers/uio/uio.c
  	.show = map_type_show,
  };
  
-@@ -217,7 +217,7 @@ static ssize_t portio_type_show(struct k
+@@ -217,7 +218,7 @@ static ssize_t portio_type_show(struct k
  	return entry->show(port, buf);
  }
  
@@ -29325,6 +29511,22 @@ diff -urNp linux-2.6.32.28/drivers/uio/uio.c linux-2.6.32.28/drivers/uio/uio.c
  	.show = portio_type_show,
  };
  
+@@ -624,13 +625,13 @@ static int uio_find_mem_index(struct vm_
+ static void uio_vma_open(struct vm_area_struct *vma)
+ {
+ 	struct uio_device *idev = vma->vm_private_data;
+-	idev->vma_count++;
++	local_inc(&idev->vma_count);
+ }
+ 
+ static void uio_vma_close(struct vm_area_struct *vma)
+ {
+ 	struct uio_device *idev = vma->vm_private_data;
+-	idev->vma_count--;
++	local_dec(&idev->vma_count);
+ }
+ 
+ static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 diff -urNp linux-2.6.32.28/drivers/usb/atm/usbatm.c linux-2.6.32.28/drivers/usb/atm/usbatm.c
 --- linux-2.6.32.28/drivers/usb/atm/usbatm.c	2010-08-13 16:24:37.000000000 -0400
 +++ linux-2.6.32.28/drivers/usb/atm/usbatm.c	2010-12-31 14:46:53.000000000 -0500
@@ -29565,6 +29767,18 @@ diff -urNp linux-2.6.32.28/drivers/usb/misc/appledisplay.c linux-2.6.32.28/drive
  	.get_brightness	= appledisplay_bl_get_brightness,
  	.update_status	= appledisplay_bl_update_status,
  };
+diff -urNp linux-2.6.32.28/drivers/usb/misc/iowarrior.c linux-2.6.32.28/drivers/usb/misc/iowarrior.c
+--- linux-2.6.32.28/drivers/usb/misc/iowarrior.c	2010-12-09 18:13:03.000000000 -0500
++++ linux-2.6.32.28/drivers/usb/misc/iowarrior.c	2011-01-25 17:27:31.000000000 -0500
+@@ -373,7 +373,7 @@ static ssize_t iowarrior_write(struct fi
+ 	case USB_DEVICE_ID_CODEMERCS_IOWPV2:
+ 	case USB_DEVICE_ID_CODEMERCS_IOW40:
+ 		/* IOW24 and IOW40 use a synchronous call */
+-		buf = kmalloc(8, GFP_KERNEL);	/* 8 bytes are enough for both products */
++		buf = kmalloc(count, GFP_KERNEL);
+ 		if (!buf) {
+ 			retval = -ENOMEM;
+ 			goto exit;
 diff -urNp linux-2.6.32.28/drivers/usb/mon/mon_main.c linux-2.6.32.28/drivers/usb/mon/mon_main.c
 --- linux-2.6.32.28/drivers/usb/mon/mon_main.c	2010-08-13 16:24:37.000000000 -0400
 +++ linux-2.6.32.28/drivers/usb/mon/mon_main.c	2010-12-31 14:46:53.000000000 -0500
@@ -46729,8 +46943,16 @@ diff -urNp linux-2.6.32.28/include/drm/drm_pciids.h linux-2.6.32.28/include/drm/
 +	{0, 0, 0, 0, 0, 0}
 diff -urNp linux-2.6.32.28/include/drm/drmP.h linux-2.6.32.28/include/drm/drmP.h
 --- linux-2.6.32.28/include/drm/drmP.h	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/include/drm/drmP.h	2010-12-31 14:46:53.000000000 -0500
-@@ -814,7 +814,7 @@ struct drm_driver {
++++ linux-2.6.32.28/include/drm/drmP.h	2011-01-24 18:05:37.000000000 -0500
+@@ -71,6 +71,7 @@
+ #include <linux/workqueue.h>
+ #include <linux/poll.h>
+ #include <asm/pgalloc.h>
++#include <asm/local.h>
+ #include "drm.h"
+ 
+ #include <linux/idr.h>
+@@ -814,7 +815,7 @@ struct drm_driver {
  	void (*vgaarb_irq)(struct drm_device *dev, bool state);
  
  	/* Driver private ops for this object */
@@ -46739,16 +46961,16 @@ diff -urNp linux-2.6.32.28/include/drm/drmP.h linux-2.6.32.28/include/drm/drmP.h
  
  	int major;
  	int minor;
-@@ -917,7 +917,7 @@ struct drm_device {
+@@ -917,7 +918,7 @@ struct drm_device {
  
  	/** \name Usage Counters */
  	/*@{ */
 -	int open_count;			/**< Outstanding files open */
-+	atomic_t open_count;		/**< Outstanding files open */
++	local_t open_count;		/**< Outstanding files open */
  	atomic_t ioctl_count;		/**< Outstanding IOCTLs pending */
  	atomic_t vma_count;		/**< Outstanding vma areas open */
  	int buf_use;			/**< Buffers in use -- cannot alloc */
-@@ -928,7 +928,7 @@ struct drm_device {
+@@ -928,7 +929,7 @@ struct drm_device {
  	/*@{ */
  	unsigned long counters;
  	enum drm_stat_type types[15];
@@ -46757,6 +46979,21 @@ diff -urNp linux-2.6.32.28/include/drm/drmP.h linux-2.6.32.28/include/drm/drmP.h
  	/*@} */
  
  	struct list_head filelist;
+@@ -1042,11 +1043,11 @@ struct drm_device {
+ 	spinlock_t object_name_lock;
+ 	struct idr object_name_idr;
+ 	atomic_t object_count;
+-	atomic_t object_memory;
++	atomic_unchecked_t object_memory;
+ 	atomic_t pin_count;
+-	atomic_t pin_memory;
++	atomic_unchecked_t pin_memory;
+ 	atomic_t gtt_count;
+-	atomic_t gtt_memory;
++	atomic_unchecked_t gtt_memory;
+ 	uint32_t gtt_total;
+ 	uint32_t invalidate_domains;    /* domains pending invalidation */
+ 	uint32_t flush_domains;         /* domains pending flush */
 diff -urNp linux-2.6.32.28/include/linux/a.out.h linux-2.6.32.28/include/linux/a.out.h
 --- linux-2.6.32.28/include/linux/a.out.h	2010-08-13 16:24:37.000000000 -0400
 +++ linux-2.6.32.28/include/linux/a.out.h	2010-12-31 14:46:53.000000000 -0500
@@ -48479,6 +48716,23 @@ diff -urNp linux-2.6.32.28/include/linux/interrupt.h linux-2.6.32.28/include/lin
  extern void softirq_init(void);
  #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
  extern void raise_softirq_irqoff(unsigned int nr);
+diff -urNp linux-2.6.32.28/include/linux/irq.h linux-2.6.32.28/include/linux/irq.h
+--- linux-2.6.32.28/include/linux/irq.h	2010-08-13 16:24:37.000000000 -0400
++++ linux-2.6.32.28/include/linux/irq.h	2011-01-24 18:05:37.000000000 -0500
+@@ -438,12 +438,12 @@ extern int set_irq_msi(unsigned int irq,
+ static inline bool alloc_desc_masks(struct irq_desc *desc, int node,
+ 							bool boot)
+ {
++#ifdef CONFIG_CPUMASK_OFFSTACK
+ 	gfp_t gfp = GFP_ATOMIC;
+ 
+ 	if (boot)
+ 		gfp = GFP_NOWAIT;
+ 
+-#ifdef CONFIG_CPUMASK_OFFSTACK
+ 	if (!alloc_cpumask_var_node(&desc->affinity, gfp, node))
+ 		return false;
+ 
 diff -urNp linux-2.6.32.28/include/linux/jbd2.h linux-2.6.32.28/include/linux/jbd2.h
 --- linux-2.6.32.28/include/linux/jbd2.h	2010-08-13 16:24:37.000000000 -0400
 +++ linux-2.6.32.28/include/linux/jbd2.h	2010-12-31 14:46:53.000000000 -0500
@@ -50119,15 +50373,23 @@ diff -urNp linux-2.6.32.28/include/net/inetpeer.h linux-2.6.32.28/include/net/in
  };
 diff -urNp linux-2.6.32.28/include/net/irda/ircomm_tty.h linux-2.6.32.28/include/net/irda/ircomm_tty.h
 --- linux-2.6.32.28/include/net/irda/ircomm_tty.h	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/include/net/irda/ircomm_tty.h	2010-12-31 14:46:53.000000000 -0500
-@@ -105,8 +105,8 @@ struct ircomm_tty_cb {
++++ linux-2.6.32.28/include/net/irda/ircomm_tty.h	2011-01-25 20:24:47.000000000 -0500
+@@ -35,6 +35,7 @@
+ #include <linux/termios.h>
+ #include <linux/timer.h>
+ #include <linux/tty.h>		/* struct tty_struct */
++#include <asm/local.h>
+ 
+ #include <net/irda/irias_object.h>
+ #include <net/irda/ircomm_core.h>
+@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
          unsigned short    close_delay;
          unsigned short    closing_wait; /* time to wait before closing */
  
 -	int  open_count;
 -	int  blocked_open;	/* # of blocked opens */
-+	atomic_t open_count;
-+	atomic_t blocked_open;	/* # of blocked opens */
++	local_t open_count;
++	local_t blocked_open;	/* # of blocked opens */
  
  	/* Protect concurent access to :
  	 *	o self->open_count
@@ -54853,7 +55115,7 @@ diff -urNp linux-2.6.32.28/mm/migrate.c linux-2.6.32.28/mm/migrate.c
  		goto out;
 diff -urNp linux-2.6.32.28/mm/mlock.c linux-2.6.32.28/mm/mlock.c
 --- linux-2.6.32.28/mm/mlock.c	2010-10-31 16:44:11.000000000 -0400
-+++ linux-2.6.32.28/mm/mlock.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/mm/mlock.c	2011-01-24 18:05:37.000000000 -0500
 @@ -13,6 +13,7 @@
  #include <linux/pagemap.h>
  #include <linux/mempolicy.h>
@@ -54889,6 +55151,15 @@ diff -urNp linux-2.6.32.28/mm/mlock.c linux-2.6.32.28/mm/mlock.c
  	while (nr_pages > 0) {
  		int i;
  
+@@ -440,7 +428,7 @@ static int do_mlock(unsigned long start,
+ {
+ 	unsigned long nstart, end, tmp;
+ 	struct vm_area_struct * vma, * prev;
+-	int error;
++	int error = -EINVAL;
+ 
+ 	len = PAGE_ALIGN(len);
+ 	end = start + len;
 @@ -448,6 +436,9 @@ static int do_mlock(unsigned long start,
  		return -EINVAL;
  	if (end == start)
@@ -56595,7 +56866,7 @@ diff -urNp linux-2.6.32.28/mm/rmap.c linux-2.6.32.28/mm/rmap.c
  			allocated = NULL;
 diff -urNp linux-2.6.32.28/mm/shmem.c linux-2.6.32.28/mm/shmem.c
 --- linux-2.6.32.28/mm/shmem.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/mm/shmem.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/mm/shmem.c	2011-01-24 18:05:37.000000000 -0500
 @@ -31,7 +31,7 @@
  #include <linux/swap.h>
  #include <linux/ima.h>
@@ -56605,6 +56876,15 @@ diff -urNp linux-2.6.32.28/mm/shmem.c linux-2.6.32.28/mm/shmem.c
  
  #ifdef CONFIG_SHMEM
  /*
+@@ -1061,6 +1061,8 @@ static int shmem_writepage(struct page *
+ 		goto unlock;
+ 	}
+ 	entry = shmem_swp_entry(info, index, NULL);
++	if (!entry)
++		goto unlock;
+ 	if (entry->val) {
+ 		/*
+ 		 * The more uptodate page coming down from a stacked
 diff -urNp linux-2.6.32.28/mm/slab.c linux-2.6.32.28/mm/slab.c
 --- linux-2.6.32.28/mm/slab.c	2010-08-29 21:08:20.000000000 -0400
 +++ linux-2.6.32.28/mm/slab.c	2010-12-31 14:46:53.000000000 -0500
@@ -58424,24 +58704,24 @@ diff -urNp linux-2.6.32.28/net/irda/af_irda.c linux-2.6.32.28/net/irda/af_irda.c
  		{
 diff -urNp linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c
 --- linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c	2011-01-24 18:05:37.000000000 -0500
 @@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(st
  	add_wait_queue(&self->open_wait, &wait);
  
  	IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
 -	      __FILE__,__LINE__, tty->driver->name, self->open_count );
-+	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
++	      __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
  
  	/* As far as I can see, we protect open_count - Jean II */
  	spin_lock_irqsave(&self->spinlock, flags);
  	if (!tty_hung_up_p(filp)) {
  		extra_count = 1;
 -		self->open_count--;
-+		atomic_dec(&self->open_count);
++		local_dec(&self->open_count);
  	}
  	spin_unlock_irqrestore(&self->spinlock, flags);
 -	self->blocked_open++;
-+	atomic_inc(&self->blocked_open);
++	local_inc(&self->blocked_open);
  
  	while (1) {
  		if (tty->termios->c_cflag & CBAUD) {
@@ -58450,7 +58730,7 @@ diff -urNp linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c linux-2.6.32.28/net/irda
  
  		IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
 -		      __FILE__,__LINE__, tty->driver->name, self->open_count );
-+		      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
++		      __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
  
  		schedule();
  	}
@@ -58459,15 +58739,15 @@ diff -urNp linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c linux-2.6.32.28/net/irda
  		/* ++ is not atomic, so this should be protected - Jean II */
  		spin_lock_irqsave(&self->spinlock, flags);
 -		self->open_count++;
-+		atomic_inc(&self->open_count);
++		local_inc(&self->open_count);
  		spin_unlock_irqrestore(&self->spinlock, flags);
  	}
 -	self->blocked_open--;
-+	atomic_dec(&self->blocked_open);
++	local_dec(&self->blocked_open);
  
  	IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
 -	      __FILE__,__LINE__, tty->driver->name, self->open_count);
-+	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count));
++	      __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
  
  	if (!retval)
  		self->flags |= ASYNC_NORMAL_ACTIVE;
@@ -58476,7 +58756,7 @@ diff -urNp linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c linux-2.6.32.28/net/irda
  	/* ++ is not atomic, so this should be protected - Jean II */
  	spin_lock_irqsave(&self->spinlock, flags);
 -	self->open_count++;
-+	atomic_inc(&self->open_count);
++	local_inc(&self->open_count);
  
  	tty->driver_data = self;
  	self->tty = tty;
@@ -58484,7 +58764,7 @@ diff -urNp linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c linux-2.6.32.28/net/irda
  
  	IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
 -		   self->line, self->open_count);
-+		   self->line, atomic_read(&self->open_count));
++		   self->line, local_read(&self->open_count));
  
  	/* Not really used by us, but lets do it anyway */
  	self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
@@ -58493,7 +58773,7 @@ diff -urNp linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c linux-2.6.32.28/net/irda
  	}
  
 -	if ((tty->count == 1) && (self->open_count != 1)) {
-+	if ((tty->count == 1) && (atomic_read(&self->open_count) != 1)) {
++	if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
  		/*
  		 * Uh, oh.  tty->count is 1, which means that the tty
  		 * structure will be freed.  state->count should always
@@ -58503,20 +58783,20 @@ diff -urNp linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c linux-2.6.32.28/net/irda
  			   "tty->count is 1, state->count is %d\n", __func__ ,
 -			   self->open_count);
 -		self->open_count = 1;
-+			   atomic_read(&self->open_count));
-+		atomic_set(&self->open_count, 1);
++			   local_read(&self->open_count));
++		local_set(&self->open_count, 1);
  	}
  
 -	if (--self->open_count < 0) {
-+	if (atomic_dec_return(&self->open_count) < 0) {
++	if (local_dec_return(&self->open_count) < 0) {
  		IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
 -			   __func__, self->line, self->open_count);
 -		self->open_count = 0;
-+			   __func__, self->line, atomic_read(&self->open_count));
-+		atomic_set(&self->open_count, 0);
++			   __func__, self->line, local_read(&self->open_count));
++		local_set(&self->open_count, 0);
  	}
 -	if (self->open_count) {
-+	if (atomic_read(&self->open_count)) {
++	if (local_read(&self->open_count)) {
  		spin_unlock_irqrestore(&self->spinlock, flags);
  
  		IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
@@ -58525,7 +58805,7 @@ diff -urNp linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c linux-2.6.32.28/net/irda
  	self->tty = NULL;
  
 -	if (self->blocked_open) {
-+	if (atomic_read(&self->blocked_open)) {
++	if (local_read(&self->blocked_open)) {
  		if (self->close_delay)
  			schedule_timeout_interruptible(self->close_delay);
  		wake_up_interruptible(&self->open_wait);
@@ -58534,7 +58814,7 @@ diff -urNp linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c linux-2.6.32.28/net/irda
  	self->flags &= ~ASYNC_NORMAL_ACTIVE;
  	self->tty = NULL;
 -	self->open_count = 0;
-+	atomic_set(&self->open_count, 0);
++	local_set(&self->open_count, 0);
  	spin_unlock_irqrestore(&self->spinlock, flags);
  
  	wake_up_interruptible(&self->open_wait);
@@ -58543,7 +58823,7 @@ diff -urNp linux-2.6.32.28/net/irda/ircomm/ircomm_tty.c linux-2.6.32.28/net/irda
  
  	seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
 -	seq_printf(m, "Open count: %d\n", self->open_count);
-+	seq_printf(m, "Open count: %d\n", atomic_read(&self->open_count));
++	seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
  	seq_printf(m, "Max data size: %d\n", self->max_data_size);
  	seq_printf(m, "Max header size: %d\n", self->max_header_size);
  
@@ -58582,25 +58862,33 @@ diff -urNp linux-2.6.32.28/net/mac80211/debugfs_key.c linux-2.6.32.28/net/mac802
  		p += scnprintf(p, bufsize + buf - p, "%02x", key->conf.key[i]);
 diff -urNp linux-2.6.32.28/net/mac80211/ieee80211_i.h linux-2.6.32.28/net/mac80211/ieee80211_i.h
 --- linux-2.6.32.28/net/mac80211/ieee80211_i.h	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/net/mac80211/ieee80211_i.h	2010-12-31 14:46:53.000000000 -0500
-@@ -635,7 +635,7 @@ struct ieee80211_local {
++++ linux-2.6.32.28/net/mac80211/ieee80211_i.h	2011-01-24 18:05:37.000000000 -0500
+@@ -25,6 +25,7 @@
+ #include <linux/etherdevice.h>
+ #include <net/cfg80211.h>
+ #include <net/mac80211.h>
++#include <asm/local.h>
+ #include "key.h"
+ #include "sta_info.h"
+ 
+@@ -635,7 +636,7 @@ struct ieee80211_local {
  	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
  	spinlock_t queue_stop_reason_lock;
  
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	int monitors, cooked_mntrs;
  	/* number of interfaces with corresponding FIF_ flags */
  	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
 diff -urNp linux-2.6.32.28/net/mac80211/iface.c linux-2.6.32.28/net/mac80211/iface.c
 --- linux-2.6.32.28/net/mac80211/iface.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/net/mac80211/iface.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/net/mac80211/iface.c	2011-01-24 18:05:37.000000000 -0500
 @@ -166,7 +166,7 @@ static int ieee80211_open(struct net_dev
  		break;
  	}
  
 -	if (local->open_count == 0) {
-+	if (atomic_read(&local->open_count) == 0) {
++	if (local_read(&local->open_count) == 0) {
  		res = drv_start(local);
  		if (res)
  			goto err_del_bss;
@@ -58609,7 +58897,7 @@ diff -urNp linux-2.6.32.28/net/mac80211/iface.c linux-2.6.32.28/net/mac80211/ifa
  	 */
  	if (!is_valid_ether_addr(dev->dev_addr)) {
 -		if (!local->open_count)
-+		if (!atomic_read(&local->open_count))
++		if (!local_read(&local->open_count))
  			drv_stop(local);
  		return -EADDRNOTAVAIL;
  	}
@@ -58618,7 +58906,7 @@ diff -urNp linux-2.6.32.28/net/mac80211/iface.c linux-2.6.32.28/net/mac80211/ifa
  	hw_reconf_flags |= __ieee80211_recalc_idle(local);
  
 -	local->open_count++;
-+	atomic_inc(&local->open_count);
++	local_inc(&local->open_count);
  	if (hw_reconf_flags) {
  		ieee80211_hw_config(local, hw_reconf_flags);
  		/*
@@ -58627,7 +58915,7 @@ diff -urNp linux-2.6.32.28/net/mac80211/iface.c linux-2.6.32.28/net/mac80211/ifa
  	drv_remove_interface(local, &conf);
   err_stop:
 -	if (!local->open_count)
-+	if (!atomic_read(&local->open_count))
++	if (!local_read(&local->open_count))
  		drv_stop(local);
   err_del_bss:
  	sdata->bss = NULL;
@@ -58636,7 +58924,7 @@ diff -urNp linux-2.6.32.28/net/mac80211/iface.c linux-2.6.32.28/net/mac80211/ifa
  	}
  
 -	local->open_count--;
-+	atomic_dec(&local->open_count);
++	local_dec(&local->open_count);
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
@@ -58645,43 +58933,43 @@ diff -urNp linux-2.6.32.28/net/mac80211/iface.c linux-2.6.32.28/net/mac80211/ifa
  	ieee80211_recalc_ps(local, -1);
  
 -	if (local->open_count == 0) {
-+	if (atomic_read(&local->open_count) == 0) {
++	if (local_read(&local->open_count) == 0) {
  		ieee80211_clear_tx_pending(local);
  		ieee80211_stop_device(local);
  
 diff -urNp linux-2.6.32.28/net/mac80211/main.c linux-2.6.32.28/net/mac80211/main.c
 --- linux-2.6.32.28/net/mac80211/main.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/net/mac80211/main.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/net/mac80211/main.c	2011-01-24 18:05:37.000000000 -0500
 @@ -145,7 +145,7 @@ int ieee80211_hw_config(struct ieee80211
  		local->hw.conf.power_level = power;
  	}
  
 -	if (changed && local->open_count) {
-+	if (changed && atomic_read(&local->open_count)) {
++	if (changed && local_read(&local->open_count)) {
  		ret = drv_config(local, changed);
  		/*
  		 * Goal:
 diff -urNp linux-2.6.32.28/net/mac80211/pm.c linux-2.6.32.28/net/mac80211/pm.c
 --- linux-2.6.32.28/net/mac80211/pm.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/net/mac80211/pm.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/net/mac80211/pm.c	2011-01-24 18:05:37.000000000 -0500
 @@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211
  	}
  
  	/* stop hardware - this must stop RX */
 -	if (local->open_count)
-+	if (atomic_read(&local->open_count))
++	if (local_read(&local->open_count))
  		ieee80211_stop_device(local);
  
  	local->suspended = true;
 diff -urNp linux-2.6.32.28/net/mac80211/rate.c linux-2.6.32.28/net/mac80211/rate.c
 --- linux-2.6.32.28/net/mac80211/rate.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/net/mac80211/rate.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/net/mac80211/rate.c	2011-01-24 18:05:37.000000000 -0500
 @@ -287,7 +287,7 @@ int ieee80211_init_rate_ctrl_alg(struct 
  	struct rate_control_ref *ref, *old;
  
  	ASSERT_RTNL();
 -	if (local->open_count)
-+	if (atomic_read(&local->open_count))
++	if (local_read(&local->open_count))
  		return -EBUSY;
  
  	ref = rate_control_alloc(name, local);
@@ -58699,13 +58987,13 @@ diff -urNp linux-2.6.32.28/net/mac80211/tx.c linux-2.6.32.28/net/mac80211/tx.c
  	return local == wdev_priv(dev->ieee80211_ptr);
 diff -urNp linux-2.6.32.28/net/mac80211/util.c linux-2.6.32.28/net/mac80211/util.c
 --- linux-2.6.32.28/net/mac80211/util.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/net/mac80211/util.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/net/mac80211/util.c	2011-01-24 18:05:37.000000000 -0500
 @@ -1042,7 +1042,7 @@ int ieee80211_reconfig(struct ieee80211_
  		local->resuming = true;
  
  	/* restart hardware */
 -	if (local->open_count) {
-+	if (atomic_read(&local->open_count)) {
++	if (local_read(&local->open_count)) {
  		/*
  		 * Upon resume hardware can sometimes be goofy due to
  		 * various platform / driver / bus issues, so restarting
@@ -60376,13 +60664,13 @@ diff -urNp linux-2.6.32.28/security/tomoyo/tomoyo.c linux-2.6.32.28/security/tom
  	.cred_prepare        = tomoyo_cred_prepare,
 diff -urNp linux-2.6.32.28/sound/aoa/codecs/onyx.c linux-2.6.32.28/sound/aoa/codecs/onyx.c
 --- linux-2.6.32.28/sound/aoa/codecs/onyx.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/sound/aoa/codecs/onyx.c	2010-12-31 14:46:53.000000000 -0500
++++ linux-2.6.32.28/sound/aoa/codecs/onyx.c	2011-01-24 18:05:37.000000000 -0500
 @@ -53,7 +53,7 @@ struct onyx {
  				spdif_locked:1,
  				analog_locked:1,
  				original_mute:2;
 -	int			open_count;
-+	atomic_t		open_count;
++	local_t			open_count;
  	struct codec_info	*codec_info;
  
  	/* mutex serializes concurrent access to the device
@@ -60391,7 +60679,7 @@ diff -urNp linux-2.6.32.28/sound/aoa/codecs/onyx.c linux-2.6.32.28/sound/aoa/cod
  
  	mutex_lock(&onyx->mutex);
 -	onyx->open_count++;
-+	atomic_inc(&onyx->open_count);
++	local_inc(&onyx->open_count);
  	mutex_unlock(&onyx->mutex);
  
  	return 0;
@@ -60401,10 +60689,21 @@ diff -urNp linux-2.6.32.28/sound/aoa/codecs/onyx.c linux-2.6.32.28/sound/aoa/cod
  	mutex_lock(&onyx->mutex);
 -	onyx->open_count--;
 -	if (!onyx->open_count)
-+	if (atomic_dec_and_test(&onyx->open_count))
++	if (local_dec_and_test(&onyx->open_count))
  		onyx->spdif_locked = onyx->analog_locked = 0;
  	mutex_unlock(&onyx->mutex);
  
+diff -urNp linux-2.6.32.28/sound/aoa/codecs/onyx.h linux-2.6.32.28/sound/aoa/codecs/onyx.h
+--- linux-2.6.32.28/sound/aoa/codecs/onyx.h	2010-08-13 16:24:37.000000000 -0400
++++ linux-2.6.32.28/sound/aoa/codecs/onyx.h	2011-01-25 20:24:47.000000000 -0500
+@@ -11,6 +11,7 @@
+ #include <linux/i2c.h>
+ #include <asm/pmac_low_i2c.h>
+ #include <asm/prom.h>
++#include <asm/local.h>
+ 
+ /* PCM3052 register definitions */
+ 
 diff -urNp linux-2.6.32.28/sound/core/oss/pcm_oss.c linux-2.6.32.28/sound/core/oss/pcm_oss.c
 --- linux-2.6.32.28/sound/core/oss/pcm_oss.c	2010-08-13 16:24:37.000000000 -0400
 +++ linux-2.6.32.28/sound/core/oss/pcm_oss.c	2010-12-31 14:46:53.000000000 -0500
@@ -60439,64 +60738,80 @@ diff -urNp linux-2.6.32.28/sound/core/seq/seq_lock.h linux-2.6.32.28/sound/core/
  
 diff -urNp linux-2.6.32.28/sound/drivers/mts64.c linux-2.6.32.28/sound/drivers/mts64.c
 --- linux-2.6.32.28/sound/drivers/mts64.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/sound/drivers/mts64.c	2010-12-31 14:46:53.000000000 -0500
-@@ -65,7 +65,7 @@ struct mts64 {
++++ linux-2.6.32.28/sound/drivers/mts64.c	2011-01-25 22:35:30.000000000 -0500
+@@ -27,6 +27,7 @@
+ #include <sound/initval.h>
+ #include <sound/rawmidi.h>
+ #include <sound/control.h>
++#include <asm/local.h>
+ 
+ #define CARD_NAME "Miditerminal 4140"
+ #define DRIVER_NAME "MTS64"
+@@ -65,7 +66,7 @@ struct mts64 {
  	struct pardevice *pardev;
  	int pardev_claimed;
  
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	int current_midi_output_port;
  	int current_midi_input_port;
  	u8 mode[MTS64_NUM_INPUT_PORTS];
-@@ -695,7 +695,7 @@ static int snd_mts64_rawmidi_open(struct
+@@ -695,7 +696,7 @@ static int snd_mts64_rawmidi_open(struct
  {
  	struct mts64 *mts = substream->rmidi->private_data;
  
 -	if (mts->open_count == 0) {
-+	if (atomic_read(&mts->open_count) == 0) {
++	if (local_read(&mts->open_count) == 0) {
  		/* We don't need a spinlock here, because this is just called 
  		   if the device has not been opened before. 
  		   So there aren't any IRQs from the device */
-@@ -703,7 +703,7 @@ static int snd_mts64_rawmidi_open(struct
+@@ -703,7 +704,7 @@ static int snd_mts64_rawmidi_open(struct
  
  		msleep(50);
  	}
 -	++(mts->open_count);
-+	atomic_inc(&mts->open_count);
++	local_inc(&mts->open_count);
  
  	return 0;
  }
-@@ -713,8 +713,7 @@ static int snd_mts64_rawmidi_close(struc
+@@ -713,8 +714,7 @@ static int snd_mts64_rawmidi_close(struc
  	struct mts64 *mts = substream->rmidi->private_data;
  	unsigned long flags;
  
 -	--(mts->open_count);
 -	if (mts->open_count == 0) {
-+	if (atomic_dec_return(&mts->open_count) == 0) {
++	if (local_dec_return(&mts->open_count) == 0) {
  		/* We need the spinlock_irqsave here because we can still
  		   have IRQs at this point */
  		spin_lock_irqsave(&mts->lock, flags);
-@@ -723,8 +722,8 @@ static int snd_mts64_rawmidi_close(struc
+@@ -723,8 +723,8 @@ static int snd_mts64_rawmidi_close(struc
  
  		msleep(500);
  
 -	} else if (mts->open_count < 0)
 -		mts->open_count = 0;
-+	} else if (atomic_read(&mts->open_count) < 0)
-+		atomic_set(&mts->open_count, 0);
++	} else if (local_read(&mts->open_count) < 0)
++		local_set(&mts->open_count, 0);
  
  	return 0;
  }
 diff -urNp linux-2.6.32.28/sound/drivers/portman2x4.c linux-2.6.32.28/sound/drivers/portman2x4.c
 --- linux-2.6.32.28/sound/drivers/portman2x4.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.28/sound/drivers/portman2x4.c	2010-12-31 14:46:53.000000000 -0500
-@@ -83,7 +83,7 @@ struct portman {
++++ linux-2.6.32.28/sound/drivers/portman2x4.c	2011-01-25 20:24:47.000000000 -0500
+@@ -46,6 +46,7 @@
+ #include <sound/initval.h>
+ #include <sound/rawmidi.h>
+ #include <sound/control.h>
++#include <asm/local.h>
+ 
+ #define CARD_NAME "Portman 2x4"
+ #define DRIVER_NAME "portman"
+@@ -83,7 +84,7 @@ struct portman {
  	struct pardevice *pardev;
  	int pardev_claimed;
  
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	int mode[PORTMAN_NUM_INPUT_PORTS];
  	struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
  };
diff --git a/2.6.37/0000_README b/2.6.37/0000_README
index 587d47a..6bc9c6e 100644
--- a/2.6.37/0000_README
+++ b/2.6.37/0000_README
@@ -3,7 +3,7 @@ README
 
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-2.2.1-2.6.37-201101172105.patch
+Patch:	4420_grsecurity-2.2.1-2.6.37-201101252237.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/2.6.37/4420_grsecurity-2.2.1-2.6.37-201101172105.patch b/2.6.37/4420_grsecurity-2.2.1-2.6.37-201101252237.patch
index 3e2bbf5..a709d1d 100644
--- a/2.6.37/4420_grsecurity-2.2.1-2.6.37-201101172105.patch
+++ b/2.6.37/4420_grsecurity-2.2.1-2.6.37-201101252237.patch
@@ -7638,7 +7638,7 @@ diff -urNp linux-2.6.37/arch/x86/include/asm/elf.h linux-2.6.37/arch/x86/include
  #endif /* _ASM_X86_ELF_H */
 diff -urNp linux-2.6.37/arch/x86/include/asm/futex.h linux-2.6.37/arch/x86/include/asm/futex.h
 --- linux-2.6.37/arch/x86/include/asm/futex.h	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/arch/x86/include/asm/futex.h	2011-01-17 02:41:00.000000000 -0500
++++ linux-2.6.37/arch/x86/include/asm/futex.h	2011-01-25 20:24:56.000000000 -0500
 @@ -12,16 +12,18 @@
  #include <asm/system.h>
  
@@ -7651,7 +7651,7 @@ diff -urNp linux-2.6.37/arch/x86/include/asm/futex.h linux-2.6.37/arch/x86/inclu
  		     "\t.previous\n"				\
  		     _ASM_EXTABLE(1b, 3b)			\
 -		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
-+		     : "=r" (oldval), "=r" (ret), "+m" (*____m(uaddr))\
++		     : "=r" (oldval), "=r" (ret), "+m" (*(u32 *)____m(uaddr))\
  		     : "i" (-EFAULT), "0" (oparg), "1" (0))
  
  #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
@@ -7664,7 +7664,7 @@ diff -urNp linux-2.6.37/arch/x86/include/asm/futex.h linux-2.6.37/arch/x86/inclu
  		     _ASM_EXTABLE(2b, 4b)			\
  		     : "=&a" (oldval), "=&r" (ret),		\
 -		       "+m" (*uaddr), "=&r" (tem)		\
-+		       "+m" (*(____m(uaddr))), "=&r" (tem)	\
++		       "+m" (*(u32 *)____m(uaddr)), "=&r" (tem)	\
  		     : "r" (oparg), "i" (-EFAULT), "1" (0))
  
 -static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
@@ -7710,7 +7710,7 @@ diff -urNp linux-2.6.37/arch/x86/include/asm/futex.h linux-2.6.37/arch/x86/inclu
  		     "\t.previous\n"
  		     _ASM_EXTABLE(1b, 3b)
 -		     : "=a" (oldval), "+m" (*uaddr)
-+		     : "=a" (oldval), "+m" (*____m(uaddr))
++		     : "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
  		     : "i" (-EFAULT), "r" (newval), "0" (oldval)
  		     : "memory"
  	);
@@ -10759,8 +10759,16 @@ diff -urNp linux-2.6.37/arch/x86/kernel/cpu/Makefile linux-2.6.37/arch/x86/kerne
  obj-y			+= vmware.o hypervisor.o sched.o mshyperv.o
 diff -urNp linux-2.6.37/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.37/arch/x86/kernel/cpu/mcheck/mce.c
 --- linux-2.6.37/arch/x86/kernel/cpu/mcheck/mce.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/arch/x86/kernel/cpu/mcheck/mce.c	2011-01-17 02:41:01.000000000 -0500
-@@ -219,7 +219,7 @@ static void print_mce(struct mce *m)
++++ linux-2.6.37/arch/x86/kernel/cpu/mcheck/mce.c	2011-01-25 20:24:56.000000000 -0500
+@@ -45,6 +45,7 @@
+ #include <asm/ipi.h>
+ #include <asm/mce.h>
+ #include <asm/msr.h>
++#include <asm/local.h>
+ 
+ #include "mce-internal.h"
+ 
+@@ -219,7 +220,7 @@ static void print_mce(struct mce *m)
  			!(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
  				m->cs, m->ip);
  
@@ -10769,12 +10777,12 @@ diff -urNp linux-2.6.37/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.37/arch/x86/k
  			print_symbol("{%s}", m->ip);
  		pr_cont("\n");
  	}
-@@ -1460,14 +1460,14 @@ void __cpuinit mcheck_cpu_init(struct cp
+@@ -1460,14 +1461,14 @@ void __cpuinit mcheck_cpu_init(struct cp
   */
  
  static DEFINE_SPINLOCK(mce_state_lock);
 -static int		open_count;		/* #times opened */
-+static atomic_t		open_count;		/* #times opened */
++static local_t		open_count;		/* #times opened */
  static int		open_exclu;		/* already open exclusive? */
  
  static int mce_open(struct inode *inode, struct file *file)
@@ -10782,29 +10790,29 @@ diff -urNp linux-2.6.37/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.37/arch/x86/k
  	spin_lock(&mce_state_lock);
  
 -	if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
-+	if (open_exclu || (atomic_read(&open_count) && (file->f_flags & O_EXCL))) {
++	if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
  		spin_unlock(&mce_state_lock);
  
  		return -EBUSY;
-@@ -1475,7 +1475,7 @@ static int mce_open(struct inode *inode,
+@@ -1475,7 +1476,7 @@ static int mce_open(struct inode *inode,
  
  	if (file->f_flags & O_EXCL)
  		open_exclu = 1;
 -	open_count++;
-+	atomic_inc(&open_count);
++	local_inc(&open_count);
  
  	spin_unlock(&mce_state_lock);
  
-@@ -1486,7 +1486,7 @@ static int mce_release(struct inode *ino
+@@ -1486,7 +1487,7 @@ static int mce_release(struct inode *ino
  {
  	spin_lock(&mce_state_lock);
  
 -	open_count--;
-+	atomic_dec(&open_count);
++	local_dec(&open_count);
  	open_exclu = 0;
  
  	spin_unlock(&mce_state_lock);
-@@ -1673,6 +1673,7 @@ static struct miscdevice mce_log_device 
+@@ -1673,6 +1674,7 @@ static struct miscdevice mce_log_device 
  	MISC_MCELOG_MINOR,
  	"mcelog",
  	&mce_chrdev_ops,
@@ -11971,7 +11979,7 @@ diff -urNp linux-2.6.37/arch/x86/kernel/head32.c linux-2.6.37/arch/x86/kernel/he
  	/* Reserve INITRD */
 diff -urNp linux-2.6.37/arch/x86/kernel/head_32.S linux-2.6.37/arch/x86/kernel/head_32.S
 --- linux-2.6.37/arch/x86/kernel/head_32.S	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/arch/x86/kernel/head_32.S	2011-01-17 02:41:01.000000000 -0500
++++ linux-2.6.37/arch/x86/kernel/head_32.S	2011-01-25 20:24:56.000000000 -0500
 @@ -25,6 +25,12 @@
  /* Physical address */
  #define pa(X) ((X) - __PAGE_OFFSET)
@@ -12262,7 +12270,7 @@ diff -urNp linux-2.6.37/arch/x86/kernel/head_32.S linux-2.6.37/arch/x86/kernel/h
  	pushl 16(%esp)
  	pushl 24(%esp)
  	pushl 32(%esp)
-@@ -619,29 +694,42 @@ ENTRY(initial_code)
+@@ -619,29 +694,43 @@ ENTRY(initial_code)
  /*
   * BSS section
   */
@@ -12273,6 +12281,7 @@ diff -urNp linux-2.6.37/arch/x86/kernel/head_32.S linux-2.6.37/arch/x86/kernel/h
  ENTRY(initial_pg_pmd)
  	.fill 1024*KPMDS,4,0
  #else
++.section .initial_page_table,"a",@progbits
  ENTRY(initial_page_table)
  	.fill 1024,4,0
  #endif
@@ -12310,7 +12319,7 @@ diff -urNp linux-2.6.37/arch/x86/kernel/head_32.S linux-2.6.37/arch/x86/kernel/h
  ENTRY(initial_page_table)
  	.long	pa(initial_pg_pmd+PGD_IDENT_ATTR),0	/* low identity map */
  # if KPMDS == 3
-@@ -660,15 +748,24 @@ ENTRY(initial_page_table)
+@@ -660,15 +749,24 @@ ENTRY(initial_page_table)
  #  error "Kernel PMDs should be 1, 2 or 3"
  # endif
  	.align PAGE_SIZE_asm		/* needs to be page-sized too */
@@ -12336,7 +12345,7 @@ diff -urNp linux-2.6.37/arch/x86/kernel/head_32.S linux-2.6.37/arch/x86/kernel/h
  early_recursion_flag:
  	.long 0
  
-@@ -704,7 +801,7 @@ fault_msg:
+@@ -704,7 +802,7 @@ fault_msg:
  	.word 0				# 32 bit align gdt_desc.address
  boot_gdt_descr:
  	.word __BOOT_DS+7
@@ -12345,7 +12354,7 @@ diff -urNp linux-2.6.37/arch/x86/kernel/head_32.S linux-2.6.37/arch/x86/kernel/h
  
  	.word 0				# 32-bit align idt_desc.address
  idt_descr:
-@@ -715,7 +812,7 @@ idt_descr:
+@@ -715,7 +813,7 @@ idt_descr:
  	.word 0				# 32 bit align gdt_desc.address
  ENTRY(early_gdt_descr)
  	.word GDT_ENTRIES*8-1
@@ -12354,7 +12363,7 @@ diff -urNp linux-2.6.37/arch/x86/kernel/head_32.S linux-2.6.37/arch/x86/kernel/h
  
  /*
   * The boot_gdt must mirror the equivalent in setup.S and is
-@@ -724,5 +821,65 @@ ENTRY(early_gdt_descr)
+@@ -724,5 +822,65 @@ ENTRY(early_gdt_descr)
  	.align L1_CACHE_BYTES
  ENTRY(boot_gdt)
  	.fill GDT_ENTRY_BOOT_CS,8,0
@@ -12777,7 +12786,7 @@ diff -urNp linux-2.6.37/arch/x86/kernel/ioport.c linux-2.6.37/arch/x86/kernel/io
  	}
 diff -urNp linux-2.6.37/arch/x86/kernel/irq_32.c linux-2.6.37/arch/x86/kernel/irq_32.c
 --- linux-2.6.37/arch/x86/kernel/irq_32.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/arch/x86/kernel/irq_32.c	2011-01-17 02:41:01.000000000 -0500
++++ linux-2.6.37/arch/x86/kernel/irq_32.c	2011-01-24 18:04:15.000000000 -0500
 @@ -91,7 +91,7 @@ execute_on_irq_stack(int overflow, struc
  		return 0;
  
@@ -12810,7 +12819,29 @@ diff -urNp linux-2.6.37/arch/x86/kernel/irq_32.c linux-2.6.37/arch/x86/kernel/ir
  	return 1;
  }
  
-@@ -171,9 +180,18 @@ asmlinkage void do_softirq(void)
+@@ -129,8 +138,7 @@ void __cpuinit irq_ctx_init(int cpu)
+ 	irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
+ 					       THREAD_FLAGS,
+ 					       THREAD_ORDER));
+-	irqctx->tinfo.task		= NULL;
+-	irqctx->tinfo.exec_domain	= NULL;
++	memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
+ 	irqctx->tinfo.cpu		= cpu;
+ 	irqctx->tinfo.preempt_count	= HARDIRQ_OFFSET;
+ 	irqctx->tinfo.addr_limit	= MAKE_MM_SEG(0);
+@@ -140,10 +148,8 @@ void __cpuinit irq_ctx_init(int cpu)
+ 	irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
+ 					       THREAD_FLAGS,
+ 					       THREAD_ORDER));
+-	irqctx->tinfo.task		= NULL;
+-	irqctx->tinfo.exec_domain	= NULL;
++	memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
+ 	irqctx->tinfo.cpu		= cpu;
+-	irqctx->tinfo.preempt_count	= 0;
+ 	irqctx->tinfo.addr_limit	= MAKE_MM_SEG(0);
+ 
+ 	per_cpu(softirq_ctx, cpu) = irqctx;
+@@ -171,9 +177,18 @@ asmlinkage void do_softirq(void)
  		irqctx->tinfo.previous_esp = current_stack_pointer;
  
  		/* build the stack frame on the softirq stack */
@@ -15943,16 +15974,20 @@ diff -urNp linux-2.6.37/arch/x86/lib/getuser.S linux-2.6.37/arch/x86/lib/getuser
  	ret
 diff -urNp linux-2.6.37/arch/x86/lib/insn.c linux-2.6.37/arch/x86/lib/insn.c
 --- linux-2.6.37/arch/x86/lib/insn.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/arch/x86/lib/insn.c	2011-01-17 02:41:01.000000000 -0500
-@@ -21,6 +21,7 @@
++++ linux-2.6.37/arch/x86/lib/insn.c	2011-01-24 18:04:15.000000000 -0500
+@@ -21,6 +21,11 @@
  #include <linux/string.h>
  #include <asm/inat.h>
  #include <asm/insn.h>
++#ifdef __KERNEL__
 +#include <asm/pgtable_types.h>
++#else
++#define ktla_ktva(addr) addr
++#endif
  
  #define get_next(t, insn)	\
  	({t r; r = *(t*)insn->next_byte; insn->next_byte += sizeof(t); r; })
-@@ -40,8 +41,8 @@
+@@ -40,8 +45,8 @@
  void insn_init(struct insn *insn, const void *kaddr, int x86_64)
  {
  	memset(insn, 0, sizeof(*insn));
@@ -23513,98 +23548,106 @@ diff -urNp linux-2.6.37/drivers/char/hvc_console.h linux-2.6.37/drivers/char/hvc
  
 diff -urNp linux-2.6.37/drivers/char/hvcs.c linux-2.6.37/drivers/char/hvcs.c
 --- linux-2.6.37/drivers/char/hvcs.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/drivers/char/hvcs.c	2011-01-17 02:41:01.000000000 -0500
-@@ -270,7 +270,7 @@ struct hvcs_struct {
++++ linux-2.6.37/drivers/char/hvcs.c	2011-01-25 20:24:56.000000000 -0500
+@@ -83,6 +83,7 @@
+ #include <asm/hvcserver.h>
+ #include <asm/uaccess.h>
+ #include <asm/vio.h>
++#include <asm/local.h>
+ 
+ /*
+  * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
+@@ -270,7 +271,7 @@ struct hvcs_struct {
  	unsigned int index;
  
  	struct tty_struct *tty;
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  
  	/*
  	 * Used to tell the driver kernel_thread what operations need to take
-@@ -420,7 +420,7 @@ static ssize_t hvcs_vterm_state_store(st
+@@ -420,7 +421,7 @@ static ssize_t hvcs_vterm_state_store(st
  
  	spin_lock_irqsave(&hvcsd->lock, flags);
  
 -	if (hvcsd->open_count > 0) {
-+	if (atomic_read(&hvcsd->open_count) > 0) {
++	if (local_read(&hvcsd->open_count) > 0) {
  		spin_unlock_irqrestore(&hvcsd->lock, flags);
  		printk(KERN_INFO "HVCS: vterm state unchanged.  "
  				"The hvcs device node is still in use.\n");
-@@ -1136,7 +1136,7 @@ static int hvcs_open(struct tty_struct *
+@@ -1136,7 +1137,7 @@ static int hvcs_open(struct tty_struct *
  		if ((retval = hvcs_partner_connect(hvcsd)))
  			goto error_release;
  
 -	hvcsd->open_count = 1;
-+	atomic_set(&hvcsd->open_count, 1);
++	local_set(&hvcsd->open_count, 1);
  	hvcsd->tty = tty;
  	tty->driver_data = hvcsd;
  
-@@ -1170,7 +1170,7 @@ fast_open:
+@@ -1170,7 +1171,7 @@ fast_open:
  
  	spin_lock_irqsave(&hvcsd->lock, flags);
  	kref_get(&hvcsd->kref);
 -	hvcsd->open_count++;
-+	atomic_inc(&hvcsd->open_count);
++	local_inc(&hvcsd->open_count);
  	hvcsd->todo_mask |= HVCS_SCHED_READ;
  	spin_unlock_irqrestore(&hvcsd->lock, flags);
  
-@@ -1214,7 +1214,7 @@ static void hvcs_close(struct tty_struct
+@@ -1214,7 +1215,7 @@ static void hvcs_close(struct tty_struct
  	hvcsd = tty->driver_data;
  
  	spin_lock_irqsave(&hvcsd->lock, flags);
 -	if (--hvcsd->open_count == 0) {
-+	if (atomic_dec_and_test(&hvcsd->open_count)) {
++	if (local_dec_and_test(&hvcsd->open_count)) {
  
  		vio_disable_interrupts(hvcsd->vdev);
  
-@@ -1240,10 +1240,10 @@ static void hvcs_close(struct tty_struct
+@@ -1240,10 +1241,10 @@ static void hvcs_close(struct tty_struct
  		free_irq(irq, hvcsd);
  		kref_put(&hvcsd->kref, destroy_hvcs_struct);
  		return;
 -	} else if (hvcsd->open_count < 0) {
-+	} else if (atomic_read(&hvcsd->open_count) < 0) {
++	} else if (local_read(&hvcsd->open_count) < 0) {
  		printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
  				" is missmanaged.\n",
 -		hvcsd->vdev->unit_address, hvcsd->open_count);
-+		hvcsd->vdev->unit_address, atomic_read(&hvcsd->open_count));
++		hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
  	}
  
  	spin_unlock_irqrestore(&hvcsd->lock, flags);
-@@ -1259,7 +1259,7 @@ static void hvcs_hangup(struct tty_struc
+@@ -1259,7 +1260,7 @@ static void hvcs_hangup(struct tty_struc
  
  	spin_lock_irqsave(&hvcsd->lock, flags);
  	/* Preserve this so that we know how many kref refs to put */
 -	temp_open_count = hvcsd->open_count;
-+	temp_open_count = atomic_read(&hvcsd->open_count);
++	temp_open_count = local_read(&hvcsd->open_count);
  
  	/*
  	 * Don't kref put inside the spinlock because the destruction
-@@ -1274,7 +1274,7 @@ static void hvcs_hangup(struct tty_struc
+@@ -1274,7 +1275,7 @@ static void hvcs_hangup(struct tty_struc
  	hvcsd->tty->driver_data = NULL;
  	hvcsd->tty = NULL;
  
 -	hvcsd->open_count = 0;
-+	atomic_set(&hvcsd->open_count, 0);
++	local_set(&hvcsd->open_count, 0);
  
  	/* This will drop any buffered data on the floor which is OK in a hangup
  	 * scenario. */
-@@ -1345,7 +1345,7 @@ static int hvcs_write(struct tty_struct 
+@@ -1345,7 +1346,7 @@ static int hvcs_write(struct tty_struct 
  	 * the middle of a write operation?  This is a crummy place to do this
  	 * but we want to keep it all in the spinlock.
  	 */
 -	if (hvcsd->open_count <= 0) {
-+	if (atomic_read(&hvcsd->open_count) <= 0) {
++	if (local_read(&hvcsd->open_count) <= 0) {
  		spin_unlock_irqrestore(&hvcsd->lock, flags);
  		return -ENODEV;
  	}
-@@ -1419,7 +1419,7 @@ static int hvcs_write_room(struct tty_st
+@@ -1419,7 +1420,7 @@ static int hvcs_write_room(struct tty_st
  {
  	struct hvcs_struct *hvcsd = tty->driver_data;
  
 -	if (!hvcsd || hvcsd->open_count <= 0)
-+	if (!hvcsd || atomic_read(&hvcsd->open_count) <= 0)
++	if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
  		return 0;
  
  	return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
@@ -23909,118 +23952,126 @@ diff -urNp linux-2.6.37/drivers/char/nvram.c linux-2.6.37/drivers/char/nvram.c
  static int __init nvram_init(void)
 diff -urNp linux-2.6.37/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.37/drivers/char/pcmcia/ipwireless/tty.c
 --- linux-2.6.37/drivers/char/pcmcia/ipwireless/tty.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/drivers/char/pcmcia/ipwireless/tty.c	2011-01-17 02:41:01.000000000 -0500
-@@ -51,7 +51,7 @@ struct ipw_tty {
++++ linux-2.6.37/drivers/char/pcmcia/ipwireless/tty.c	2011-01-25 20:24:56.000000000 -0500
+@@ -29,6 +29,7 @@
+ #include <linux/tty_driver.h>
+ #include <linux/tty_flip.h>
+ #include <linux/uaccess.h>
++#include <asm/local.h>
+ 
+ #include "tty.h"
+ #include "network.h"
+@@ -51,7 +52,7 @@ struct ipw_tty {
  	int tty_type;
  	struct ipw_network *network;
  	struct tty_struct *linux_tty;
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	unsigned int control_lines;
  	struct mutex ipw_tty_mutex;
  	int tx_bytes_queued;
-@@ -127,10 +127,10 @@ static int ipw_open(struct tty_struct *l
+@@ -127,10 +128,10 @@ static int ipw_open(struct tty_struct *l
  		mutex_unlock(&tty->ipw_tty_mutex);
  		return -ENODEV;
  	}
 -	if (tty->open_count == 0)
-+	if (atomic_read(&tty->open_count) == 0)
++	if (local_read(&tty->open_count) == 0)
  		tty->tx_bytes_queued = 0;
  
 -	tty->open_count++;
-+	atomic_inc(&tty->open_count);
++	local_inc(&tty->open_count);
  
  	tty->linux_tty = linux_tty;
  	linux_tty->driver_data = tty;
-@@ -146,9 +146,7 @@ static int ipw_open(struct tty_struct *l
+@@ -146,9 +147,7 @@ static int ipw_open(struct tty_struct *l
  
  static void do_ipw_close(struct ipw_tty *tty)
  {
 -	tty->open_count--;
 -
 -	if (tty->open_count == 0) {
-+	if (atomic_dec_return(&tty->open_count) == 0) {
++	if (local_dec_return(&tty->open_count) == 0) {
  		struct tty_struct *linux_tty = tty->linux_tty;
  
  		if (linux_tty != NULL) {
-@@ -169,7 +167,7 @@ static void ipw_hangup(struct tty_struct
+@@ -169,7 +168,7 @@ static void ipw_hangup(struct tty_struct
  		return;
  
  	mutex_lock(&tty->ipw_tty_mutex);
 -	if (tty->open_count == 0) {
-+	if (atomic_read(&tty->open_count) == 0) {
++	if (local_read(&tty->open_count) == 0) {
  		mutex_unlock(&tty->ipw_tty_mutex);
  		return;
  	}
-@@ -198,7 +196,7 @@ void ipwireless_tty_received(struct ipw_
+@@ -198,7 +197,7 @@ void ipwireless_tty_received(struct ipw_
  		return;
  	}
  
 -	if (!tty->open_count) {
-+	if (!atomic_read(&tty->open_count)) {
++	if (!local_read(&tty->open_count)) {
  		mutex_unlock(&tty->ipw_tty_mutex);
  		return;
  	}
-@@ -240,7 +238,7 @@ static int ipw_write(struct tty_struct *
+@@ -240,7 +239,7 @@ static int ipw_write(struct tty_struct *
  		return -ENODEV;
  
  	mutex_lock(&tty->ipw_tty_mutex);
 -	if (!tty->open_count) {
-+	if (!atomic_read(&tty->open_count)) {
++	if (!local_read(&tty->open_count)) {
  		mutex_unlock(&tty->ipw_tty_mutex);
  		return -EINVAL;
  	}
-@@ -280,7 +278,7 @@ static int ipw_write_room(struct tty_str
+@@ -280,7 +279,7 @@ static int ipw_write_room(struct tty_str
  	if (!tty)
  		return -ENODEV;
  
 -	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
++	if (!local_read(&tty->open_count))
  		return -EINVAL;
  
  	room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
-@@ -322,7 +320,7 @@ static int ipw_chars_in_buffer(struct tt
+@@ -322,7 +321,7 @@ static int ipw_chars_in_buffer(struct tt
  	if (!tty)
  		return 0;
  
 -	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
++	if (!local_read(&tty->open_count))
  		return 0;
  
  	return tty->tx_bytes_queued;
-@@ -403,7 +401,7 @@ static int ipw_tiocmget(struct tty_struc
+@@ -403,7 +402,7 @@ static int ipw_tiocmget(struct tty_struc
  	if (!tty)
  		return -ENODEV;
  
 -	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
++	if (!local_read(&tty->open_count))
  		return -EINVAL;
  
  	return get_control_lines(tty);
-@@ -419,7 +417,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
+@@ -419,7 +418,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
  	if (!tty)
  		return -ENODEV;
  
 -	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
++	if (!local_read(&tty->open_count))
  		return -EINVAL;
  
  	return set_control_lines(tty, set, clear);
-@@ -433,7 +431,7 @@ static int ipw_ioctl(struct tty_struct *
+@@ -433,7 +432,7 @@ static int ipw_ioctl(struct tty_struct *
  	if (!tty)
  		return -ENODEV;
  
 -	if (!tty->open_count)
-+	if (!atomic_read(&tty->open_count))
++	if (!local_read(&tty->open_count))
  		return -EINVAL;
  
  	/* FIXME: Exactly how is the tty object locked here .. */
-@@ -582,7 +580,7 @@ void ipwireless_tty_free(struct ipw_tty 
+@@ -582,7 +581,7 @@ void ipwireless_tty_free(struct ipw_tty 
  				   against a parallel ioctl etc */
  				mutex_lock(&ttyj->ipw_tty_mutex);
  			}
 -			while (ttyj->open_count)
-+			while (atomic_read(&ttyj->open_count))
++			while (local_read(&ttyj->open_count))
  				do_ipw_close(ttyj);
  			ipwireless_disassociate_network_ttys(network,
  							     ttyj->channel_idx);
@@ -24079,34 +24130,42 @@ diff -urNp linux-2.6.37/drivers/char/random.c linux-2.6.37/drivers/char/random.c
  
 diff -urNp linux-2.6.37/drivers/char/sonypi.c linux-2.6.37/drivers/char/sonypi.c
 --- linux-2.6.37/drivers/char/sonypi.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/drivers/char/sonypi.c	2011-01-17 02:41:01.000000000 -0500
-@@ -491,7 +491,7 @@ static struct sonypi_device {
++++ linux-2.6.37/drivers/char/sonypi.c	2011-01-25 20:24:56.000000000 -0500
+@@ -55,6 +55,7 @@
+ #include <asm/uaccess.h>
+ #include <asm/io.h>
+ #include <asm/system.h>
++#include <asm/local.h>
+ 
+ #include <linux/sonypi.h>
+ 
+@@ -491,7 +492,7 @@ static struct sonypi_device {
  	spinlock_t fifo_lock;
  	wait_queue_head_t fifo_proc_list;
  	struct fasync_struct *fifo_async;
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	int model;
  	struct input_dev *input_jog_dev;
  	struct input_dev *input_key_dev;
-@@ -898,7 +898,7 @@ static int sonypi_misc_fasync(int fd, st
+@@ -898,7 +899,7 @@ static int sonypi_misc_fasync(int fd, st
  static int sonypi_misc_release(struct inode *inode, struct file *file)
  {
  	mutex_lock(&sonypi_device.lock);
 -	sonypi_device.open_count--;
-+	atomic_dec(&sonypi_device.open_count);
++	local_dec(&sonypi_device.open_count);
  	mutex_unlock(&sonypi_device.lock);
  	return 0;
  }
-@@ -907,9 +907,9 @@ static int sonypi_misc_open(struct inode
+@@ -907,9 +908,9 @@ static int sonypi_misc_open(struct inode
  {
  	mutex_lock(&sonypi_device.lock);
  	/* Flush input queue on first open */
 -	if (!sonypi_device.open_count)
-+	if (!atomic_read(&sonypi_device.open_count))
++	if (!local_read(&sonypi_device.open_count))
  		kfifo_reset(&sonypi_device.fifo);
 -	sonypi_device.open_count++;
-+	atomic_inc(&sonypi_device.open_count);
++	local_inc(&sonypi_device.open_count);
  	mutex_unlock(&sonypi_device.lock);
  
  	return 0;
@@ -24251,7 +24310,7 @@ diff -urNp linux-2.6.37/drivers/gpu/drm/drm_drv.c linux-2.6.37/drivers/gpu/drm/d
  	DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
 diff -urNp linux-2.6.37/drivers/gpu/drm/drm_fops.c linux-2.6.37/drivers/gpu/drm/drm_fops.c
 --- linux-2.6.37/drivers/gpu/drm/drm_fops.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/drivers/gpu/drm/drm_fops.c	2011-01-17 02:41:01.000000000 -0500
++++ linux-2.6.37/drivers/gpu/drm/drm_fops.c	2011-01-24 18:04:15.000000000 -0500
 @@ -70,7 +70,7 @@ static int drm_setup(struct drm_device *
  	}
  
@@ -24268,7 +24327,7 @@ diff -urNp linux-2.6.37/drivers/gpu/drm/drm_fops.c linux-2.6.37/drivers/gpu/drm/
 -		atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
 -		if (!dev->open_count++)
 +		atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
-+		if (atomic_inc_return(&dev->open_count) == 1)
++		if (local_inc_return(&dev->open_count) == 1)
  			retcode = drm_setup(dev);
  	}
  	if (!retcode) {
@@ -24277,7 +24336,7 @@ diff -urNp linux-2.6.37/drivers/gpu/drm/drm_fops.c linux-2.6.37/drivers/gpu/drm/
  	mutex_lock(&drm_global_mutex);
  
 -	DRM_DEBUG("open_count = %d\n", dev->open_count);
-+	DRM_DEBUG("open_count = %d\n", atomic_read(&dev->open_count));
++	DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
  
  	if (dev->driver->preclose)
  		dev->driver->preclose(dev, file_priv);
@@ -24286,7 +24345,7 @@ diff -urNp linux-2.6.37/drivers/gpu/drm/drm_fops.c linux-2.6.37/drivers/gpu/drm/
  		  task_pid_nr(current),
  		  (long)old_encode_dev(file_priv->minor->device),
 -		  dev->open_count);
-+		  atomic_read(&dev->open_count));
++		  local_read(&dev->open_count));
  
  	/* if the master has gone away we can't do anything with the lock */
  	if (file_priv->minor->master)
@@ -24297,7 +24356,7 @@ diff -urNp linux-2.6.37/drivers/gpu/drm/drm_fops.c linux-2.6.37/drivers/gpu/drm/
 -	atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
 -	if (!--dev->open_count) {
 +	atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
-+	if (atomic_dec_and_test(&dev->open_count)) {
++	if (local_dec_and_test(&dev->open_count)) {
  		if (atomic_read(&dev->ioctl_count)) {
  			DRM_ERROR("Device busy: %d\n",
  				  atomic_read(&dev->ioctl_count));
@@ -24547,13 +24606,13 @@ diff -urNp linux-2.6.37/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.37/drivers/g
  	.mode_valid = tfp410_mode_valid,
 diff -urNp linux-2.6.37/drivers/gpu/drm/i915/i915_dma.c linux-2.6.37/drivers/gpu/drm/i915/i915_dma.c
 --- linux-2.6.37/drivers/gpu/drm/i915/i915_dma.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/drivers/gpu/drm/i915/i915_dma.c	2011-01-17 02:41:01.000000000 -0500
++++ linux-2.6.37/drivers/gpu/drm/i915/i915_dma.c	2011-01-24 18:04:15.000000000 -0500
 @@ -1191,7 +1191,7 @@ static bool i915_switcheroo_can_switch(s
  	bool can_switch;
  
  	spin_lock(&dev->count_lock);
 -	can_switch = (dev->open_count == 0);
-+	can_switch = (atomic_read(&dev->open_count) == 0);
++	can_switch = (local_read(&dev->open_count) == 0);
  	spin_unlock(&dev->count_lock);
  	return can_switch;
  }
@@ -24603,13 +24662,13 @@ diff -urNp linux-2.6.37/drivers/gpu/drm/nouveau/nouveau_backlight.c linux-2.6.37
  	.update_status = nv50_set_intensity,
 diff -urNp linux-2.6.37/drivers/gpu/drm/nouveau/nouveau_state.c linux-2.6.37/drivers/gpu/drm/nouveau/nouveau_state.c
 --- linux-2.6.37/drivers/gpu/drm/nouveau/nouveau_state.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/drivers/gpu/drm/nouveau/nouveau_state.c	2011-01-17 02:41:01.000000000 -0500
++++ linux-2.6.37/drivers/gpu/drm/nouveau/nouveau_state.c	2011-01-24 18:04:15.000000000 -0500
 @@ -546,7 +546,7 @@ static bool nouveau_switcheroo_can_switc
  	bool can_switch;
  
  	spin_lock(&dev->count_lock);
 -	can_switch = (dev->open_count == 0);
-+	can_switch = (atomic_read(&dev->open_count) == 0);
++	can_switch = (local_read(&dev->open_count) == 0);
  	spin_unlock(&dev->count_lock);
  	return can_switch;
  }
@@ -24635,13 +24694,13 @@ diff -urNp linux-2.6.37/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.37/drivers
  	    (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
 diff -urNp linux-2.6.37/drivers/gpu/drm/radeon/radeon_device.c linux-2.6.37/drivers/gpu/drm/radeon/radeon_device.c
 --- linux-2.6.37/drivers/gpu/drm/radeon/radeon_device.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/drivers/gpu/drm/radeon/radeon_device.c	2011-01-17 02:41:01.000000000 -0500
++++ linux-2.6.37/drivers/gpu/drm/radeon/radeon_device.c	2011-01-24 18:04:15.000000000 -0500
 @@ -659,7 +659,7 @@ static bool radeon_switcheroo_can_switch
  	bool can_switch;
  
  	spin_lock(&dev->count_lock);
 -	can_switch = (dev->open_count == 0);
-+	can_switch = (atomic_read(&dev->open_count) == 0);
++	can_switch = (local_read(&dev->open_count) == 0);
  	spin_unlock(&dev->count_lock);
  	return can_switch;
  }
@@ -25252,31 +25311,39 @@ diff -urNp linux-2.6.37/drivers/input/serio/serio_raw.c linux-2.6.37/drivers/inp
  MODULE_DEVICE_TABLE(serio, serio_raw_serio_ids);
 diff -urNp linux-2.6.37/drivers/isdn/gigaset/common.c linux-2.6.37/drivers/isdn/gigaset/common.c
 --- linux-2.6.37/drivers/isdn/gigaset/common.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/drivers/isdn/gigaset/common.c	2011-01-17 02:41:01.000000000 -0500
++++ linux-2.6.37/drivers/isdn/gigaset/common.c	2011-01-24 18:04:15.000000000 -0500
 @@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct 
  	cs->commands_pending = 0;
  	cs->cur_at_seq = 0;
  	cs->gotfwver = -1;
 -	cs->open_count = 0;
-+	atomic_set(&cs->open_count, 0);
++	local_set(&cs->open_count, 0);
  	cs->dev = NULL;
  	cs->tty = NULL;
  	cs->tty_dev = NULL;
 diff -urNp linux-2.6.37/drivers/isdn/gigaset/gigaset.h linux-2.6.37/drivers/isdn/gigaset/gigaset.h
 --- linux-2.6.37/drivers/isdn/gigaset/gigaset.h	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/drivers/isdn/gigaset/gigaset.h	2011-01-17 02:41:01.000000000 -0500
-@@ -433,7 +433,7 @@ struct cardstate {
++++ linux-2.6.37/drivers/isdn/gigaset/gigaset.h	2011-01-25 20:24:56.000000000 -0500
+@@ -35,6 +35,7 @@
+ #include <linux/tty_driver.h>
+ #include <linux/list.h>
+ #include <asm/atomic.h>
++#include <asm/local.h>
+ 
+ #define GIG_VERSION {0, 5, 0, 0}
+ #define GIG_COMPAT  {0, 4, 0, 0}
+@@ -433,7 +434,7 @@ struct cardstate {
  	spinlock_t cmdlock;
  	unsigned curlen, cmdbytes;
  
 -	unsigned open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	struct tty_struct *tty;
  	struct tasklet_struct if_wake_tasklet;
  	unsigned control_state;
 diff -urNp linux-2.6.37/drivers/isdn/gigaset/interface.c linux-2.6.37/drivers/isdn/gigaset/interface.c
 --- linux-2.6.37/drivers/isdn/gigaset/interface.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/drivers/isdn/gigaset/interface.c	2011-01-17 02:41:01.000000000 -0500
++++ linux-2.6.37/drivers/isdn/gigaset/interface.c	2011-01-24 18:04:15.000000000 -0500
 @@ -160,9 +160,7 @@ static int if_open(struct tty_struct *tt
  		return -ERESTARTSYS;
  	tty->driver_data = cs;
@@ -25284,7 +25351,7 @@ diff -urNp linux-2.6.37/drivers/isdn/gigaset/interface.c linux-2.6.37/drivers/is
 -	++cs->open_count;
 -
 -	if (cs->open_count == 1) {
-+	if (atomic_inc_return(&cs->open_count) == 1) {
++	if (local_inc_return(&cs->open_count) == 1) {
  		spin_lock_irqsave(&cs->lock, flags);
  		cs->tty = tty;
  		spin_unlock_irqrestore(&cs->lock, flags);
@@ -25293,11 +25360,11 @@ diff -urNp linux-2.6.37/drivers/isdn/gigaset/interface.c linux-2.6.37/drivers/is
  	if (!cs->connected)
  		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
 -	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
++	else if (!local_read(&cs->open_count))
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  	else {
 -		if (!--cs->open_count) {
-+		if (!atomic_dec_return(&cs->open_count)) {
++		if (!local_dec_return(&cs->open_count)) {
  			spin_lock_irqsave(&cs->lock, flags);
  			cs->tty = NULL;
  			spin_unlock_irqrestore(&cs->lock, flags);
@@ -25306,7 +25373,7 @@ diff -urNp linux-2.6.37/drivers/isdn/gigaset/interface.c linux-2.6.37/drivers/is
  		gig_dbg(DEBUG_IF, "not connected");
  		retval = -ENODEV;
 -	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
++	} else if (!local_read(&cs->open_count))
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  	else {
  		retval = 0;
@@ -25315,7 +25382,7 @@ diff -urNp linux-2.6.37/drivers/isdn/gigaset/interface.c linux-2.6.37/drivers/is
  		goto done;
  	}
 -	if (!cs->open_count) {
-+	if (!atomic_read(&cs->open_count)) {
++	if (!local_read(&cs->open_count)) {
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  		retval = -ENODEV;
  		goto done;
@@ -25324,7 +25391,7 @@ diff -urNp linux-2.6.37/drivers/isdn/gigaset/interface.c linux-2.6.37/drivers/is
  		gig_dbg(DEBUG_IF, "not connected");
  		retval = -ENODEV;
 -	} else if (!cs->open_count)
-+	} else if (!atomic_read(&cs->open_count))
++	} else if (!local_read(&cs->open_count))
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  	else if (cs->mstate != MS_LOCKED) {
  		dev_warn(cs->dev, "can't write to unlocked device\n");
@@ -25333,7 +25400,7 @@ diff -urNp linux-2.6.37/drivers/isdn/gigaset/interface.c linux-2.6.37/drivers/is
  	if (!cs->connected)
  		gig_dbg(DEBUG_IF, "not connected");
 -	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
++	else if (!local_read(&cs->open_count))
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  	else if (cs->mstate != MS_LOCKED)
  		dev_warn(cs->dev, "can't write to unlocked device\n");
@@ -25342,7 +25409,7 @@ diff -urNp linux-2.6.37/drivers/isdn/gigaset/interface.c linux-2.6.37/drivers/is
  	if (!cs->connected)
  		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
 -	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
++	else if (!local_read(&cs->open_count))
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  	else
  		gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
@@ -25351,7 +25418,7 @@ diff -urNp linux-2.6.37/drivers/isdn/gigaset/interface.c linux-2.6.37/drivers/is
  	if (!cs->connected)
  		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
 -	else if (!cs->open_count)
-+	else if (!atomic_read(&cs->open_count))
++	else if (!local_read(&cs->open_count))
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  	else
  		gig_dbg(DEBUG_IF, "%s: not implemented\n", __func__);
@@ -25360,7 +25427,7 @@ diff -urNp linux-2.6.37/drivers/isdn/gigaset/interface.c linux-2.6.37/drivers/is
  	}
  
 -	if (!cs->open_count) {
-+	if (!atomic_read(&cs->open_count)) {
++	if (!local_read(&cs->open_count)) {
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  		goto out;
  	}
@@ -25669,6 +25736,18 @@ diff -urNp linux-2.6.37/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.37/drivers
  	struct file_operations *dvbdevfops;
  	struct device *clsdev;
  	int minor;
+diff -urNp linux-2.6.37/drivers/media/dvb/ttpci/av7110_ca.c linux-2.6.37/drivers/media/dvb/ttpci/av7110_ca.c
+--- linux-2.6.37/drivers/media/dvb/ttpci/av7110_ca.c	2011-01-04 19:50:19.000000000 -0500
++++ linux-2.6.37/drivers/media/dvb/ttpci/av7110_ca.c	2011-01-24 18:13:05.000000000 -0500
+@@ -277,7 +277,7 @@ static int dvb_ca_ioctl(struct file *fil
+ 	{
+ 		ca_slot_info_t *info=(ca_slot_info_t *)parg;
+ 
+-		if (info->num > 1)
++		if (info->num < 0 || info->num > 1)
+ 			return -EINVAL;
+ 		av7110->ci_slot[info->num].num = info->num;
+ 		av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?
 diff -urNp linux-2.6.37/drivers/media/IR/ir-lirc-codec.c linux-2.6.37/drivers/media/IR/ir-lirc-codec.c
 --- linux-2.6.37/drivers/media/IR/ir-lirc-codec.c	2011-01-04 19:50:19.000000000 -0500
 +++ linux-2.6.37/drivers/media/IR/ir-lirc-codec.c	2011-01-17 02:41:01.000000000 -0500
@@ -26618,13 +26697,22 @@ diff -urNp linux-2.6.37/drivers/net/tulip/de4x5.c linux-2.6.37/drivers/net/tulip
      }
 diff -urNp linux-2.6.37/drivers/net/usb/hso.c linux-2.6.37/drivers/net/usb/hso.c
 --- linux-2.6.37/drivers/net/usb/hso.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/drivers/net/usb/hso.c	2011-01-17 02:41:01.000000000 -0500
++++ linux-2.6.37/drivers/net/usb/hso.c	2011-01-24 18:04:15.000000000 -0500
+@@ -71,7 +71,7 @@
+ #include <asm/byteorder.h>
+ #include <linux/serial_core.h>
+ #include <linux/serial.h>
+-
++#include <asm/local.h>
+ 
+ #define MOD_AUTHOR			"Option Wireless"
+ #define MOD_DESCRIPTION			"USB High Speed Option driver"
 @@ -257,7 +257,7 @@ struct hso_serial {
  
  	/* from usb_serial_port */
  	struct tty_struct *tty;
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	spinlock_t serial_lock;
  
  	int (*write_data) (struct hso_serial *serial);
@@ -26633,7 +26721,7 @@ diff -urNp linux-2.6.37/drivers/net/usb/hso.c linux-2.6.37/drivers/net/usb/hso.c
  
  	urb = serial->rx_urb[0];
 -	if (serial->open_count > 0) {
-+	if (atomic_read(&serial->open_count) > 0) {
++	if (local_read(&serial->open_count) > 0) {
  		count = put_rxbuf_data(urb, serial);
  		if (count == -1)
  			return;
@@ -26642,7 +26730,7 @@ diff -urNp linux-2.6.37/drivers/net/usb/hso.c linux-2.6.37/drivers/net/usb/hso.c
  
  	/* Anyone listening? */
 -	if (serial->open_count == 0)
-+	if (atomic_read(&serial->open_count) == 0)
++	if (local_read(&serial->open_count) == 0)
  		return;
  
  	if (status == 0) {
@@ -26652,7 +26740,7 @@ diff -urNp linux-2.6.37/drivers/net/usb/hso.c linux-2.6.37/drivers/net/usb/hso.c
  	/* check for port already opened, if not set the termios */
 -	serial->open_count++;
 -	if (serial->open_count == 1) {
-+	if (atomic_inc_return(&serial->open_count) == 1) {
++	if (local_inc_return(&serial->open_count) == 1) {
  		serial->rx_state = RX_IDLE;
  		/* Force default termio settings */
  		_hso_serial_set_termios(tty, NULL);
@@ -26661,7 +26749,7 @@ diff -urNp linux-2.6.37/drivers/net/usb/hso.c linux-2.6.37/drivers/net/usb/hso.c
  		if (result) {
  			hso_stop_serial_device(serial->parent);
 -			serial->open_count--;
-+			atomic_dec(&serial->open_count);
++			local_dec(&serial->open_count);
  			kref_put(&serial->parent->ref, hso_serial_ref_free);
  		}
  	} else {
@@ -26670,12 +26758,12 @@ diff -urNp linux-2.6.37/drivers/net/usb/hso.c linux-2.6.37/drivers/net/usb/hso.c
  	/* reset the rts and dtr */
  	/* do the actual close */
 -	serial->open_count--;
-+	atomic_dec(&serial->open_count);
++	local_dec(&serial->open_count);
  
 -	if (serial->open_count <= 0) {
 -		serial->open_count = 0;
-+	if (atomic_read(&serial->open_count) <= 0) {
-+		atomic_set(&serial->open_count,  0);
++	if (local_read(&serial->open_count) <= 0) {
++		local_set(&serial->open_count,  0);
  		spin_lock_irq(&serial->serial_lock);
  		if (serial->tty == tty) {
  			serial->tty->driver_data = NULL;
@@ -26684,7 +26772,7 @@ diff -urNp linux-2.6.37/drivers/net/usb/hso.c linux-2.6.37/drivers/net/usb/hso.c
  	/* the actual setup */
  	spin_lock_irqsave(&serial->serial_lock, flags);
 -	if (serial->open_count)
-+	if (atomic_read(&serial->open_count))
++	if (local_read(&serial->open_count))
  		_hso_serial_set_termios(tty, old);
  	else
  		tty->termios = old;
@@ -26693,7 +26781,7 @@ diff -urNp linux-2.6.37/drivers/net/usb/hso.c linux-2.6.37/drivers/net/usb/hso.c
  				spin_lock(&serial->serial_lock);
  				if (serial->rx_state == RX_IDLE &&
 -					serial->open_count > 0) {
-+					atomic_read(&serial->open_count) > 0) {
++					local_read(&serial->open_count) > 0) {
  					/* Setup and send a ctrl req read on
  					 * port i */
  					if (!serial->rx_urb_filled[0]) {
@@ -26702,7 +26790,7 @@ diff -urNp linux-2.6.37/drivers/net/usb/hso.c linux-2.6.37/drivers/net/usb/hso.c
  	for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
  		if (serial_table[i] && (serial_table[i]->interface == iface)) {
 -			if (dev2ser(serial_table[i])->open_count) {
-+			if (atomic_read(&dev2ser(serial_table[i])->open_count)) {
++			if (local_read(&dev2ser(serial_table[i])->open_count)) {
  				result =
  				    hso_start_serial_device(serial_table[i], GFP_NOIO);
  				hso_kick_transmit(dev2ser(serial_table[i]));
@@ -27525,7 +27613,7 @@ diff -urNp linux-2.6.37/drivers/serial/kgdboc.c linux-2.6.37/drivers/serial/kgdb
  	.read_char		= kgdboc_get_char,
 diff -urNp linux-2.6.37/drivers/staging/autofs/root.c linux-2.6.37/drivers/staging/autofs/root.c
 --- linux-2.6.37/drivers/staging/autofs/root.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/drivers/staging/autofs/root.c	2011-01-17 21:04:34.000000000 -0500
++++ linux-2.6.37/drivers/staging/autofs/root.c	2011-01-24 18:04:18.000000000 -0500
 @@ -308,7 +308,8 @@ static int autofs_root_symlink(struct in
  	set_bit(n,sbi->symlink_bitmap);
  	sl = &sbi->symlink[n];
@@ -27560,6 +27648,76 @@ diff -urNp linux-2.6.37/drivers/staging/bcm/InterfaceInit.c linux-2.6.37/drivers
      .open    =  usbbcm_open,
      .release =  usbbcm_release,
      .read    =  usbbcm_read,
+diff -urNp linux-2.6.37/drivers/staging/brcm80211/brcmfmac/dhd_linux.c linux-2.6.37/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
+--- linux-2.6.37/drivers/staging/brcm80211/brcmfmac/dhd_linux.c	2011-01-04 19:50:19.000000000 -0500
++++ linux-2.6.37/drivers/staging/brcm80211/brcmfmac/dhd_linux.c	2011-01-24 18:04:18.000000000 -0500
+@@ -864,14 +864,14 @@ static void dhd_op_if(dhd_if_t *ifp)
+ 			free_netdev(ifp->net);
+ 		}
+ 		/* Allocate etherdev, including space for private structure */
+-		ifp->net = alloc_etherdev(sizeof(dhd));
++		ifp->net = alloc_etherdev(sizeof(*dhd));
+ 		if (!ifp->net) {
+ 			DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
+ 			ret = -ENOMEM;
+ 		}
+ 		if (ret == 0) {
+ 			strcpy(ifp->net->name, ifp->name);
+-			memcpy(netdev_priv(ifp->net), &dhd, sizeof(dhd));
++			memcpy(netdev_priv(ifp->net), dhd, sizeof(*dhd));
+ 			err = dhd_net_attach(&dhd->pub, ifp->idx);
+ 			if (err != 0) {
+ 				DHD_ERROR(("%s: dhd_net_attach failed, "
+@@ -1891,25 +1891,23 @@ dhd_pub_t *dhd_attach(osl_t *osh, struct
+ 		strcpy(nv_path, nvram_path);
+ 
+ 	/* Allocate etherdev, including space for private structure */
+-	net = alloc_etherdev(sizeof(dhd));
++	net = alloc_etherdev(sizeof(*dhd));
+ 	if (!net) {
+ 		DHD_ERROR(("%s: OOM - alloc_etherdev\n", __func__));
+ 		goto fail;
+ 	}
+ 
+ 	/* Allocate primary dhd_info */
+-	dhd = kmalloc(sizeof(dhd_info_t), GFP_ATOMIC);
++	dhd = kzalloc(sizeof(dhd_info_t), GFP_ATOMIC);
+ 	if (!dhd) {
+ 		DHD_ERROR(("%s: OOM - alloc dhd_info\n", __func__));
+ 		goto fail;
+ 	}
+ 
+-	memset(dhd, 0, sizeof(dhd_info_t));
+-
+ 	/*
+ 	 * Save the dhd_info into the priv
+ 	 */
+-	memcpy(netdev_priv(net), &dhd, sizeof(dhd));
++	memcpy(netdev_priv(net), dhd, sizeof(*dhd));
+ 	dhd->pub.osh = osh;
+ 
+ 	/* Set network interface name if it was provided as module parameter */
+@@ -2027,7 +2025,7 @@ dhd_pub_t *dhd_attach(osl_t *osh, struct
+ 	/*
+ 	 * Save the dhd_info into the priv
+ 	 */
+-	memcpy(netdev_priv(net), &dhd, sizeof(dhd));
++	memcpy(netdev_priv(net), dhd, sizeof(*dhd));
+ 
+ #if defined(CUSTOMER_HW2) && defined(CONFIG_WIFI_CONTROL_FUNC)
+ 	g_bus = bus;
+diff -urNp linux-2.6.37/drivers/staging/brcm80211/brcmfmac/wl_iw.c linux-2.6.37/drivers/staging/brcm80211/brcmfmac/wl_iw.c
+--- linux-2.6.37/drivers/staging/brcm80211/brcmfmac/wl_iw.c	2011-01-04 19:50:19.000000000 -0500
++++ linux-2.6.37/drivers/staging/brcm80211/brcmfmac/wl_iw.c	2011-01-24 18:04:18.000000000 -0500
+@@ -514,7 +514,7 @@ wl_iw_get_range(struct net_device *dev,
+ 	list = (wl_u32_list_t *) channels;
+ 
+ 	dwrq->length = sizeof(struct iw_range);
+-	memset(range, 0, sizeof(range));
++	memset(range, 0, sizeof(*range));
+ 
+ 	range->min_nwid = range->max_nwid = 0;
+ 
 diff -urNp linux-2.6.37/drivers/staging/comedi/comedi_fops.c linux-2.6.37/drivers/staging/comedi/comedi_fops.c
 --- linux-2.6.37/drivers/staging/comedi/comedi_fops.c	2011-01-04 19:50:19.000000000 -0500
 +++ linux-2.6.37/drivers/staging/comedi/comedi_fops.c	2011-01-17 02:41:01.000000000 -0500
@@ -28058,6 +28216,42 @@ diff -urNp linux-2.6.37/drivers/tty/vt/vt_ioctl.c linux-2.6.37/drivers/tty/vt/vt
  		if (!perm) {
  			ret = -EPERM;
  			goto reterr;
+diff -urNp linux-2.6.37/drivers/uio/uio.c linux-2.6.37/drivers/uio/uio.c
+--- linux-2.6.37/drivers/uio/uio.c	2011-01-04 19:50:19.000000000 -0500
++++ linux-2.6.37/drivers/uio/uio.c	2011-01-24 18:04:18.000000000 -0500
+@@ -25,6 +25,7 @@
+ #include <linux/kobject.h>
+ #include <linux/cdev.h>
+ #include <linux/uio_driver.h>
++#include <asm/local.h>
+ 
+ #define UIO_MAX_DEVICES		(1U << MINORBITS)
+ 
+@@ -35,7 +36,7 @@ struct uio_device {
+ 	atomic_t		event;
+ 	struct fasync_struct	*async_queue;
+ 	wait_queue_head_t	wait;
+-	int			vma_count;
++	local_t			vma_count;
+ 	struct uio_info		*info;
+ 	struct kobject		*map_dir;
+ 	struct kobject		*portio_dir;
+@@ -602,13 +603,13 @@ static int uio_find_mem_index(struct vm_
+ static void uio_vma_open(struct vm_area_struct *vma)
+ {
+ 	struct uio_device *idev = vma->vm_private_data;
+-	idev->vma_count++;
++	local_inc(&idev->vma_count);
+ }
+ 
+ static void uio_vma_close(struct vm_area_struct *vma)
+ {
+ 	struct uio_device *idev = vma->vm_private_data;
+-	idev->vma_count--;
++	local_dec(&idev->vma_count);
+ }
+ 
+ static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 diff -urNp linux-2.6.37/drivers/usb/atm/cxacru.c linux-2.6.37/drivers/usb/atm/cxacru.c
 --- linux-2.6.37/drivers/usb/atm/cxacru.c	2011-01-04 19:50:19.000000000 -0500
 +++ linux-2.6.37/drivers/usb/atm/cxacru.c	2011-01-17 02:41:01.000000000 -0500
@@ -44979,8 +45173,16 @@ diff -urNp linux-2.6.37/include/drm/drm_pciids.h linux-2.6.37/include/drm/drm_pc
 +	{0, 0, 0, 0, 0, 0}
 diff -urNp linux-2.6.37/include/drm/drmP.h linux-2.6.37/include/drm/drmP.h
 --- linux-2.6.37/include/drm/drmP.h	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/include/drm/drmP.h	2011-01-17 02:41:02.000000000 -0500
-@@ -804,7 +804,7 @@ struct drm_driver {
++++ linux-2.6.37/include/drm/drmP.h	2011-01-24 18:04:18.000000000 -0500
+@@ -73,6 +73,7 @@
+ #include <linux/workqueue.h>
+ #include <linux/poll.h>
+ #include <asm/pgalloc.h>
++#include <asm/local.h>
+ #include "drm.h"
+ 
+ #include <linux/idr.h>
+@@ -804,7 +805,7 @@ struct drm_driver {
  	void (*vgaarb_irq)(struct drm_device *dev, bool state);
  
  	/* Driver private ops for this object */
@@ -44989,7 +45191,7 @@ diff -urNp linux-2.6.37/include/drm/drmP.h linux-2.6.37/include/drm/drmP.h
  
  	int major;
  	int minor;
-@@ -817,7 +817,7 @@ struct drm_driver {
+@@ -817,7 +818,7 @@ struct drm_driver {
  	int dev_priv_size;
  	struct drm_ioctl_desc *ioctls;
  	int num_ioctls;
@@ -44998,16 +45200,16 @@ diff -urNp linux-2.6.37/include/drm/drmP.h linux-2.6.37/include/drm/drmP.h
  	struct pci_driver pci_driver;
  	struct platform_device *platform_device;
  	/* List of devices hanging off this driver */
-@@ -914,7 +914,7 @@ struct drm_device {
+@@ -914,7 +915,7 @@ struct drm_device {
  
  	/** \name Usage Counters */
  	/*@{ */
 -	int open_count;			/**< Outstanding files open */
-+	atomic_t open_count;		/**< Outstanding files open */
++	local_t open_count;		/**< Outstanding files open */
  	atomic_t ioctl_count;		/**< Outstanding IOCTLs pending */
  	atomic_t vma_count;		/**< Outstanding vma areas open */
  	int buf_use;			/**< Buffers in use -- cannot alloc */
-@@ -925,7 +925,7 @@ struct drm_device {
+@@ -925,7 +926,7 @@ struct drm_device {
  	/*@{ */
  	unsigned long counters;
  	enum drm_stat_type types[15];
@@ -48410,15 +48612,23 @@ diff -urNp linux-2.6.37/include/net/inetpeer.h linux-2.6.37/include/net/inetpeer
  #endif /* _NET_INETPEER_H */
 diff -urNp linux-2.6.37/include/net/irda/ircomm_tty.h linux-2.6.37/include/net/irda/ircomm_tty.h
 --- linux-2.6.37/include/net/irda/ircomm_tty.h	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/include/net/irda/ircomm_tty.h	2011-01-17 02:41:02.000000000 -0500
-@@ -105,8 +105,8 @@ struct ircomm_tty_cb {
++++ linux-2.6.37/include/net/irda/ircomm_tty.h	2011-01-25 20:24:56.000000000 -0500
+@@ -35,6 +35,7 @@
+ #include <linux/termios.h>
+ #include <linux/timer.h>
+ #include <linux/tty.h>		/* struct tty_struct */
++#include <asm/local.h>
+ 
+ #include <net/irda/irias_object.h>
+ #include <net/irda/ircomm_core.h>
+@@ -105,8 +106,8 @@ struct ircomm_tty_cb {
          unsigned short    close_delay;
          unsigned short    closing_wait; /* time to wait before closing */
  
 -	int  open_count;
 -	int  blocked_open;	/* # of blocked opens */
-+	atomic_t open_count;
-+	atomic_t blocked_open;	/* # of blocked opens */
++	local_t open_count;
++	local_t blocked_open;	/* # of blocked opens */
  
  	/* Protect concurent access to :
  	 *	o self->open_count
@@ -52896,7 +53106,7 @@ diff -urNp linux-2.6.37/mm/migrate.c linux-2.6.37/mm/migrate.c
  		goto out;
 diff -urNp linux-2.6.37/mm/mlock.c linux-2.6.37/mm/mlock.c
 --- linux-2.6.37/mm/mlock.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/mm/mlock.c	2011-01-17 02:41:02.000000000 -0500
++++ linux-2.6.37/mm/mlock.c	2011-01-24 18:04:18.000000000 -0500
 @@ -13,6 +13,7 @@
  #include <linux/pagemap.h>
  #include <linux/mempolicy.h>
@@ -52932,6 +53142,15 @@ diff -urNp linux-2.6.37/mm/mlock.c linux-2.6.37/mm/mlock.c
  	while (nr_pages > 0) {
  		int i;
  
+@@ -437,7 +425,7 @@ static int do_mlock(unsigned long start,
+ {
+ 	unsigned long nstart, end, tmp;
+ 	struct vm_area_struct * vma, * prev;
+-	int error;
++	int error = -EINVAL;
+ 
+ 	len = PAGE_ALIGN(len);
+ 	end = start + len;
 @@ -445,6 +433,9 @@ static int do_mlock(unsigned long start,
  		return -EINVAL;
  	if (end == start)
@@ -54753,7 +54972,7 @@ diff -urNp linux-2.6.37/mm/rmap.c linux-2.6.37/mm/rmap.c
  	struct anon_vma *anon_vma;
 diff -urNp linux-2.6.37/mm/shmem.c linux-2.6.37/mm/shmem.c
 --- linux-2.6.37/mm/shmem.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/mm/shmem.c	2011-01-17 02:41:02.000000000 -0500
++++ linux-2.6.37/mm/shmem.c	2011-01-24 18:04:18.000000000 -0500
 @@ -31,7 +31,7 @@
  #include <linux/percpu_counter.h>
  #include <linux/swap.h>
@@ -54763,6 +54982,15 @@ diff -urNp linux-2.6.37/mm/shmem.c linux-2.6.37/mm/shmem.c
  
  #ifdef CONFIG_SHMEM
  /*
+@@ -1070,6 +1070,8 @@ static int shmem_writepage(struct page *
+ 		goto unlock;
+ 	}
+ 	entry = shmem_swp_entry(info, index, NULL);
++	if (!entry)
++		goto unlock;
+ 	if (entry->val) {
+ 		/*
+ 		 * The more uptodate page coming down from a stacked
 diff -urNp linux-2.6.37/mm/slab.c linux-2.6.37/mm/slab.c
 --- linux-2.6.37/mm/slab.c	2011-01-04 19:50:19.000000000 -0500
 +++ linux-2.6.37/mm/slab.c	2011-01-17 02:41:02.000000000 -0500
@@ -56479,24 +56707,24 @@ diff -urNp linux-2.6.37/net/ipv6/udp.c linux-2.6.37/net/ipv6/udp.c
  
 diff -urNp linux-2.6.37/net/irda/ircomm/ircomm_tty.c linux-2.6.37/net/irda/ircomm/ircomm_tty.c
 --- linux-2.6.37/net/irda/ircomm/ircomm_tty.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/net/irda/ircomm/ircomm_tty.c	2011-01-17 02:41:02.000000000 -0500
++++ linux-2.6.37/net/irda/ircomm/ircomm_tty.c	2011-01-24 18:04:18.000000000 -0500
 @@ -281,16 +281,16 @@ static int ircomm_tty_block_til_ready(st
  	add_wait_queue(&self->open_wait, &wait);
  
  	IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
 -	      __FILE__,__LINE__, tty->driver->name, self->open_count );
-+	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
++	      __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
  
  	/* As far as I can see, we protect open_count - Jean II */
  	spin_lock_irqsave(&self->spinlock, flags);
  	if (!tty_hung_up_p(filp)) {
  		extra_count = 1;
 -		self->open_count--;
-+		atomic_dec(&self->open_count);
++		local_dec(&self->open_count);
  	}
  	spin_unlock_irqrestore(&self->spinlock, flags);
 -	self->blocked_open++;
-+	atomic_inc(&self->blocked_open);
++	local_inc(&self->blocked_open);
  
  	while (1) {
  		if (tty->termios->c_cflag & CBAUD) {
@@ -56505,7 +56733,7 @@ diff -urNp linux-2.6.37/net/irda/ircomm/ircomm_tty.c linux-2.6.37/net/irda/ircom
  
  		IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
 -		      __FILE__,__LINE__, tty->driver->name, self->open_count );
-+		      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
++		      __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
  
  		schedule();
  	}
@@ -56514,15 +56742,15 @@ diff -urNp linux-2.6.37/net/irda/ircomm/ircomm_tty.c linux-2.6.37/net/irda/ircom
  		/* ++ is not atomic, so this should be protected - Jean II */
  		spin_lock_irqsave(&self->spinlock, flags);
 -		self->open_count++;
-+		atomic_inc(&self->open_count);
++		local_inc(&self->open_count);
  		spin_unlock_irqrestore(&self->spinlock, flags);
  	}
 -	self->blocked_open--;
-+	atomic_dec(&self->blocked_open);
++	local_dec(&self->blocked_open);
  
  	IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
 -	      __FILE__,__LINE__, tty->driver->name, self->open_count);
-+	      __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count));
++	      __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
  
  	if (!retval)
  		self->flags |= ASYNC_NORMAL_ACTIVE;
@@ -56531,7 +56759,7 @@ diff -urNp linux-2.6.37/net/irda/ircomm/ircomm_tty.c linux-2.6.37/net/irda/ircom
  	/* ++ is not atomic, so this should be protected - Jean II */
  	spin_lock_irqsave(&self->spinlock, flags);
 -	self->open_count++;
-+	atomic_inc(&self->open_count);
++	local_inc(&self->open_count);
  
  	tty->driver_data = self;
  	self->tty = tty;
@@ -56539,7 +56767,7 @@ diff -urNp linux-2.6.37/net/irda/ircomm/ircomm_tty.c linux-2.6.37/net/irda/ircom
  
  	IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
 -		   self->line, self->open_count);
-+		   self->line, atomic_read(&self->open_count));
++		   self->line, local_read(&self->open_count));
  
  	/* Not really used by us, but lets do it anyway */
  	self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
@@ -56548,7 +56776,7 @@ diff -urNp linux-2.6.37/net/irda/ircomm/ircomm_tty.c linux-2.6.37/net/irda/ircom
  	}
  
 -	if ((tty->count == 1) && (self->open_count != 1)) {
-+	if ((tty->count == 1) && (atomic_read(&self->open_count) != 1)) {
++	if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
  		/*
  		 * Uh, oh.  tty->count is 1, which means that the tty
  		 * structure will be freed.  state->count should always
@@ -56558,20 +56786,20 @@ diff -urNp linux-2.6.37/net/irda/ircomm/ircomm_tty.c linux-2.6.37/net/irda/ircom
  			   "tty->count is 1, state->count is %d\n", __func__ ,
 -			   self->open_count);
 -		self->open_count = 1;
-+			   atomic_read(&self->open_count));
-+		atomic_set(&self->open_count, 1);
++			   local_read(&self->open_count));
++		local_set(&self->open_count, 1);
  	}
  
 -	if (--self->open_count < 0) {
-+	if (atomic_dec_return(&self->open_count) < 0) {
++	if (local_dec_return(&self->open_count) < 0) {
  		IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
 -			   __func__, self->line, self->open_count);
 -		self->open_count = 0;
-+			   __func__, self->line, atomic_read(&self->open_count));
-+		atomic_set(&self->open_count, 0);
++			   __func__, self->line, local_read(&self->open_count));
++		local_set(&self->open_count, 0);
  	}
 -	if (self->open_count) {
-+	if (atomic_read(&self->open_count)) {
++	if (local_read(&self->open_count)) {
  		spin_unlock_irqrestore(&self->spinlock, flags);
  
  		IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
@@ -56580,7 +56808,7 @@ diff -urNp linux-2.6.37/net/irda/ircomm/ircomm_tty.c linux-2.6.37/net/irda/ircom
  	self->tty = NULL;
  
 -	if (self->blocked_open) {
-+	if (atomic_read(&self->blocked_open)) {
++	if (local_read(&self->blocked_open)) {
  		if (self->close_delay)
  			schedule_timeout_interruptible(self->close_delay);
  		wake_up_interruptible(&self->open_wait);
@@ -56589,7 +56817,7 @@ diff -urNp linux-2.6.37/net/irda/ircomm/ircomm_tty.c linux-2.6.37/net/irda/ircom
  	self->flags &= ~ASYNC_NORMAL_ACTIVE;
  	self->tty = NULL;
 -	self->open_count = 0;
-+	atomic_set(&self->open_count, 0);
++	local_set(&self->open_count, 0);
  	spin_unlock_irqrestore(&self->spinlock, flags);
  
  	wake_up_interruptible(&self->open_wait);
@@ -56598,7 +56826,7 @@ diff -urNp linux-2.6.37/net/irda/ircomm/ircomm_tty.c linux-2.6.37/net/irda/ircom
  
  	seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
 -	seq_printf(m, "Open count: %d\n", self->open_count);
-+	seq_printf(m, "Open count: %d\n", atomic_read(&self->open_count));
++	seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
  	seq_printf(m, "Max data size: %d\n", self->max_data_size);
  	seq_printf(m, "Max header size: %d\n", self->max_header_size);
  
@@ -56619,25 +56847,33 @@ diff -urNp linux-2.6.37/net/key/af_key.c linux-2.6.37/net/key/af_key.c
  			       sk_wmem_alloc_get(s),
 diff -urNp linux-2.6.37/net/mac80211/ieee80211_i.h linux-2.6.37/net/mac80211/ieee80211_i.h
 --- linux-2.6.37/net/mac80211/ieee80211_i.h	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/net/mac80211/ieee80211_i.h	2011-01-17 02:41:02.000000000 -0500
-@@ -704,7 +704,7 @@ struct ieee80211_local {
++++ linux-2.6.37/net/mac80211/ieee80211_i.h	2011-01-24 18:04:18.000000000 -0500
+@@ -26,6 +26,7 @@
+ #include <net/ieee80211_radiotap.h>
+ #include <net/cfg80211.h>
+ #include <net/mac80211.h>
++#include <asm/local.h>
+ #include "key.h"
+ #include "sta_info.h"
+ 
+@@ -704,7 +705,7 @@ struct ieee80211_local {
  	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
  	spinlock_t queue_stop_reason_lock;
  
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	int monitors, cooked_mntrs;
  	/* number of interfaces with corresponding FIF_ flags */
  	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
 diff -urNp linux-2.6.37/net/mac80211/iface.c linux-2.6.37/net/mac80211/iface.c
 --- linux-2.6.37/net/mac80211/iface.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/net/mac80211/iface.c	2011-01-17 02:41:02.000000000 -0500
++++ linux-2.6.37/net/mac80211/iface.c	2011-01-24 18:04:18.000000000 -0500
 @@ -216,7 +216,7 @@ static int ieee80211_do_open(struct net_
  		break;
  	}
  
 -	if (local->open_count == 0) {
-+	if (atomic_read(&local->open_count) == 0) {
++	if (local_read(&local->open_count) == 0) {
  		res = drv_start(local);
  		if (res)
  			goto err_del_bss;
@@ -56646,7 +56882,7 @@ diff -urNp linux-2.6.37/net/mac80211/iface.c linux-2.6.37/net/mac80211/iface.c
  
  		if (!is_valid_ether_addr(dev->dev_addr)) {
 -			if (!local->open_count)
-+			if (!atomic_read(&local->open_count))
++			if (!local_read(&local->open_count))
  				drv_stop(local);
  			return -EADDRNOTAVAIL;
  		}
@@ -56655,7 +56891,7 @@ diff -urNp linux-2.6.37/net/mac80211/iface.c linux-2.6.37/net/mac80211/iface.c
  
  	if (coming_up)
 -		local->open_count++;
-+		atomic_inc(&local->open_count);
++		local_inc(&local->open_count);
  
  	if (hw_reconf_flags) {
  		ieee80211_hw_config(local, hw_reconf_flags);
@@ -56664,7 +56900,7 @@ diff -urNp linux-2.6.37/net/mac80211/iface.c linux-2.6.37/net/mac80211/iface.c
  	drv_remove_interface(local, &sdata->vif);
   err_stop:
 -	if (!local->open_count)
-+	if (!atomic_read(&local->open_count))
++	if (!local_read(&local->open_count))
  		drv_stop(local);
   err_del_bss:
  	sdata->bss = NULL;
@@ -56673,7 +56909,7 @@ diff -urNp linux-2.6.37/net/mac80211/iface.c linux-2.6.37/net/mac80211/iface.c
  
  	if (going_down)
 -		local->open_count--;
-+		atomic_dec(&local->open_count);
++		local_dec(&local->open_count);
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
@@ -56682,43 +56918,43 @@ diff -urNp linux-2.6.37/net/mac80211/iface.c linux-2.6.37/net/mac80211/iface.c
  	ieee80211_recalc_ps(local, -1);
  
 -	if (local->open_count == 0) {
-+	if (atomic_read(&local->open_count) == 0) {
++	if (local_read(&local->open_count) == 0) {
  		if (local->ops->napi_poll)
  			napi_disable(&local->napi);
  		ieee80211_clear_tx_pending(local);
 diff -urNp linux-2.6.37/net/mac80211/main.c linux-2.6.37/net/mac80211/main.c
 --- linux-2.6.37/net/mac80211/main.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/net/mac80211/main.c	2011-01-17 02:41:02.000000000 -0500
++++ linux-2.6.37/net/mac80211/main.c	2011-01-24 18:04:18.000000000 -0500
 @@ -159,7 +159,7 @@ int ieee80211_hw_config(struct ieee80211
  		local->hw.conf.power_level = power;
  	}
  
 -	if (changed && local->open_count) {
-+	if (changed && atomic_read(&local->open_count)) {
++	if (changed && local_read(&local->open_count)) {
  		ret = drv_config(local, changed);
  		/*
  		 * Goal:
 diff -urNp linux-2.6.37/net/mac80211/pm.c linux-2.6.37/net/mac80211/pm.c
 --- linux-2.6.37/net/mac80211/pm.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/net/mac80211/pm.c	2011-01-17 02:41:02.000000000 -0500
++++ linux-2.6.37/net/mac80211/pm.c	2011-01-24 18:04:18.000000000 -0500
 @@ -95,7 +95,7 @@ int __ieee80211_suspend(struct ieee80211
  	}
  
  	/* stop hardware - this must stop RX */
 -	if (local->open_count)
-+	if (atomic_read(&local->open_count))
++	if (local_read(&local->open_count))
  		ieee80211_stop_device(local);
  
  	local->suspended = true;
 diff -urNp linux-2.6.37/net/mac80211/rate.c linux-2.6.37/net/mac80211/rate.c
 --- linux-2.6.37/net/mac80211/rate.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/net/mac80211/rate.c	2011-01-17 02:41:02.000000000 -0500
++++ linux-2.6.37/net/mac80211/rate.c	2011-01-24 18:04:18.000000000 -0500
 @@ -361,7 +361,7 @@ int ieee80211_init_rate_ctrl_alg(struct 
  
  	ASSERT_RTNL();
  
 -	if (local->open_count)
-+	if (atomic_read(&local->open_count))
++	if (local_read(&local->open_count))
  		return -EBUSY;
  
  	if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
@@ -56748,13 +56984,13 @@ diff -urNp linux-2.6.37/net/mac80211/tx.c linux-2.6.37/net/mac80211/tx.c
  	return local == wdev_priv(dev->ieee80211_ptr);
 diff -urNp linux-2.6.37/net/mac80211/util.c linux-2.6.37/net/mac80211/util.c
 --- linux-2.6.37/net/mac80211/util.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/net/mac80211/util.c	2011-01-17 02:41:02.000000000 -0500
++++ linux-2.6.37/net/mac80211/util.c	2011-01-24 18:04:18.000000000 -0500
 @@ -1111,7 +1111,7 @@ int ieee80211_reconfig(struct ieee80211_
  		local->resuming = true;
  
  	/* restart hardware */
 -	if (local->open_count) {
-+	if (atomic_read(&local->open_count)) {
++	if (local_read(&local->open_count)) {
  		/*
  		 * Upon resume hardware can sometimes be goofy due to
  		 * various platform / driver / bus issues, so restarting
@@ -58339,13 +58575,13 @@ diff -urNp linux-2.6.37/security/tomoyo/tomoyo.c linux-2.6.37/security/tomoyo/to
  	.cred_prepare        = tomoyo_cred_prepare,
 diff -urNp linux-2.6.37/sound/aoa/codecs/onyx.c linux-2.6.37/sound/aoa/codecs/onyx.c
 --- linux-2.6.37/sound/aoa/codecs/onyx.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/sound/aoa/codecs/onyx.c	2011-01-17 02:41:02.000000000 -0500
++++ linux-2.6.37/sound/aoa/codecs/onyx.c	2011-01-24 18:04:18.000000000 -0500
 @@ -54,7 +54,7 @@ struct onyx {
  				spdif_locked:1,
  				analog_locked:1,
  				original_mute:2;
 -	int			open_count;
-+	atomic_t		open_count;
++	local_t			open_count;
  	struct codec_info	*codec_info;
  
  	/* mutex serializes concurrent access to the device
@@ -58354,7 +58590,7 @@ diff -urNp linux-2.6.37/sound/aoa/codecs/onyx.c linux-2.6.37/sound/aoa/codecs/on
  
  	mutex_lock(&onyx->mutex);
 -	onyx->open_count++;
-+	atomic_inc(&onyx->open_count);
++	local_inc(&onyx->open_count);
  	mutex_unlock(&onyx->mutex);
  
  	return 0;
@@ -58364,10 +58600,21 @@ diff -urNp linux-2.6.37/sound/aoa/codecs/onyx.c linux-2.6.37/sound/aoa/codecs/on
  	mutex_lock(&onyx->mutex);
 -	onyx->open_count--;
 -	if (!onyx->open_count)
-+	if (atomic_dec_and_test(&onyx->open_count))
++	if (local_dec_and_test(&onyx->open_count))
  		onyx->spdif_locked = onyx->analog_locked = 0;
  	mutex_unlock(&onyx->mutex);
  
+diff -urNp linux-2.6.37/sound/aoa/codecs/onyx.h linux-2.6.37/sound/aoa/codecs/onyx.h
+--- linux-2.6.37/sound/aoa/codecs/onyx.h	2011-01-04 19:50:19.000000000 -0500
++++ linux-2.6.37/sound/aoa/codecs/onyx.h	2011-01-25 20:24:56.000000000 -0500
+@@ -11,6 +11,7 @@
+ #include <linux/i2c.h>
+ #include <asm/pmac_low_i2c.h>
+ #include <asm/prom.h>
++#include <asm/local.h>
+ 
+ /* PCM3052 register definitions */
+ 
 diff -urNp linux-2.6.37/sound/core/oss/pcm_oss.c linux-2.6.37/sound/core/oss/pcm_oss.c
 --- linux-2.6.37/sound/core/oss/pcm_oss.c	2011-01-04 19:50:19.000000000 -0500
 +++ linux-2.6.37/sound/core/oss/pcm_oss.c	2011-01-17 02:41:02.000000000 -0500
@@ -58402,64 +58649,80 @@ diff -urNp linux-2.6.37/sound/core/seq/seq_lock.h linux-2.6.37/sound/core/seq/se
  
 diff -urNp linux-2.6.37/sound/drivers/mts64.c linux-2.6.37/sound/drivers/mts64.c
 --- linux-2.6.37/sound/drivers/mts64.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/sound/drivers/mts64.c	2011-01-17 02:41:02.000000000 -0500
-@@ -66,7 +66,7 @@ struct mts64 {
++++ linux-2.6.37/sound/drivers/mts64.c	2011-01-25 22:35:55.000000000 -0500
+@@ -28,6 +28,7 @@
+ #include <sound/initval.h>
+ #include <sound/rawmidi.h>
+ #include <sound/control.h>
++#include <asm/local.h>
+ 
+ #define CARD_NAME "Miditerminal 4140"
+ #define DRIVER_NAME "MTS64"
+@@ -66,7 +67,7 @@ struct mts64 {
  	struct pardevice *pardev;
  	int pardev_claimed;
  
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	int current_midi_output_port;
  	int current_midi_input_port;
  	u8 mode[MTS64_NUM_INPUT_PORTS];
-@@ -696,7 +696,7 @@ static int snd_mts64_rawmidi_open(struct
+@@ -696,7 +697,7 @@ static int snd_mts64_rawmidi_open(struct
  {
  	struct mts64 *mts = substream->rmidi->private_data;
  
 -	if (mts->open_count == 0) {
-+	if (atomic_read(&mts->open_count) == 0) {
++	if (local_read(&mts->open_count) == 0) {
  		/* We don't need a spinlock here, because this is just called 
  		   if the device has not been opened before. 
  		   So there aren't any IRQs from the device */
-@@ -704,7 +704,7 @@ static int snd_mts64_rawmidi_open(struct
+@@ -704,7 +705,7 @@ static int snd_mts64_rawmidi_open(struct
  
  		msleep(50);
  	}
 -	++(mts->open_count);
-+	atomic_inc(&mts->open_count);
++	local_inc(&mts->open_count);
  
  	return 0;
  }
-@@ -714,8 +714,7 @@ static int snd_mts64_rawmidi_close(struc
+@@ -714,8 +715,7 @@ static int snd_mts64_rawmidi_close(struc
  	struct mts64 *mts = substream->rmidi->private_data;
  	unsigned long flags;
  
 -	--(mts->open_count);
 -	if (mts->open_count == 0) {
-+	if (atomic_dec_return(&mts->open_count) == 0) {
++	if (local_dec_return(&mts->open_count) == 0) {
  		/* We need the spinlock_irqsave here because we can still
  		   have IRQs at this point */
  		spin_lock_irqsave(&mts->lock, flags);
-@@ -724,8 +723,8 @@ static int snd_mts64_rawmidi_close(struc
+@@ -724,8 +724,8 @@ static int snd_mts64_rawmidi_close(struc
  
  		msleep(500);
  
 -	} else if (mts->open_count < 0)
 -		mts->open_count = 0;
-+	} else if (atomic_read(&mts->open_count) < 0)
-+		atomic_set(&mts->open_count, 0);
++	} else if (local_read(&mts->open_count) < 0)
++		local_set(&mts->open_count, 0);
  
  	return 0;
  }
 diff -urNp linux-2.6.37/sound/drivers/portman2x4.c linux-2.6.37/sound/drivers/portman2x4.c
 --- linux-2.6.37/sound/drivers/portman2x4.c	2011-01-04 19:50:19.000000000 -0500
-+++ linux-2.6.37/sound/drivers/portman2x4.c	2011-01-17 02:41:02.000000000 -0500
-@@ -84,7 +84,7 @@ struct portman {
++++ linux-2.6.37/sound/drivers/portman2x4.c	2011-01-25 20:24:56.000000000 -0500
+@@ -47,6 +47,7 @@
+ #include <sound/initval.h>
+ #include <sound/rawmidi.h>
+ #include <sound/control.h>
++#include <asm/local.h>
+ 
+ #define CARD_NAME "Portman 2x4"
+ #define DRIVER_NAME "portman"
+@@ -84,7 +85,7 @@ struct portman {
  	struct pardevice *pardev;
  	int pardev_claimed;
  
 -	int open_count;
-+	atomic_t open_count;
++	local_t open_count;
  	int mode[PORTMAN_NUM_INPUT_PORTS];
  	struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
  };