## Automatically generated incremental diff
## From:   linux-2.4.27-rc4
## To:     linux-2.4.27-rc5
## Robot:  $Id: make-incremental-diff,v 1.12 2004/01/06 07:19:36 hpa Exp $

diff -urN linux-2.4.27-rc4/Documentation/Configure.help linux-2.4.27-rc5/Documentation/Configure.help
--- linux-2.4.27-rc4/Documentation/Configure.help	2004-08-03 16:53:22.119744965 -0700
+++ linux-2.4.27-rc5/Documentation/Configure.help	2004-08-03 16:53:25.886899613 -0700
@@ -10949,13 +10949,15 @@
   whenever you want). If you want to compile it as a module, say M
   here and read <file:Documentation/modules.txt>.
 
-Network delay simualtor  
-CONFIG_NET_SCH_DELAY
-  Say Y if you want to delay packets by a fixed amount of
-  time. This is often useful to simulate network delay when
+CONFIG_NET_SCH_NETEM
+  Say Y if you want to emulate network delay, loss, and packet
+  re-ordering. This is often useful to simulate networks when
   testing applications or protocols.
-  
-  This code is also available as a module called sch_delay.o
+
+  To compile this driver as a module, choose M here: the module
+  will be called sch_netem.
+
+  If unsure, say N.
 
 Ingress Qdisc
 CONFIG_NET_SCH_INGRESS
diff -urN linux-2.4.27-rc4/Makefile linux-2.4.27-rc5/Makefile
--- linux-2.4.27-rc4/Makefile	2004-08-03 16:53:22.292752067 -0700
+++ linux-2.4.27-rc5/Makefile	2004-08-03 16:53:25.925901214 -0700
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 4
 SUBLEVEL = 27
-EXTRAVERSION = -rc4
+EXTRAVERSION = -rc5
 
 KERNELRELEASE=$(VERSION).$(PATCHLEVEL).$(SUBLEVEL)$(EXTRAVERSION)
 
diff -urN linux-2.4.27-rc4/arch/cris/drivers/eeprom.c linux-2.4.27-rc5/arch/cris/drivers/eeprom.c
--- linux-2.4.27-rc4/arch/cris/drivers/eeprom.c	2003-08-25 04:44:39.000000000 -0700
+++ linux-2.4.27-rc5/arch/cris/drivers/eeprom.c	2004-08-03 16:53:25.927901296 -0700
@@ -506,7 +506,7 @@
 static ssize_t eeprom_read(struct file * file, char * buf, size_t count, loff_t *off)
 {
   int read=0;
-  unsigned long p = file->f_pos;
+  unsigned long p = *off;
 
   unsigned char page;
 
@@ -540,7 +540,7 @@
     return -EFAULT;
   }
 
-  if( (p + count) > eeprom.size)
+  if(count > eeprom.size - p)
   {
     /* truncate count */
     count = eeprom.size - p;
@@ -560,7 +560,7 @@
   
   if(read > 0)
   {
-    file->f_pos += read;
+    *off = p + read;
   }
 
   eeprom.busy--;
@@ -605,7 +605,7 @@
   {
     restart = 0;
     written = 0;
-    p = file->f_pos;
+    p = *off;
    
     
     while( (written < count) && (p < eeprom.size))
@@ -733,10 +733,10 @@
 
   eeprom.busy--;
   wake_up_interruptible(&eeprom.wait_q);
-  if (written == 0 && file->f_pos >= eeprom.size){
+  if (written == 0 && p >= eeprom.size){
     return -ENOSPC;
   }
-  file->f_pos += written;
+  *off = p;
   return written;
 }
 
diff -urN linux-2.4.27-rc4/arch/i386/defconfig linux-2.4.27-rc5/arch/i386/defconfig
--- linux-2.4.27-rc4/arch/i386/defconfig	2004-04-14 06:05:25.000000000 -0700
+++ linux-2.4.27-rc5/arch/i386/defconfig	2004-08-03 16:53:25.928901337 -0700
@@ -105,6 +105,11 @@
 # CONFIG_HOTPLUG_PCI_COMPAQ is not set
 # CONFIG_HOTPLUG_PCI_COMPAQ_NVRAM is not set
 # CONFIG_HOTPLUG_PCI_IBM is not set
+# CONFIG_HOTPLUG_PCI_SHPC is not set
+# CONFIG_HOTPLUG_PCI_SHPC_POLL_EVENT_MODE is not set
+# CONFIG_HOTPLUG_PCI_SHPC_PHPRM_LEGACY is not set
+# CONFIG_HOTPLUG_PCI_PCIE is not set
+# CONFIG_HOTPLUG_PCI_PCIE_POLL_EVENT_MODE is not set
 CONFIG_SYSVIPC=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 CONFIG_SYSCTL=y
@@ -151,6 +156,7 @@
 # CONFIG_CISS_MONITOR_THREAD is not set
 # CONFIG_BLK_DEV_DAC960 is not set
 # CONFIG_BLK_DEV_UMEM is not set
+# CONFIG_BLK_DEV_SX8 is not set
 # CONFIG_BLK_DEV_LOOP is not set
 # CONFIG_BLK_DEV_NBD is not set
 # CONFIG_BLK_DEV_RAM is not set
@@ -266,6 +272,7 @@
 # CONFIG_WDC_ALI15X3 is not set
 # CONFIG_BLK_DEV_AMD74XX is not set
 # CONFIG_AMD74XX_OVERRIDE is not set
+# CONFIG_BLK_DEV_ATIIXP is not set
 # CONFIG_BLK_DEV_CMD64X is not set
 # CONFIG_BLK_DEV_TRIFLEX is not set
 # CONFIG_BLK_DEV_CY82C693 is not set
@@ -294,6 +301,7 @@
 # CONFIG_BLK_DEV_ATARAID is not set
 # CONFIG_BLK_DEV_ATARAID_PDC is not set
 # CONFIG_BLK_DEV_ATARAID_HPT is not set
+# CONFIG_BLK_DEV_ATARAID_MEDLEY is not set
 # CONFIG_BLK_DEV_ATARAID_SII is not set
 
 #
@@ -337,6 +345,14 @@
 # CONFIG_SCSI_AM53C974 is not set
 # CONFIG_SCSI_MEGARAID is not set
 # CONFIG_SCSI_MEGARAID2 is not set
+# CONFIG_SCSI_SATA is not set
+# CONFIG_SCSI_SATA_SVW is not set
+# CONFIG_SCSI_SATA_PROMISE is not set
+# CONFIG_SCSI_SATA_SX4 is not set
+# CONFIG_SCSI_SATA_SIL is not set
+# CONFIG_SCSI_SATA_SIS is not set
+# CONFIG_SCSI_SATA_VIA is not set
+# CONFIG_SCSI_SATA_VITESSE is not set
 # CONFIG_SCSI_BUSLOGIC is not set
 # CONFIG_SCSI_CPQFCTS is not set
 # CONFIG_SCSI_DMX3191D is not set
@@ -453,6 +469,7 @@
 # CONFIG_FEALNX is not set
 # CONFIG_NATSEMI is not set
 # CONFIG_NE2K_PCI is not set
+# CONFIG_FORCEDETH is not set
 # CONFIG_NE3210 is not set
 # CONFIG_ES3210 is not set
 # CONFIG_8139CP is not set
diff -urN linux-2.4.27-rc4/arch/i386/kernel/mtrr.c linux-2.4.27-rc5/arch/i386/kernel/mtrr.c
--- linux-2.4.27-rc4/arch/i386/kernel/mtrr.c	2003-06-13 07:51:29.000000000 -0700
+++ linux-2.4.27-rc5/arch/i386/kernel/mtrr.c	2004-08-03 16:53:25.934901583 -0700
@@ -1648,11 +1648,17 @@
 static ssize_t mtrr_read (struct file *file, char *buf, size_t len,
 			  loff_t *ppos)
 {
-    if (*ppos >= ascii_buf_bytes) return 0;
-    if (*ppos + len > ascii_buf_bytes) len = ascii_buf_bytes - *ppos;
-    if ( copy_to_user (buf, ascii_buffer + *ppos, len) ) return -EFAULT;
-    *ppos += len;
-    return len;
+	loff_t pos = *ppos;
+	if (pos < 0 || pos >= ascii_buf_bytes)
+		return 0;
+	if (len > ascii_buf_bytes - pos)
+		len = ascii_buf_bytes - pos;
+	if (copy_to_user(buf, ascii_buffer + pos, len))
+		return -EFAULT;
+	pos += len;
+	*ppos = pos;
+
+	return len;
 }   /*  End Function mtrr_read  */
 
 static ssize_t mtrr_write (struct file *file, const char *buf, size_t len,
diff -urN linux-2.4.27-rc4/arch/ia64/kernel/efivars.c linux-2.4.27-rc5/arch/ia64/kernel/efivars.c
--- linux-2.4.27-rc4/arch/ia64/kernel/efivars.c	2003-11-28 10:26:19.000000000 -0800
+++ linux-2.4.27-rc5/arch/ia64/kernel/efivars.c	2004-08-03 16:53:25.951902281 -0700
@@ -364,6 +364,7 @@
 	int ret;
 	const int max_nr_entries = 7; 	/* num ptrs to tables we could expose */
 	const int max_line_len = 80;
+	loff_t pos = *ppos;
 
 	if (!efi.systab)
 		return 0;
@@ -388,13 +389,13 @@
 	if (efi.boot_info)
 		length += sprintf(proc_buffer + length, "BOOTINFO=0x%lx\n", __pa(efi.boot_info));
 
-	if (*ppos >= length) {
+	if (pos != (unsigned) pos || pos >= length) {
 		ret = 0;
 		goto out;
 	}
 
-	data = proc_buffer + file->f_pos;
-	size = length - file->f_pos;
+	data = proc_buffer + pos;
+	size = length - pos;
 	if (size > count)
 		size = count;
 	if (copy_to_user(buffer, data, size)) {
@@ -402,7 +403,7 @@
 		goto out;
 	}
 
-	*ppos += size;
+	*ppos = pos + size;
 	ret = size;
 
 out:
diff -urN linux-2.4.27-rc4/arch/ia64/kernel/salinfo.c linux-2.4.27-rc5/arch/ia64/kernel/salinfo.c
--- linux-2.4.27-rc4/arch/ia64/kernel/salinfo.c	2004-04-14 06:05:26.000000000 -0700
+++ linux-2.4.27-rc5/arch/ia64/kernel/salinfo.c	2004-08-03 16:53:25.956902486 -0700
@@ -451,6 +451,7 @@
 	size_t size;
 	u8 *buf;
 	u64 bufsize;
+	loff_t pos = *ppos;
 
 	if (data->state == STATE_LOG_RECORD) {
 		buf = data->log_buffer;
@@ -462,17 +463,17 @@
 		buf = NULL;
 		bufsize = 0;
 	}
-	if (*ppos >= bufsize)
+	if (pos != (unsigned)pos || pos >= bufsize)
 		return 0;
 
-	saldata = buf + file->f_pos;
-	size = bufsize - file->f_pos;
+	saldata = buf + pos;
+	size = bufsize - pos;
 	if (size > count)
 		size = count;
 	if (copy_to_user(buffer, saldata, size))
 		return -EFAULT;
 
-	*ppos += size;
+	*ppos = pos + size;
 	return size;
 }
 
diff -urN linux-2.4.27-rc4/arch/mips/sibyte/sb1250/bcm1250_tbprof.c linux-2.4.27-rc5/arch/mips/sibyte/sb1250/bcm1250_tbprof.c
--- linux-2.4.27-rc4/arch/mips/sibyte/sb1250/bcm1250_tbprof.c	2003-08-25 04:44:40.000000000 -0700
+++ linux-2.4.27-rc5/arch/mips/sibyte/sb1250/bcm1250_tbprof.c	2004-08-03 16:53:25.960902651 -0700
@@ -300,6 +300,9 @@
 	char *dest    =	 buf;
 	long  cur_off = *offp;
 
+	if (cur_off < 0)
+		return -EINVAL;
+
 	count = 0;
 	cur_sample = cur_off / TB_SAMPLE_SIZE;
 	sample_off = cur_off % TB_SAMPLE_SIZE;
diff -urN linux-2.4.27-rc4/arch/ppc/config.in linux-2.4.27-rc5/arch/ppc/config.in
--- linux-2.4.27-rc4/arch/ppc/config.in	2004-04-14 06:05:27.000000000 -0700
+++ linux-2.4.27-rc5/arch/ppc/config.in	2004-08-03 16:53:25.962902733 -0700
@@ -410,7 +410,6 @@
 
 if [ "$CONFIG_ALL_PPC" = "y" ]; then
   bool 'Support for Open Firmware device tree in /proc' CONFIG_PROC_DEVICETREE
-  bool 'Support for RTAS (RunTime Abstraction Services) in /proc' CONFIG_PPC_RTAS
   bool 'Support for PReP Residual Data' CONFIG_PREP_RESIDUAL
   dep_bool '  Support for reading of PReP Residual Data in /proc' CONFIG_PROC_PREPRESIDUAL $CONFIG_PREP_RESIDUAL
   define_bool CONFIG_PPCBUG_NVRAM y
diff -urN linux-2.4.27-rc4/arch/ppc/kernel/ppc_htab.c linux-2.4.27-rc5/arch/ppc/kernel/ppc_htab.c
--- linux-2.4.27-rc4/arch/ppc/kernel/ppc_htab.c	2004-02-18 05:36:30.000000000 -0800
+++ linux-2.4.27-rc5/arch/ppc/kernel/ppc_htab.c	2004-08-03 16:53:25.965902856 -0700
@@ -112,6 +112,7 @@
 			     size_t count, loff_t *ppos)
 {
 	unsigned long mmcr0 = 0, pmc1 = 0, pmc2 = 0;
+	loff_t pos = *ppos;
 	int n = 0;
 #if defined(CONFIG_PPC_STD_MMU) && !defined(CONFIG_PPC64BRIDGE)
 	int valid;
@@ -219,14 +220,14 @@
 		      "Non-error misses: %lu\n"
 		      "Error misses\t: %lu\n",
 		      pte_misses, pte_errors);
-	if (*ppos >= strlen(buffer))
+	if (pos != (unsigned)pos || pos >= strlen(buffer))
 		return 0;
-	if (n > strlen(buffer) - *ppos)
-		n = strlen(buffer) - *ppos;
+	if (n > strlen(buffer) - pos)
+		n = strlen(buffer) - pos;
 	if (n > count)
 		n = count;
-	copy_to_user(buf, buffer + *ppos, n);
-	*ppos += n;
+	copy_to_user(buf, buffer + pos, n);
+	*ppos = pos + n;
 	return n;
 }
 
diff -urN linux-2.4.27-rc4/arch/ppc/platforms/Makefile linux-2.4.27-rc5/arch/ppc/platforms/Makefile
--- linux-2.4.27-rc4/arch/ppc/platforms/Makefile	2004-04-14 06:05:27.000000000 -0700
+++ linux-2.4.27-rc5/arch/ppc/platforms/Makefile	2004-08-03 16:53:25.966902897 -0700
@@ -51,7 +51,6 @@
 					prep_time.o prep_setup.o pmac_sleep.o \
 					pmac_nvram.o
 obj-$(CONFIG_PMAC_BACKLIGHT)	+= pmac_backlight.o
-obj-$(CONFIG_PPC_RTAS)		+= error_log.o proc_rtas.o
 obj-$(CONFIG_PREP_RESIDUAL)	+= residual.o
 obj-$(CONFIG_GEMINI)		+= gemini_pci.o gemini_setup.o gemini_prom.o
 obj-$(CONFIG_LOPEC)		+= lopec_setup.o lopec_pci.o
diff -urN linux-2.4.27-rc4/arch/ppc/platforms/error_log.c linux-2.4.27-rc5/arch/ppc/platforms/error_log.c
--- linux-2.4.27-rc4/arch/ppc/platforms/error_log.c	2003-08-25 04:44:40.000000000 -0700
+++ linux-2.4.27-rc5/arch/ppc/platforms/error_log.c	1969-12-31 16:00:00.000000000 -0800
@@ -1,183 +0,0 @@
-/*
- *  arch/ppc/kernel/error_log.c
- *
- *  Copyright (c) 2000 Tilmann Bitterberg
- *  (tilmann@bitterberg.de)
- *
- *  Error processing of errors found by rtas even-scan routine
- *  which is done with every heartbeat. (chrp_setup.c)
- */
-
-#include <linux/sched.h>
-
-#include <asm/prom.h>
-
-#include "error_log.h"
-
-/* ****************************************************************** */
-/*
- * EVENT-SCAN
- * The whole stuff below here doesn't take any action when it found
- * an error, it just prints as much information as possible and
- * then its up to the user to decide what to do.
- *
- * Returns 0 if no errors were found
- * Returns 1 if there may be more errors
- */
-int ppc_rtas_errorlog_scan(void)
-{
-const char *_errlog_severity[] = {
-#ifdef VERBOSE_ERRORS
-	"No Error\n\t\
-Should require no further information",
-	"Event\n\t\
-This is not really an error, it is an event. I use events\n\t\
-to communicate with RTAS back and forth.",
-	"Warning\n\t\
-Indicates a non-state-losing error, either fully recovered\n\t\
-by RTAS or not needing recovery. Ignore it.",
-	"Error sync\n\t\
-May only be fatal to a certain program or thread. Recovery\n\t\
-and continuation is possible, if I only had a handler for\n\t\
-this. Less serious",
-	"Error\n\t\
-Less serious, but still causing a loss of data and state.\n\t\
-I can't tell you exactly what to do, You have to decide\n\t\
-with help from the target and initiator field, what kind\n\t\
-of further actions may take place.",
-	"Fatal\n\t\
-Represent a permanent hardware failure and I believe this\n\t\
-affects my overall performance and behaviour. I would not\n\t\
-attempt to continue normal operation."
-#else
-	"No Error",
-	"Event",
-	"Warning",
-	"Error sync",
-	"Error",
-	"Fatal"
-#endif /* VERBOSE_ERRORS */
-};
-
-#if 0 /* unused?? */
-const char *_errlog_disposition[] = {
-#ifdef VERBOSE_ERRORS
-	"Fully recovered\n\t\
-There was an error, but it is fully recovered by RTAS.",
-	"Limited recovery\n\t\
-RTAS was able to recover the state of the machine, but some\n\t\
-feature of the machine has been disabled or lost (for example\n\t\
-error checking) or performance may suffer.",
-	"Not recovered\n\t\
-Whether RTAS did not try to recover anything or recovery failed:\n\t\
-HOUSTON, WE HAVE A PROBLEM!"
-#else
-	"Fully recovered",
-	"Limited recovery",
-	"Not recovered"
-#endif /* VERBOSE_ERRORS */
-};
-#endif
-
-const char *_errlog_extended[] = {
-#ifdef VERBOSE_ERRORS
-	"Not present\n\t\
-Sad, the RTAS call didn't return an extended error log.",
-	"Present\n\t\
-The extended log is present and hopefully it contains a lot of\n\t\
-useful information, which leads to the solution of the problem."
-#else
-	"Not present",
-	"Present"
-#endif /* VERBOSE_ERRORS */
-};
-
-const char *_errlog_initiator[] = {
-	"Unknown or not applicable",
-	"CPU",
-	"PCI",
-	"ISA",
-	"Memory",
-	"Power management"
-};
-
-const char *_errlog_target[] = {
-	"Unknown or not applicable",
-	"CPU",
-	"PCI",
-	"ISA",
-	"Memory",
-	"Power management"
-};
-	rtas_error_log error_log;
-	char logdata[1024];
-	int error;
-#if 0 /* unused?? */
-	int retries = 0; /* if HW error, try 10 times */
-#endif
-
-	error = call_rtas ("event-scan", 4, 1, (unsigned long *)&error_log,
-			INTERNAL_ERROR | EPOW_WARNING,
-			0, __pa(logdata), 1024);
-
-	if (error == 1) /* no errors found */
-		return 0;
-
-	if (error == -1) {
-		printk(KERN_ERR "Unable to get errors. Do you a favor and throw this box away\n");
-		return 0;
-	}
-	if (error_log.version != 1)
-		printk(KERN_WARNING "Unknown version (%d), please implement me\n",
-				error_log.version);
-
-	switch (error_log.disposition) {
-		case DISP_FULLY_RECOVERED:
-			/* there was an error, but everything is fine now */
-			return 0;
-		case DISP_NOT_RECOVERED:
-			printk("We have a really serious Problem!\n");
-		case DISP_LIMITED_RECOVERY:
-			printk("Error classification\n");
-			printk("Severity  : %s\n",
-					ppc_rtas_errorlog_check_severity (error_log));
-			printk("Initiator : %s\n",
-					ppc_rtas_errorlog_check_initiator (error_log));
-			printk("Target    : %s\n",
-					ppc_rtas_errorlog_check_target (error_log));
-			printk("Type      : %s\n",
-					ppc_rtas_errorlog_check_type (error_log));
-			printk("Ext. log  : %s\n",
-					ppc_rtas_errorlog_check_extended (error_log));
-			if (error_log.extended)
-				ppc_rtas_errorlog_disect_extended (logdata);
-			return 1;
-		default:
-			/* nothing */
-			break;
-	}
-	return 0;
-}
-/* ****************************************************************** */
-const char * ppc_rtas_errorlog_check_type (rtas_error_log error_log)
-{
-	const char *_errlog_type[] = {
-		"unknown type",
-		"too many tries failed",
-		"TCE error",
-		"RTAS device failed",
-		"target timed out",
-		"parity error on data",			/* 5 */
-		"parity error on address",
-		"parity error on external cache",
-		"access to invalid address",
-		"uncorrectable ECC error",
-		"corrected ECC error"			/* 10 */
-	};
-	if (error_log.type == TYPE_EPOW)
-		return "EPOW";
-	if (error_log.type >= TYPE_PMGM_POWER_SW_ON)
-		return "PowerMGM Event (not handled right now)";
-	return _errlog_type[error_log.type];
-}
-
diff -urN linux-2.4.27-rc4/arch/ppc/platforms/error_log.h linux-2.4.27-rc5/arch/ppc/platforms/error_log.h
--- linux-2.4.27-rc4/arch/ppc/platforms/error_log.h	2003-08-25 04:44:40.000000000 -0700
+++ linux-2.4.27-rc5/arch/ppc/platforms/error_log.h	1969-12-31 16:00:00.000000000 -0800
@@ -1,95 +0,0 @@
-#ifndef __ERROR_LOG_H__
-#define __ERROR_LOG_H__
-
-#define VERBOSE_ERRORS		1 /* Maybe I enlarge the kernel too much */
-#undef VERBOSE_ERRORS
-
-/* Event classes */
-/* XXX: Endianess correct? NOW*/
-#define INTERNAL_ERROR		0x80000000 /* set bit 0 */
-#define EPOW_WARNING		0x40000000 /* set bit 1 */
-#define POWERMGM_EVENTS		0x20000000 /* set bit 2 */
-
-/* event-scan returns */
-#define SEVERITY_FATAL		0x5
-#define SEVERITY_ERROR		0x4
-#define SEVERITY_ERROR_SYNC	0x3
-#define SEVERITY_WARNING	0x2
-#define SEVERITY_EVENT		0x1
-#define SEVERITY_NO_ERROR	0x0
-#define DISP_FULLY_RECOVERED	0x0
-#define DISP_LIMITED_RECOVERY	0x1
-#define DISP_NOT_RECOVERED	0x2
-#define PART_PRESENT		0x0
-#define PART_NOT_PRESENT	0x1
-#define INITIATOR_UNKNOWN	0x0
-#define INITIATOR_CPU		0x1
-#define INITIATOR_PCI		0x2
-#define INITIATOR_ISA		0x3
-#define INITIATOR_MEMORY	0x4
-#define INITIATOR_POWERMGM	0x5
-#define TARGET_UNKNOWN		0x0
-#define TARGET_CPU		0x1
-#define TARGET_PCI		0x2
-#define TARGET_ISA		0x3
-#define TARGET_MEMORY		0x4
-#define TARGET_POWERMGM		0x5
-#define TYPE_RETRY		0x01
-#define TYPE_TCE_ERR		0x02
-#define TYPE_INTERN_DEV_FAIL	0x03
-#define TYPE_TIMEOUT		0x04
-#define TYPE_DATA_PARITY	0x05
-#define TYPE_ADDR_PARITY	0x06
-#define TYPE_CACHE_PARITY	0x07
-#define TYPE_ADDR_INVALID	0x08
-#define TYPE_ECC_UNCORR		0x09
-#define TYPE_ECC_CORR		0x0a
-#define TYPE_EPOW		0x40
-/* I don't add PowerMGM events right now, this is a different topic */
-#define TYPE_PMGM_POWER_SW_ON	0x60
-#define TYPE_PMGM_POWER_SW_OFF	0x61
-#define TYPE_PMGM_LID_OPEN	0x62
-#define TYPE_PMGM_LID_CLOSE	0x63
-#define TYPE_PMGM_SLEEP_BTN	0x64
-#define TYPE_PMGM_WAKE_BTN	0x65
-#define TYPE_PMGM_BATTERY_WARN	0x66
-#define TYPE_PMGM_BATTERY_CRIT	0x67
-#define TYPE_PMGM_SWITCH_TO_BAT	0x68
-#define TYPE_PMGM_SWITCH_TO_AC	0x69
-#define TYPE_PMGM_KBD_OR_MOUSE	0x6a
-#define TYPE_PMGM_ENCLOS_OPEN	0x6b
-#define TYPE_PMGM_ENCLOS_CLOSED	0x6c
-#define TYPE_PMGM_RING_INDICATE	0x6d
-#define TYPE_PMGM_LAN_ATTENTION	0x6e
-#define TYPE_PMGM_TIME_ALARM	0x6f
-#define TYPE_PMGM_CONFIG_CHANGE	0x70
-#define TYPE_PMGM_SERVICE_PROC	0x71
-
-typedef struct _rtas_error_log {
-	unsigned long version:8;		/* Architectural version */
-	unsigned long severity:3;		/* Severity level of error */
-	unsigned long disposition:2;		/* Degree of recovery */
-	unsigned long extended:1;		/* extended log present? */
-	unsigned long /* reserved */ :2;	/* Reserved for future use */
-	unsigned long initiator:4;		/* Initiator of event */
-	unsigned long target:4;			/* Target of failed operation */
-	unsigned long type:8;			/* General event or error*/
-	unsigned long extended_log_length:32;	/* length in bytes */
-} rtas_error_log;
-
-/* ****************************************************************** */
-#define ppc_rtas_errorlog_check_severity(x) \
-	(_errlog_severity[x.severity])
-#define ppc_rtas_errorlog_check_target(x) \
-	(_errlog_target[x.target])
-#define ppc_rtas_errorlog_check_initiator(x) \
-	(_errlog_initiator[x.initiator])
-#define ppc_rtas_errorlog_check_extended(x) \
-	(_errlog_extended[x.extended])
-#define ppc_rtas_errorlog_disect_extended(x) \
-	do { /* implement me */ } while(0)
-extern const char * ppc_rtas_errorlog_check_type (rtas_error_log error_log);
-extern int ppc_rtas_errorlog_scan(void);
-
-
-#endif /* __ERROR_LOG_H__ */
diff -urN linux-2.4.27-rc4/arch/ppc/platforms/proc_rtas.c linux-2.4.27-rc5/arch/ppc/platforms/proc_rtas.c
--- linux-2.4.27-rc4/arch/ppc/platforms/proc_rtas.c	2003-08-25 04:44:40.000000000 -0700
+++ linux-2.4.27-rc5/arch/ppc/platforms/proc_rtas.c	1969-12-31 16:00:00.000000000 -0800
@@ -1,784 +0,0 @@
-/*
- *   arch/ppc/kernel/proc_rtas.c
- *   Copyright (C) 2000 Tilmann Bitterberg
- *   (tilmann@bitterberg.de)
- *
- *   RTAS (Runtime Abstraction Services) stuff
- *   Intention is to provide a clean user interface
- *   to use the RTAS.
- *
- *   TODO:
- *   Split off a header file and maybe move it to a different
- *   location. Write Documentation on what the /proc/rtas/ entries
- *   actually do.
- */
-
-#include <linux/errno.h>
-#include <linux/sched.h>
-#include <linux/proc_fs.h>
-#include <linux/stat.h>
-#include <linux/ctype.h>
-#include <linux/time.h>
-#include <linux/string.h>
-
-#include <asm/uaccess.h>
-#include <asm/bitops.h>
-#include <asm/processor.h>
-#include <asm/io.h>
-#include <asm/prom.h>
-#include <asm/machdep.h> /* for ppc_md */
-#include <asm/time.h>
-
-/* Token for Sensors */
-#define KEY_SWITCH		0x0001
-#define ENCLOSURE_SWITCH	0x0002
-#define THERMAL_SENSOR		0x0003
-#define LID_STATUS		0x0004
-#define POWER_SOURCE		0x0005
-#define BATTERY_VOLTAGE		0x0006
-#define BATTERY_REMAINING	0x0007
-#define BATTERY_PERCENTAGE	0x0008
-#define EPOW_SENSOR		0x0009
-#define BATTERY_CYCLESTATE	0x000a
-#define BATTERY_CHARGING	0x000b
-
-/* IBM specific sensors */
-#define IBM_SURVEILLANCE	0x2328 /* 9000 */
-#define IBM_FANRPM		0x2329 /* 9001 */
-#define IBM_VOLTAGE		0x232a /* 9002 */
-#define IBM_DRCONNECTOR		0x232b /* 9003 */
-#define IBM_POWERSUPPLY		0x232c /* 9004 */
-#define IBM_INTQUEUE		0x232d /* 9005 */
-
-/* Status return values */
-#define SENSOR_CRITICAL_HIGH	13
-#define SENSOR_WARNING_HIGH	12
-#define SENSOR_NORMAL		11
-#define SENSOR_WARNING_LOW	10
-#define SENSOR_CRITICAL_LOW	 9
-#define SENSOR_SUCCESS		 0
-#define SENSOR_HW_ERROR		-1
-#define SENSOR_BUSY		-2
-#define SENSOR_NOT_EXIST	-3
-#define SENSOR_DR_ENTITY	-9000
-
-/* Location Codes */
-#define LOC_SCSI_DEV_ADDR	'A'
-#define LOC_SCSI_DEV_LOC	'B'
-#define LOC_CPU			'C'
-#define LOC_DISKETTE		'D'
-#define LOC_ETHERNET		'E'
-#define LOC_FAN			'F'
-#define LOC_GRAPHICS		'G'
-/* reserved / not used		'H' */
-#define LOC_IO_ADAPTER		'I'
-/* reserved / not used		'J' */
-#define LOC_KEYBOARD		'K'
-#define LOC_LCD			'L'
-#define LOC_MEMORY		'M'
-#define LOC_NV_MEMORY		'N'
-#define LOC_MOUSE		'O'
-#define LOC_PLANAR		'P'
-#define LOC_OTHER_IO		'Q'
-#define LOC_PARALLEL		'R'
-#define LOC_SERIAL		'S'
-#define LOC_DEAD_RING		'T'
-#define LOC_RACKMOUNTED		'U' /* for _u_nit is rack mounted */
-#define LOC_VOLTAGE		'V'
-#define LOC_SWITCH_ADAPTER	'W'
-#define LOC_OTHER		'X'
-#define LOC_FIRMWARE		'Y'
-#define LOC_SCSI		'Z'
-
-/* Tokens for indicators */
-#define TONE_FREQUENCY		0x0001 /* 0 - 1000 (HZ)*/
-#define TONE_VOLUME		0x0002 /* 0 - 100 (%) */
-#define SYSTEM_POWER_STATE	0x0003
-#define WARNING_LIGHT		0x0004
-#define DISK_ACTIVITY_LIGHT	0x0005
-#define HEX_DISPLAY_UNIT	0x0006
-#define BATTERY_WARNING_TIME	0x0007
-#define CONDITION_CYCLE_REQUEST	0x0008
-#define SURVEILLANCE_INDICATOR	0x2328 /* 9000 */
-#define DR_ACTION		0x2329 /* 9001 */
-#define DR_INDICATOR		0x232a /* 9002 */
-/* 9003 - 9004: Vendor specific */
-#define GLOBAL_INTERRUPT_QUEUE	0x232d /* 9005 */
-/* 9006 - 9999: Vendor specific */
-
-/* other */
-#define MAX_SENSORS		 17  /* I only know of 17 sensors */
-#define MAX_LINELENGTH          256
-#define SENSOR_PREFIX		"ibm,sensor-"
-#define cel_to_fahr(x)		((x*9/5)+32)
-
-
-/* Globals */
-static struct proc_dir_entry *proc_rtas;
-static struct rtas_sensors sensors;
-static struct device_node *rtas;
-static unsigned long power_on_time = 0; /* Save the time the user set */
-static char progress_led[MAX_LINELENGTH];
-
-static unsigned long rtas_tone_frequency = 1000;
-static unsigned long rtas_tone_volume = 0;
-
-/* ****************STRUCTS******************************************* */
-struct individual_sensor {
-	unsigned int token;
-	unsigned int quant;
-};
-
-struct rtas_sensors {
-        struct individual_sensor sensor[MAX_SENSORS];
-	unsigned int quant;
-};
-
-/* ****************************************************************** */
-/* Declarations */
-static int ppc_rtas_sensor_read(char * buf, char ** start, off_t off,
-		int count, int *eof, void *data);
-static ssize_t ppc_rtas_clock_read(struct file * file, char * buf,
-		size_t count, loff_t *ppos);
-static ssize_t ppc_rtas_clock_write(struct file * file, const char * buf,
-		size_t count, loff_t *ppos);
-static ssize_t ppc_rtas_progress_read(struct file * file, char * buf,
-		size_t count, loff_t *ppos);
-static ssize_t ppc_rtas_progress_write(struct file * file, const char * buf,
-		size_t count, loff_t *ppos);
-static ssize_t ppc_rtas_poweron_read(struct file * file, char * buf,
-		size_t count, loff_t *ppos);
-static ssize_t ppc_rtas_poweron_write(struct file * file, const char * buf,
-		size_t count, loff_t *ppos);
-
-static ssize_t ppc_rtas_tone_freq_write(struct file * file, const char * buf,
-		size_t count, loff_t *ppos);
-static ssize_t ppc_rtas_tone_freq_read(struct file * file, char * buf,
-		size_t count, loff_t *ppos);
-static ssize_t ppc_rtas_tone_volume_write(struct file * file, const char * buf,
-		size_t count, loff_t *ppos);
-static ssize_t ppc_rtas_tone_volume_read(struct file * file, char * buf,
-		size_t count, loff_t *ppos);
-
-struct file_operations ppc_rtas_poweron_operations = {
-	read:		ppc_rtas_poweron_read,
-	write:		ppc_rtas_poweron_write
-};
-struct file_operations ppc_rtas_progress_operations = {
-	read:		ppc_rtas_progress_read,
-	write:		ppc_rtas_progress_write
-};
-
-struct file_operations ppc_rtas_clock_operations = {
-	read:		ppc_rtas_clock_read,
-	write:		ppc_rtas_clock_write
-};
-
-struct file_operations ppc_rtas_tone_freq_operations = {
-	read:		ppc_rtas_tone_freq_read,
-	write:		ppc_rtas_tone_freq_write
-};
-struct file_operations ppc_rtas_tone_volume_operations = {
-	read:		ppc_rtas_tone_volume_read,
-	write:		ppc_rtas_tone_volume_write
-};
-
-int ppc_rtas_find_all_sensors (void);
-int ppc_rtas_process_sensor(struct individual_sensor s, int state,
-		int error, char * buf);
-char * ppc_rtas_process_error(int error);
-int get_location_code(struct individual_sensor s, char * buf);
-int check_location_string (char *c, char * buf);
-int check_location (char *c, int idx, char * buf);
-
-/* ****************************************************************** */
-/* MAIN                                                               */
-/* ****************************************************************** */
-void proc_rtas_init(void)
-{
-	struct proc_dir_entry *entry;
-
-	rtas = find_devices("rtas");
-	if ((rtas == 0) || (_machine != _MACH_chrp)) {
-		return;
-	}
-
-	proc_rtas = proc_mkdir("rtas", 0);
-	if (proc_rtas == 0)
-		return;
-
-	/* /proc/rtas entries */
-
-	entry = create_proc_entry("progress", S_IRUGO|S_IWUSR, proc_rtas);
-	if (entry) entry->proc_fops = &ppc_rtas_progress_operations;
-
-	entry = create_proc_entry("clock", S_IRUGO|S_IWUSR, proc_rtas);
-	if (entry) entry->proc_fops = &ppc_rtas_clock_operations;
-
-	entry = create_proc_entry("poweron", S_IWUSR|S_IRUGO, proc_rtas);
-	if (entry) entry->proc_fops = &ppc_rtas_poweron_operations;
-
-	create_proc_read_entry("sensors", S_IRUGO, proc_rtas,
-			ppc_rtas_sensor_read, NULL);
-
-	entry = create_proc_entry("frequency", S_IWUSR|S_IRUGO, proc_rtas);
-	if (entry) entry->proc_fops = &ppc_rtas_tone_freq_operations;
-
-	entry = create_proc_entry("volume", S_IWUSR|S_IRUGO, proc_rtas);
-	if (entry) entry->proc_fops = &ppc_rtas_tone_volume_operations;
-}
-
-/* ****************************************************************** */
-/* POWER-ON-TIME                                                      */
-/* ****************************************************************** */
-static ssize_t ppc_rtas_poweron_write(struct file * file, const char * buf,
-		size_t count, loff_t *ppos)
-{
-	struct rtc_time tm;
-	unsigned long nowtime;
-	char *dest;
-	int error;
-
-	nowtime = simple_strtoul(buf, &dest, 10);
-	if (*dest != '\0' && *dest != '\n') {
-		printk("ppc_rtas_poweron_write: Invalid time\n");
-		return count;
-	}
-	power_on_time = nowtime; /* save the time */
-
-	to_tm(nowtime, &tm);
-
-	error = call_rtas("set-time-for-power-on", 7, 1, NULL,
-			tm.tm_year, tm.tm_mon, tm.tm_mday,
-			tm.tm_hour, tm.tm_min, tm.tm_sec, 0 /* nano */);
-	if (error != 0)
-		printk(KERN_WARNING "error: setting poweron time returned: %s\n",
-				ppc_rtas_process_error(error));
-	return count;
-}
-/* ****************************************************************** */
-static ssize_t ppc_rtas_poweron_read(struct file * file, char * buf,
-		size_t count, loff_t *ppos)
-{
-	int n;
-	if (power_on_time == 0)
-		n = sprintf(buf, "Power on time not set\n");
-	else
-		n = sprintf(buf, "%lu\n", power_on_time);
-
-	if (*ppos >= strlen(buf))
-		return 0;
-	if (n > strlen(buf) - *ppos)
-		n = strlen(buf) - *ppos;
-	if (n > count)
-		n = count;
-	*ppos += n;
-	return n;
-}
-
-/* ****************************************************************** */
-/* PROGRESS                                                           */
-/* ****************************************************************** */
-static ssize_t ppc_rtas_progress_write(struct file * file, const char * buf,
-		size_t count, loff_t *ppos)
-{
-	unsigned long hex;
-
-	strcpy(progress_led, buf); /* save the string */
-	/* Lets see if the user passed hexdigits */
-	hex = simple_strtoul(buf, NULL, 10);
-
-	ppc_md.progress ((char *)buf, hex);
-	return count;
-
-	/* clear the line */ /* ppc_md.progress("                   ", 0xffff);*/
-}
-/* ****************************************************************** */
-static ssize_t ppc_rtas_progress_read(struct file * file, char * buf,
-		size_t count, loff_t *ppos)
-{
-	int n = 0;
-	if (progress_led != NULL)
-		n = sprintf (buf, "%s\n", progress_led);
-	if (*ppos >= strlen(buf))
-		return 0;
-	if (n > strlen(buf) - *ppos)
-		n = strlen(buf) - *ppos;
-	if (n > count)
-		n = count;
-	*ppos += n;
-	return n;
-}
-
-/* ****************************************************************** */
-/* CLOCK                                                              */
-/* ****************************************************************** */
-static ssize_t ppc_rtas_clock_write(struct file * file, const char * buf,
-		size_t count, loff_t *ppos)
-{
-	struct rtc_time tm;
-	unsigned long nowtime;
-	char *dest;
-	int error;
-
-	nowtime = simple_strtoul(buf, &dest, 10);
-	if (*dest != '\0' && *dest != '\n') {
-		printk("ppc_rtas_clock_write: Invalid time\n");
-		return count;
-	}
-
-	to_tm(nowtime, &tm);
-	error = call_rtas("set-time-of-day", 7, 1, NULL,
-			tm.tm_year, tm.tm_mon, tm.tm_mday,
-			tm.tm_hour, tm.tm_min, tm.tm_sec, 0);
-	if (error != 0)
-		printk(KERN_WARNING "error: setting the clock returned: %s\n",
-				ppc_rtas_process_error(error));
-	return count;
-}
-/* ****************************************************************** */
-static ssize_t ppc_rtas_clock_read(struct file * file, char * buf,
-		size_t count, loff_t *ppos)
-{
-	unsigned int year, mon, day, hour, min, sec;
-	unsigned long *ret = kmalloc(4*8, GFP_KERNEL);
-	int n, error;
-
-	error = call_rtas("get-time-of-day", 0, 8, ret);
-
-	year = ret[0]; mon  = ret[1]; day  = ret[2];
-	hour = ret[3]; min  = ret[4]; sec  = ret[5];
-
-	if (error != 0){
-		printk(KERN_WARNING "error: reading the clock returned: %s\n",
-				ppc_rtas_process_error(error));
-		n = sprintf (buf, "0");
-	} else {
-		n = sprintf (buf, "%lu\n", mktime(year, mon, day, hour, min, sec));
-	}
-	kfree(ret);
-
-	if (*ppos >= strlen(buf))
-		return 0;
-	if (n > strlen(buf) - *ppos)
-		n = strlen(buf) - *ppos;
-	if (n > count)
-		n = count;
-	*ppos += n;
-	return n;
-}
-
-/* ****************************************************************** */
-/* SENSOR STUFF                                                       */
-/* ****************************************************************** */
-static int ppc_rtas_sensor_read(char * buf, char ** start, off_t off,
-		int count, int *eof, void *data)
-{
-	int i,j,n;
-	unsigned long ret;
-	int state, error;
-	char buffer[MAX_LINELENGTH*MAX_SENSORS]; /* May not be enough */
-
-	if (count < 0)
-		return -EINVAL;
-
-	n  = sprintf ( buffer  , "RTAS (RunTime Abstraction Services) Sensor Information\n");
-	n += sprintf ( buffer+n, "Sensor\t\tValue\t\tCondition\tLocation\n");
-	n += sprintf ( buffer+n, "********************************************************\n");
-
-	if (ppc_rtas_find_all_sensors() != 0) {
-		n += sprintf ( buffer+n, "\nNo sensors are available\n");
-		goto return_string;
-	}
-
-	for (i=0; i<sensors.quant; i++) {
-		j = sensors.sensor[i].quant;
-		/* A sensor may have multiple instances */
-		while (j >= 0) {
-			error =	call_rtas("get-sensor-state", 2, 2, &ret,
-				  sensors.sensor[i].token, sensors.sensor[i].quant-j);
-			state = (int) ret;
-			n += ppc_rtas_process_sensor(sensors.sensor[i], state, error, buffer+n );
-			n += sprintf (buffer+n, "\n");
-			j--;
-		} /* while */
-	} /* for */
-
-return_string:
-	if (off >= strlen(buffer)) {
-		*eof = 1;
-		return 0;
-	}
-	if (n > strlen(buffer) - off)
-		n = strlen(buffer) - off;
-	if (n > count)
-		n = count;
-	else
-		*eof = 1;
-	memcpy(buf, buffer + off, n);
-	*start = buf;
-	return n;
-}
-
-/* ****************************************************************** */
-
-int ppc_rtas_find_all_sensors (void)
-{
-	unsigned long *utmp;
-	int len, i, j;
-
-	utmp = (unsigned long *) get_property(rtas, "rtas-sensors", &len);
-	if (utmp == NULL) {
-		printk (KERN_ERR "error: could not get rtas-sensors\n");
-		return 1;
-	}
-
-	sensors.quant = len / 8;      /* int + int */
-
-	for (i=0, j=0; j<sensors.quant; i+=2, j++) {
-		sensors.sensor[j].token = utmp[i];
-		sensors.sensor[j].quant = utmp[i+1];
-	}
-	return 0;
-}
-
-/* ****************************************************************** */
-/*
- * Builds a string of what rtas returned
- */
-char * ppc_rtas_process_error(int error)
-{
-	switch (error) {
-		case SENSOR_CRITICAL_HIGH:
-			return "(critical high)";
-		case SENSOR_WARNING_HIGH:
-			return "(warning high)";
-		case SENSOR_NORMAL:
-			return "(normal)";
-		case SENSOR_WARNING_LOW:
-			return "(warning low)";
-		case SENSOR_CRITICAL_LOW:
-			return "(critical low)";
-		case SENSOR_SUCCESS:
-			return "(read ok)";
-		case SENSOR_HW_ERROR:
-			return "(hardware error)";
-		case SENSOR_BUSY:
-			return "(busy)";
-		case SENSOR_NOT_EXIST:
-			return "(non existant)";
-		case SENSOR_DR_ENTITY:
-			return "(dr entity removed)";
-		default:
-			return "(UNKNOWN)";
-	}
-}
-
-/* ****************************************************************** */
-/*
- * Builds a string out of what the sensor said
- */
-
-int ppc_rtas_process_sensor(struct individual_sensor s, int state,
-		int error, char * buf)
-{
-	/* Defined return vales */
-	const char * key_switch[]        = { "Off\t", "Normal\t", "Secure\t", "Mainenance" };
-	const char * enclosure_switch[]  = { "Closed", "Open" };
-	const char * lid_status[]        = { " ", "Open", "Closed" };
-	const char * power_source[]      = { "AC\t", "Battery", "AC & Battery" };
-	const char * battery_remaining[] = { "Very Low", "Low", "Mid", "High" };
-	const char * epow_sensor[]       = {
-		"EPOW Reset", "Cooling warning", "Power warning",
-		"System shutdown", "System halt", "EPOW main enclosure",
-		"EPOW power off" };
-	const char * battery_cyclestate[]  = { "None", "In progress", "Requested" };
-	const char * battery_charging[]    = { "Charging", "Discharching", "No current flow" };
-	const char * ibm_drconnector[]     = { "Empty", "Present" };
-	const char * ibm_intqueue[]        = { "Disabled", "Enabled" };
-
-	int have_strings = 0;
-	int temperature = 0;
-	int unknown = 0;
-	int n = 0;
-
-	/* What kind of sensor do we have here? */
-	switch (s.token) {
-		case KEY_SWITCH:
-			n += sprintf(buf+n, "Key switch:\t");
-			n += sprintf(buf+n, "%s\t", key_switch[state]);
-			have_strings = 1;
-			break;
-		case ENCLOSURE_SWITCH:
-			n += sprintf(buf+n, "Enclosure switch:\t");
-			n += sprintf(buf+n, "%s\t", enclosure_switch[state]);
-			have_strings = 1;
-			break;
-		case THERMAL_SENSOR:
-			n += sprintf(buf+n, "Temp. (°C/°F):\t");
-			temperature = 1;
-			break;
-		case LID_STATUS:
-			n += sprintf(buf+n, "Lid status:\t");
-			n += sprintf(buf+n, "%s\t", lid_status[state]);
-			have_strings = 1;
-			break;
-		case POWER_SOURCE:
-			n += sprintf(buf+n, "Power source:\t");
-			n += sprintf(buf+n, "%s\t", power_source[state]);
-			have_strings = 1;
-			break;
-		case BATTERY_VOLTAGE:
-			n += sprintf(buf+n, "Battery voltage:\t");
-			break;
-		case BATTERY_REMAINING:
-			n += sprintf(buf+n, "Battery remaining:\t");
-			n += sprintf(buf+n, "%s\t", battery_remaining[state]);
-			have_strings = 1;
-			break;
-		case BATTERY_PERCENTAGE:
-			n += sprintf(buf+n, "Battery percentage:\t");
-			break;
-		case EPOW_SENSOR:
-			n += sprintf(buf+n, "EPOW Sensor:\t");
-			n += sprintf(buf+n, "%s\t", epow_sensor[state]);
-			have_strings = 1;
-			break;
-		case BATTERY_CYCLESTATE:
-			n += sprintf(buf+n, "Battery cyclestate:\t");
-			n += sprintf(buf+n, "%s\t", battery_cyclestate[state]);
-			have_strings = 1;
-			break;
-		case BATTERY_CHARGING:
-			n += sprintf(buf+n, "Battery Charging:\t");
-			n += sprintf(buf+n, "%s\t", battery_charging[state]);
-			have_strings = 1;
-			break;
-		case IBM_SURVEILLANCE:
-			n += sprintf(buf+n, "Surveillance:\t");
-			break;
-		case IBM_FANRPM:
-			n += sprintf(buf+n, "Fan (rpm):\t");
-			break;
-		case IBM_VOLTAGE:
-			n += sprintf(buf+n, "Voltage (mv):\t");
-			break;
-		case IBM_DRCONNECTOR:
-			n += sprintf(buf+n, "DR connector:\t");
-			n += sprintf(buf+n, "%s\t", ibm_drconnector[state]);
-			have_strings = 1;
-			break;
-		case IBM_POWERSUPPLY:
-			n += sprintf(buf+n, "Powersupply:\t");
-			break;
-		case IBM_INTQUEUE:
-			n += sprintf(buf+n, "Interrupt queue:\t");
-			n += sprintf(buf+n, "%s\t", ibm_intqueue[state]);
-			have_strings = 1;
-			break;
-		default:
-			n += sprintf(buf+n,  "Unkown sensor (type %d), ignoring it\n",
-					s.token);
-			unknown = 1;
-			have_strings = 1;
-			break;
-	}
-	if (have_strings == 0) {
-		if (temperature) {
-			n += sprintf(buf+n, "%4d /%4d\t", state, cel_to_fahr(state));
-		} else
-			n += sprintf(buf+n, "%10d\t", state);
-	}
-	if (unknown == 0) {
-		n += sprintf ( buf+n, "%s\t", ppc_rtas_process_error(error));
-		n += get_location_code(s, buf+n);
-	}
-	return n;
-}
-
-/* ****************************************************************** */
-
-int check_location (char *c, int idx, char * buf)
-{
-	int n = 0;
-
-	switch (*(c+idx)) {
-		case LOC_PLANAR:
-			n += sprintf ( buf, "Planar #%c", *(c+idx+1));
-			break;
-		case LOC_CPU:
-			n += sprintf ( buf, "CPU #%c", *(c+idx+1));
-			break;
-		case LOC_FAN:
-			n += sprintf ( buf, "Fan #%c", *(c+idx+1));
-			break;
-		case LOC_RACKMOUNTED:
-			n += sprintf ( buf, "Rack #%c", *(c+idx+1));
-			break;
-		case LOC_VOLTAGE:
-			n += sprintf ( buf, "Voltage #%c", *(c+idx+1));
-			break;
-		case LOC_LCD:
-			n += sprintf ( buf, "LCD #%c", *(c+idx+1));
-			break;
-		case '.':
-			n += sprintf ( buf, "- %c", *(c+idx+1));
-		default:
-			n += sprintf ( buf, "Unknown location");
-			break;
-	}
-	return n;
-}
-
-
-/* ****************************************************************** */
-/*
- * Format:
- * ${LETTER}${NUMBER}[[-/]${LETTER}${NUMBER} [ ... ] ]
- * the '.' may be an abbrevation
- */
-int check_location_string (char *c, char *buf)
-{
-	int n=0,i=0;
-
-	while (c[i]) {
-		if (isalpha(c[i]) || c[i] == '.') {
-			 n += check_location(c, i, buf+n);
-		}
-		else if (c[i] == '/' || c[i] == '-')
-			n += sprintf(buf+n, " at ");
-		i++;
-	}
-	return n;
-}
-
-
-/* ****************************************************************** */
-
-int get_location_code(struct individual_sensor s, char * buffer)
-{
-	char rstr[512], tmp[10], tmp2[10];
-	int n=0, i=0, llen, len;
-	/* char *buf = kmalloc(MAX_LINELENGTH, GFP_KERNEL); */
-	char *ret;
-
-	static int pos = 0; /* remember position where buffer was */
-
-	/* construct the sensor number like 0003 */
-	/* fill with zeros */
-	n = sprintf(tmp, "%d", s.token);
-	len = strlen(tmp);
-	while (strlen(tmp) < 4)
-		n += sprintf (tmp+n, "0");
-
-	/* invert the string */
-	while (tmp[i]) {
-		if (i<len)
-			tmp2[4-len+i] = tmp[i];
-		else
-			tmp2[3-i] = tmp[i];
-		i++;
-	}
-	tmp2[4] = '\0';
-
-	sprintf (rstr, SENSOR_PREFIX"%s", tmp2);
-
-	ret = (char *) get_property(rtas, rstr, &llen);
-
-	n=0;
-	if (ret[0] == '\0')
-		n += sprintf ( buffer+n, "--- ");/* does not have a location */
-	else {
-		char t[50];
-		ret += pos;
-
-		n += check_location_string(ret, buffer + n);
-		n += sprintf ( buffer+n, " ");
-		/* see how many characters we have printed */
-		sprintf ( t, "%s ", ret);
-
-		pos += strlen(t);
-		if (pos >= llen) pos=0;
-	}
-	return n;
-}
-/* ****************************************************************** */
-/* INDICATORS - Tone Frequency                                        */
-/* ****************************************************************** */
-static ssize_t ppc_rtas_tone_freq_write(struct file * file, const char * buf,
-		size_t count, loff_t *ppos)
-{
-	unsigned long freq;
-	char *dest;
-	int error;
-	freq = simple_strtoul(buf, &dest, 10);
-	if (*dest != '\0' && *dest != '\n') {
-		printk("ppc_rtas_tone_freq_write: Invalid tone freqency\n");
-		return count;
-	}
-	if (freq < 0) freq = 0;
-	rtas_tone_frequency = freq; /* save it for later */
-	error = call_rtas("set-indicator", 3, 1, NULL,
-			TONE_FREQUENCY, 0, freq);
-	if (error != 0)
-		printk(KERN_WARNING "error: setting tone frequency returned: %s\n",
-				ppc_rtas_process_error(error));
-	return count;
-}
-/* ****************************************************************** */
-static ssize_t ppc_rtas_tone_freq_read(struct file * file, char * buf,
-		size_t count, loff_t *ppos)
-{
-	int n;
-	n = sprintf(buf, "%lu\n", rtas_tone_frequency);
-
-	if (*ppos >= strlen(buf))
-		return 0;
-	if (n > strlen(buf) - *ppos)
-		n = strlen(buf) - *ppos;
-	if (n > count)
-		n = count;
-	*ppos += n;
-	return n;
-}
-/* ****************************************************************** */
-/* INDICATORS - Tone Volume                                           */
-/* ****************************************************************** */
-static ssize_t ppc_rtas_tone_volume_write(struct file * file, const char * buf,
-		size_t count, loff_t *ppos)
-{
-	unsigned long volume;
-	char *dest;
-	int error;
-	volume = simple_strtoul(buf, &dest, 10);
-	if (*dest != '\0' && *dest != '\n') {
-		printk("ppc_rtas_tone_volume_write: Invalid tone volume\n");
-		return count;
-	}
-	if (volume < 0) volume = 0;
-	if (volume > 100) volume = 100;
-
-        rtas_tone_volume = volume; /* save it for later */
-	error = call_rtas("set-indicator", 3, 1, NULL,
-			TONE_VOLUME, 0, volume);
-	if (error != 0)
-		printk(KERN_WARNING "error: setting tone volume returned: %s\n",
-				ppc_rtas_process_error(error));
-	return count;
-}
-/* ****************************************************************** */
-static ssize_t ppc_rtas_tone_volume_read(struct file * file, char * buf,
-		size_t count, loff_t *ppos)
-{
-	int n;
-	n = sprintf(buf, "%lu\n", rtas_tone_volume);
-
-	if (*ppos >= strlen(buf))
-		return 0;
-	if (n > strlen(buf) - *ppos)
-		n = strlen(buf) - *ppos;
-	if (n > count)
-		n = count;
-	*ppos += n;
-	return n;
-}
diff -urN linux-2.4.27-rc4/arch/ppc64/kernel/lparcfg.c linux-2.4.27-rc5/arch/ppc64/kernel/lparcfg.c
--- linux-2.4.27-rc4/arch/ppc64/kernel/lparcfg.c	2004-04-14 06:05:27.000000000 -0700
+++ linux-2.4.27-rc5/arch/ppc64/kernel/lparcfg.c	2004-08-03 16:53:25.974903225 -0700
@@ -415,7 +415,7 @@
 	pnt = (char *)(data) + p;
 	copy_to_user(buf, (void *)pnt, count);
 	read += count;
-	*ppos += read;
+	*ppos = p + read;
 	return read;
 }
 
diff -urN linux-2.4.27-rc4/arch/ppc64/kernel/nvram.c linux-2.4.27-rc5/arch/ppc64/kernel/nvram.c
--- linux-2.4.27-rc4/arch/ppc64/kernel/nvram.c	2004-02-18 05:36:30.000000000 -0800
+++ linux-2.4.27-rc5/arch/ppc64/kernel/nvram.c	2004-08-03 16:53:25.975903266 -0700
@@ -78,11 +78,12 @@
 			  size_t count, loff_t *ppos)
 {
 	unsigned long len;
-	char *tmp_buffer;
+	char *tmp_buffer; 
+	loff_t pos = *ppos;
 
 	if (verify_area(VERIFY_WRITE, buf, count))
 		return -EFAULT;
-	if (*ppos >= rtas_nvram_size)
+	if ((unsigned)pos != pos || pos >= rtas_nvram_size)
 		return 0;
 	if (count > rtas_nvram_size)
 		count = rtas_nvram_size;
@@ -93,7 +94,7 @@
 		return 0;
 	}
 
-	len = read_nvram(tmp_buffer, count, ppos);
+	len = read_nvram(tmp_buffer, count, &pos);
 	if ((long)len <= 0) {
 		kfree(tmp_buffer);
 		return len;
@@ -105,6 +106,7 @@
 	}
 
 	kfree(tmp_buffer);
+	*ppos = pos;
 	return len;
 
 }
@@ -114,10 +116,11 @@
 {
 	unsigned long len;
 	char * tmp_buffer;
+	loff_t pos = *ppos;
 
 	if (verify_area(VERIFY_READ, buf, count))
 		return -EFAULT;
-	if (*ppos >= rtas_nvram_size)
+	if (pos != (unsigned) pos || pos >= rtas_nvram_size)
 		return 0;
 	if (count > rtas_nvram_size)
 		count = rtas_nvram_size;
@@ -133,7 +136,8 @@
 		return -EFAULT;
 	}
 
-	len = write_nvram(tmp_buffer, count, ppos);
+	len = write_nvram(tmp_buffer, count, &pos);
+	*ppos = pos;
 
 	kfree(tmp_buffer);
 	return len;
diff -urN linux-2.4.27-rc4/arch/ppc64/kernel/proc_pmc.c linux-2.4.27-rc5/arch/ppc64/kernel/proc_pmc.c
--- linux-2.4.27-rc4/arch/ppc64/kernel/proc_pmc.c	2004-02-18 05:36:30.000000000 -0800
+++ linux-2.4.27-rc5/arch/ppc64/kernel/proc_pmc.c	2004-08-03 16:53:25.976903307 -0700
@@ -445,8 +445,9 @@
 	}
 	pnt = (char *)(perfmon_base.profile_buffer) + p - sizeof(unsigned int);
 	copy_to_user(buf,(void *)pnt,count);
+	p += count;
 	read += count;
-	*ppos += read;
+	*ppos = p;
 	return read;
 }
 
@@ -460,19 +461,17 @@
 			    size_t count, loff_t *ppos)
 {
 	unsigned long p = *ppos;
-	ssize_t read;
 	char * pnt;
 
 	if (p >= (perfmon_base.trace_length)) return 0;
 	if (count > (perfmon_base.trace_length) - p)
 		count = (perfmon_base.trace_length) - p;
-	read = 0;
 
 	pnt = (char *)(perfmon_base.trace_buffer) + p;
 	copy_to_user(buf,(void *)pnt,count);
-	read += count;
-	*ppos += read;
-	return read;
+	p += count;
+	*ppos = p;
+	return count;
 }
 
 static ssize_t write_trace(struct file * file, const char * buf,
@@ -491,13 +490,11 @@
 	if (p >= (perfmon_base.timeslice_length)) return 0;
 	if (count > (perfmon_base.timeslice_length) - p)
 		count = (perfmon_base.timeslice_length) - p;
-	read = 0;
 
 	pnt = (char *)(perfmon_base.timeslice_buffer) + p;
 	copy_to_user(buf,(void *)pnt,count);
-	read += count;
-	*ppos += read;
-	return read;
+	*ppos = p + count;
+	return count;
 }
 
 static ssize_t write_timeslice(struct file * file, const char * buf,
diff -urN linux-2.4.27-rc4/arch/ppc64/kernel/rtas-proc.c linux-2.4.27-rc5/arch/ppc64/kernel/rtas-proc.c
--- linux-2.4.27-rc4/arch/ppc64/kernel/rtas-proc.c	2004-02-18 05:36:30.000000000 -0800
+++ linux-2.4.27-rc5/arch/ppc64/kernel/rtas-proc.c	2004-08-03 16:53:25.977903349 -0700
@@ -337,6 +337,7 @@
 {
 	char stkbuf[40];  /* its small, its on stack */
 	int n;
+	loff_t pos = *ppos;
 
 	if (power_on_time == 0)
 		n = snprintf(stkbuf, 40, "Power on time not set\n");
@@ -344,15 +345,15 @@
 		n = snprintf(stkbuf, 40, "%lu\n", power_on_time);
 
 	int sn = strlen(stkbuf) +1;
-	if (*ppos >= sn)
+	if (pos != (unsigned)pos || pos >= sn)
 		return 0;
-	if (n > sn - *ppos)
-		n = sn - *ppos;
+	if (n > sn - pos)
+		n = sn - pos;
 	if (n > count)
 		n = count;
-	if (copy_to_user(buf, stkbuf + (*ppos), n))
+	if (copy_to_user(buf, stkbuf + pos, n))
 		return -EFAULT;
-	*ppos += n;
+	*ppos = pos + n;
 	return n;
 }
 
@@ -384,6 +385,7 @@
 		size_t count, loff_t *ppos)
 {
 	int n = 0, sn;
+	loff_t pos = *ppos;
 	
 	if (progress_led == NULL)
 		return 0;
@@ -396,20 +398,20 @@
 	n = sprintf (tmpbuf, "%s\n", progress_led);
 
 	sn = strlen (tmpbuf) +1;
-	if (*ppos >= sn) {
+	if (pos != (unsigned)pos || pos >= sn) {
 		kfree(tmpbuf);
 		return 0;
 	}
-	if (n > sn - *ppos)
-		n = sn - *ppos;
+	if (n > sn - pos)
+		n = sn - pos;
 	if (n > count)
 		n = count;
-	if (copy_to_user(buf, tmpbuf + (*ppos), n)) {
+	if (copy_to_user(buf, tmpbuf + pos), n) {
 		kfree(tmpbuf);
 		return -EFAULT;
 	}
 	kfree(tmpbuf);
-	*ppos += n;
+	*ppos = pos + n;
 	return n;
 }
 
@@ -453,6 +455,7 @@
 	unsigned int year, mon, day, hour, min, sec;
 	unsigned long *ret = kmalloc(4*8, GFP_KERNEL);
 	int n, error;
+	loff_t pos = *ppos;
 
 	error = rtas_call(rtas_token("get-time-of-day"), 0, 8, ret);
 	
@@ -471,16 +474,16 @@
 	kfree(ret);
 
 	int sn = strlen(stkbuf) +1;
-	if (*ppos >= sn)
+	if (pos != (unsigned)pos || pos >= sn)
 		return 0;
-	if (n > sn - *ppos)
-		n = sn - *ppos;
+	if (n > sn - pos)
+		n = sn - pos;
 	if (n > count)
 		n = count;
-	if (copy_to_user(buf, stkbuf + (*ppos), n))
+	if (copy_to_user(buf, stkbuf + pos, n))
 		return -EFAULT;
 
-	*ppos += n;
+	*ppos = pos + n;
 	return n;
 }
 
@@ -878,20 +881,21 @@
 {
 	int n, sn;
 	char stkbuf[40];  /* its small, its on stack */
+	loff_t pos = *ppos;
 
 	n = snprintf(stkbuf, 40, "%lu\n", rtas_tone_frequency);
 
 	sn = strlen(stkbuf) +1;
-	if (*ppos >= sn)
+	if (pos != (unsigned)pos || pos >= sn)
 		return 0;
-	if (n > sn - *ppos)
-		n = sn - *ppos;
+	if (n > sn - pos)
+		n = sn - pos;
 	if (n > count)
 		n = count;
-	if (copy_to_user(buf, stkbuf + (*ppos), n))
+	if (copy_to_user(buf, stkbuf + pos, n))
 		return -EFAULT;
 
-	*ppos += n;
+	*ppos = pos + n;
 	return n;
 }
 /* ****************************************************************** */
@@ -933,19 +937,20 @@
 {
 	int n, sn;
 	char stkbuf[40];  /* its small, its on stack */
+	loff_t pos = *ppos;
 
 	n = snprintf(stkbuf, 40, "%lu\n", rtas_tone_volume);
 	sn = strlen(stkbuf) +1;
-	if (*ppos >= sn)
+	if (pos != (unsigned)pos || pos >= sn)
 		return 0;
-	if (n > sn - *ppos)
-		n = sn - *ppos;
+	if (n > sn - pos)
+		n = sn - pos;
 	if (n > count)
 		n = count;
-	if (copy_to_user(buf, stkbuf + (*ppos), n))
+	if (copy_to_user(buf, stkbuf + pos, n))
 		return -EFAULT;
 
-	*ppos += n;
+	*ppos = pos + n;
 	return n;
 }
 
@@ -1064,6 +1069,7 @@
 	char * buffer;
 	int i, sn;
 	int n = 0;
+	loff_t pos = *ppos;
 
 	int m = MAX_ERRINJCT_TOKENS * (ERRINJCT_TOKEN_LEN+1);
 	buffer = (char *)kmalloc(m, GFP_KERNEL);
@@ -1078,22 +1084,22 @@
 	}
 
 	sn = strlen(buffer) +1;
-	if (*ppos >= sn) {
+	if (pos != (unsigned)pos || pos >= sn) {
 		kfree(buffer);
 		return 0;
 	}
-	if (n > sn - *ppos)
-		n = sn - *ppos;
+	if (n > sn - pos)
+		n = sn - pos;
 
 	if (n > count)
 		n = count;
 
-	if (copy_to_user(buf, buffer + *ppos, n)) {
+	if (copy_to_user(buf, buffer + pos, n)) {
 		kfree(buffer);
 		return -EFAULT;
 	}
 
-	*ppos += n;
+	*ppos = pos + n;
 
 	kfree(buffer);
 	return n;
diff -urN linux-2.4.27-rc4/arch/s390/kernel/debug.c linux-2.4.27-rc5/arch/s390/kernel/debug.c
--- linux-2.4.27-rc4/arch/s390/kernel/debug.c	2003-08-25 04:44:40.000000000 -0700
+++ linux-2.4.27-rc5/arch/s390/kernel/debug.c	2004-08-03 16:53:25.978903390 -0700
@@ -470,8 +470,8 @@
 				goto out;
 	}
 out:
-	p_info->offset           = *offset + count;
-	p_info->act_entry_offset = size;	
+	p_info->offset           += count;
+	p_info->act_entry_offset = size;
 	*offset = p_info->offset;
 	return count;
 }
@@ -1068,7 +1068,7 @@
 		       input_buf[0]);
 	}
       out:
-	*offset += in_buf_size;
+	*offset = in_buf_size;
 	return rc;		/* number of input characters */
 }
 
@@ -1135,7 +1135,7 @@
         printk(KERN_INFO "debug: area `%c` is not valid\n", input_buf[0]);
 
       out:
-        *offset += in_buf_size;
+        *offset = in_buf_size;
         return rc;              /* number of input characters */
 }
 
diff -urN linux-2.4.27-rc4/arch/s390x/kernel/debug.c linux-2.4.27-rc5/arch/s390x/kernel/debug.c
--- linux-2.4.27-rc4/arch/s390x/kernel/debug.c	2003-08-25 04:44:40.000000000 -0700
+++ linux-2.4.27-rc5/arch/s390x/kernel/debug.c	2004-08-03 16:53:25.979903431 -0700
@@ -470,7 +470,7 @@
 				goto out;
 	}
 out:
-	p_info->offset           = *offset + count;
+	p_info->offset           += count;
 	p_info->act_entry_offset = size;	
 	*offset = p_info->offset;
 	return count;
@@ -1068,7 +1068,7 @@
 		       input_buf[0]);
 	}
       out:
-	*offset += in_buf_size;
+	*offset = in_buf_size;
 	return rc;		/* number of input characters */
 }
 
@@ -1135,7 +1135,7 @@
         printk(KERN_INFO "debug: area `%c` is not valid\n", input_buf[0]);
 
       out:
-        *offset += in_buf_size;
+        *offset = in_buf_size;
         return rc;              /* number of input characters */
 }
 
diff -urN linux-2.4.27-rc4/arch/x86_64/kernel/mtrr.c linux-2.4.27-rc5/arch/x86_64/kernel/mtrr.c
--- linux-2.4.27-rc4/arch/x86_64/kernel/mtrr.c	2004-04-14 06:05:28.000000000 -0700
+++ linux-2.4.27-rc5/arch/x86_64/kernel/mtrr.c	2004-08-03 16:53:26.159910820 -0700
@@ -961,16 +961,19 @@
 static ssize_t mtrr_read (struct file *file, char *buf, size_t len,
 		loff_t * ppos)
 {
-	if (*ppos >= ascii_buf_bytes)
+	loff_t n = *ppos;
+	unsigned pos = n;
+
+	if (pos != n || pos >= ascii_buf_bytes)
 		return 0;
 
-	if (*ppos + len > ascii_buf_bytes)
-		len = ascii_buf_bytes - *ppos;
+	if (len > ascii_buf_bytes - pos)
+		len = ascii_buf_bytes - pos;
 
-	if (copy_to_user (buf, ascii_buffer + *ppos, len))
+	if (copy_to_user (buf, ascii_buffer + pos, len))
 		return -EFAULT;
 
-	*ppos += len;
+	*ppos = pos + len;
 	return len;
 }
 
diff -urN linux-2.4.27-rc4/drivers/block/acsi_slm.c linux-2.4.27-rc5/drivers/block/acsi_slm.c
--- linux-2.4.27-rc4/drivers/block/acsi_slm.c	2002-11-28 15:53:12.000000000 -0800
+++ linux-2.4.27-rc5/drivers/block/acsi_slm.c	2004-08-03 16:53:26.322917512 -0700
@@ -367,6 +367,7 @@
 
 {
 	struct inode *node = file->f_dentry->d_inode;
+	loff_t pos = *ppos;
 	unsigned long page;
 	int length;
 	int end;
@@ -381,18 +382,18 @@
 		count = length;
 		goto out;
 	}
-	if (file->f_pos >= length) {
+	if (pos != (unsigned) pos || pos >= length) {
 		count = 0;
 		goto out;
 	}
-	if (count + file->f_pos > length)
-		count = length - file->f_pos;
-	end = count + file->f_pos;
-	if (copy_to_user(buf, (char *)page + file->f_pos, count)) {
+	if (count > length - pos)
+		count = length - pos;
+	end = count + pos;
+	if (copy_to_user(buf, (char *)page + pos, count)) {
 		count = -EFAULT;
 		goto out;
 	}
-	file->f_pos = end;
+	*ppos = end;
 out:	free_page( page );
 	return( count );
 }
diff -urN linux-2.4.27-rc4/drivers/block/rd.c linux-2.4.27-rc5/drivers/block/rd.c
--- linux-2.4.27-rc4/drivers/block/rd.c	2002-11-28 15:53:12.000000000 -0800
+++ linux-2.4.27-rc5/drivers/block/rd.c	2004-08-03 16:53:26.327917717 -0700
@@ -320,14 +320,19 @@
 static ssize_t initrd_read(struct file *file, char *buf,
 			   size_t count, loff_t *ppos)
 {
-	int left;
+	loff_t n = *ppos;
+	unsigned pos = n;
+	unsigned left = initrd_end - initrd_start;
 
-	left = initrd_end - initrd_start - *ppos;
+	if (pos != n || pos >= left)
+		return 0;
+
+	left -= pos;
 	if (count > left) count = left;
 	if (count == 0) return 0;
-	if (copy_to_user(buf, (char *)initrd_start + *ppos, count))
+	if (copy_to_user(buf, (char *)initrd_start + pos, count))
 		return -EFAULT;
-	*ppos += count;
+	*ppos = pos + count;
 	return count;
 }
 
diff -urN linux-2.4.27-rc4/drivers/bluetooth/bluecard_cs.c linux-2.4.27-rc5/drivers/bluetooth/bluecard_cs.c
--- linux-2.4.27-rc4/drivers/bluetooth/bluecard_cs.c	2002-11-28 15:53:12.000000000 -0800
+++ linux-2.4.27-rc5/drivers/bluetooth/bluecard_cs.c	2004-08-03 16:53:26.332917922 -0700
@@ -803,6 +803,9 @@
 	unsigned int iobase = info->link.io.BasePort1;
 	struct hci_dev *hdev = &(info->hdev);
 
+	if (info->link.state & DEV_CONFIG_PENDING)
+		return -ENODEV;
+
 	bluecard_hci_close(hdev);
 
 	clear_bit(CARD_READY, &(info->hw_state));
diff -urN linux-2.4.27-rc4/drivers/bluetooth/bt3c_cs.c linux-2.4.27-rc5/drivers/bluetooth/bt3c_cs.c
--- linux-2.4.27-rc4/drivers/bluetooth/bt3c_cs.c	2004-08-03 16:53:22.527761715 -0700
+++ linux-2.4.27-rc5/drivers/bluetooth/bt3c_cs.c	2004-08-03 16:53:26.333917963 -0700
@@ -643,6 +643,9 @@
 {
 	struct hci_dev *hdev = &(info->hdev);
 
+	if (info->link.state & DEV_CONFIG_PENDING)
+		return -ENODEV;
+
 	bt3c_hci_close(hdev);
 
 	if (hci_unregister_dev(hdev) < 0)
diff -urN linux-2.4.27-rc4/drivers/bluetooth/btuart_cs.c linux-2.4.27-rc5/drivers/bluetooth/btuart_cs.c
--- linux-2.4.27-rc4/drivers/bluetooth/btuart_cs.c	2003-06-13 07:51:32.000000000 -0700
+++ linux-2.4.27-rc5/drivers/bluetooth/btuart_cs.c	2004-08-03 16:53:26.334918005 -0700
@@ -556,6 +556,9 @@
 	unsigned int iobase = info->link.io.BasePort1;
 	struct hci_dev *hdev = &(info->hdev);
 
+	if (info->link.state & DEV_CONFIG_PENDING)
+		return -ENODEV;
+
 	btuart_hci_close(hdev);
 
 	spin_lock_irqsave(&(info->lock), flags);
diff -urN linux-2.4.27-rc4/drivers/bluetooth/dtl1_cs.c linux-2.4.27-rc5/drivers/bluetooth/dtl1_cs.c
--- linux-2.4.27-rc4/drivers/bluetooth/dtl1_cs.c	2002-11-28 15:53:12.000000000 -0800
+++ linux-2.4.27-rc5/drivers/bluetooth/dtl1_cs.c	2004-08-03 16:53:26.335918046 -0700
@@ -535,6 +535,9 @@
 	unsigned int iobase = info->link.io.BasePort1;
 	struct hci_dev *hdev = &(info->hdev);
 
+	if (info->link.state & DEV_CONFIG_PENDING)
+		return -ENODEV;
+
 	dtl1_hci_close(hdev);
 
 	spin_lock_irqsave(&(info->lock), flags);
diff -urN linux-2.4.27-rc4/drivers/bluetooth/hci_bcsp.c linux-2.4.27-rc5/drivers/bluetooth/hci_bcsp.c
--- linux-2.4.27-rc4/drivers/bluetooth/hci_bcsp.c	2004-08-03 16:53:22.528761756 -0700
+++ linux-2.4.27-rc5/drivers/bluetooth/hci_bcsp.c	2004-08-03 16:53:26.335918046 -0700
@@ -634,7 +634,8 @@
 	struct sk_buff *skb;
 	unsigned long flags;
 
-	BT_ERR("Timeout, retransmitting %u pkts", bcsp->unack.qlen);
+	BT_DBG("hu %p retransmitting %u pkts", hu, bcsp->unack.qlen);
+
 	spin_lock_irqsave(&bcsp->unack.lock, flags);
 
 	while ((skb = __skb_dequeue_tail(&bcsp->unack)) != NULL) {
diff -urN linux-2.4.27-rc4/drivers/bluetooth/hci_usb.c linux-2.4.27-rc5/drivers/bluetooth/hci_usb.c
--- linux-2.4.27-rc4/drivers/bluetooth/hci_usb.c	2004-08-03 16:53:22.530761838 -0700
+++ linux-2.4.27-rc5/drivers/bluetooth/hci_usb.c	2004-08-03 16:53:26.337918128 -0700
@@ -30,7 +30,7 @@
  *
  * $Id: hci_usb.c,v 1.8 2002/07/18 17:23:09 maxk Exp $    
  */
-#define VERSION "2.6"
+#define VERSION "2.7"
 
 #include <linux/config.h>
 #include <linux/module.h>
@@ -98,6 +98,9 @@
 	/* Broadcom BCM2035 */
 	{ USB_DEVICE(0x0a5c, 0x200a), driver_info: HCI_RESET },
 
+	/* ISSC Bluetooth Adapter v3.1 */
+	{ USB_DEVICE(0x1131, 0x1001), driver_info: HCI_RESET },
+
 	/* Digianswer device */
 	{ USB_DEVICE(0x08fd, 0x0001), driver_info: HCI_DIGIANSWER },
 
diff -urN linux-2.4.27-rc4/drivers/cdrom/cdrom.c linux-2.4.27-rc5/drivers/cdrom/cdrom.c
--- linux-2.4.27-rc4/drivers/cdrom/cdrom.c	2004-08-03 16:53:22.533761961 -0700
+++ linux-2.4.27-rc5/drivers/cdrom/cdrom.c	2003-11-28 10:26:20.000000000 -0800
@@ -1,8 +1,7 @@
 /* linux/drivers/cdrom/cdrom.c. 
    Copyright (c) 1996, 1997 David A. van Leeuwen.
    Copyright (c) 1997, 1998 Erik Andersen <andersee@debian.org>
-   Copyright (c) 1998-2004 Jens Axboe <axboe@image.dk>
-   Copyright (c) 2004, Iomega Corp.
+   Copyright (c) 1998, 1999 Jens Axboe <axboe@image.dk>
 
    May be copied or modified under the terms of the GNU General Public
    License.  See linux/COPYING for more information.
@@ -448,100 +447,6 @@
 	return cdi;
 }
 
-int cdrom_get_random_writable(struct cdrom_device_info *cdi,
-			      struct rwrt_feature_desc *rfd)
-{
-	struct cdrom_generic_command cgc;
-	char buffer[24];
-	int ret;
-
-	init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_READ);
-
-	cgc.cmd[0] = GPCMD_GET_CONFIGURATION;	/* often 0x46 */
-	cgc.cmd[3] = CDF_RWRT;			/* often 0x0020 */
-	cgc.cmd[8] = sizeof(buffer);		/* often 0x18 */
-	cgc.quiet = 1;
-
-	if ((ret = cdi->ops->generic_packet(cdi, &cgc)))
-		return ret;
-
-	memcpy(rfd, &buffer[sizeof(struct feature_header)], sizeof (*rfd));
-	return 0;
-}
-
-int cdrom_has_defect_mgt(struct cdrom_device_info *cdi)
-{
-	struct cdrom_generic_command cgc;
-	char buffer[16];
-	__u16 *feature_code;
-	int ret;
-
-	init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_READ);
-
-	cgc.cmd[0] = GPCMD_GET_CONFIGURATION;
-	cgc.cmd[3] = CDF_HWDM;
-	cgc.cmd[8] = sizeof(buffer);
-	cgc.quiet = 1;
-
-	if ((ret = cdi->ops->generic_packet(cdi, &cgc)))
-		return ret;
-
-	feature_code = (__u16 *) &buffer[sizeof(struct feature_header)];
-	if (be16_to_cpu(*feature_code) == CDF_HWDM)
-		return 0;
-
-	return 1;
-}
-
-
-int cdrom_is_random_writable(struct cdrom_device_info *cdi, int *write)
-{
-	struct rwrt_feature_desc rfd;
-	int ret;
-
-	*write = 0;
-
-	if ((ret = cdrom_get_random_writable(cdi, &rfd)))
-		return ret;
-
-	if (CDF_RWRT == be16_to_cpu(rfd.feature_code))
-		*write = 1;
-
-	return 0;
-}
-
-static int cdrom_ram_open_write(struct cdrom_device_info *cdi)
-{
-	struct rwrt_feature_desc rfd;
-	int ret;
-
-	if ((ret = cdrom_has_defect_mgt(cdi)))
-		return ret;
-	else
-		if ((ret = cdrom_get_random_writable(cdi, &rfd)))
-			return ret;
-		else if (CDF_RWRT == be16_to_cpu(rfd.feature_code))
-			ret = !rfd.curr;
-
-	cdinfo(CD_OPEN, "can open for random write\n");
-	return ret;
-}
-
-/*
- * returns 0 for ok to open write, non-0 to disallow
- */
-static int cdrom_open_write(struct cdrom_device_info *cdi)
-{
-	int ret;
-	if (CDROM_CAN(CDC_RAM) &&
-	    !CDROM_CAN(CDC_CD_R|CDC_CD_RW|CDC_DVD|CDC_DVD_R)) 
-		ret = cdrom_ram_open_write(cdi);
-	else
-		ret = 1;
-
-	return ret;
-}
-
 /* We use the open-option O_NONBLOCK to indicate that the
  * purpose of opening is only for subsequent ioctl() calls; no device
  * integrity checks are performed.
@@ -560,15 +465,8 @@
 	if ((cdi = cdrom_find_device(dev)) == NULL)
 		return -ENODEV;
 
-	cdi->use_count++;
-	ret = -EROFS;
-	if (fp->f_mode & FMODE_WRITE) {
-		/* printk("cdrom: %s opening for WRITE\n", current->comm); */
-		if (!CDROM_CAN(CDC_RAM))
-			goto out;
-		if (cdrom_open_write(cdi))
-			goto out;
-	}
+	if ((fp->f_mode & FMODE_WRITE) && !CDROM_CAN(CDC_DVD_RAM))
+		return -EROFS;
 
 	/* if this was a O_NONBLOCK open and we should honor the flags,
 	 * do a quick open without drive/disc integrity checks. */
@@ -577,13 +475,12 @@
 	else
 		ret = open_for_data(cdi);
 
+	if (!ret) cdi->use_count++;
+
 	cdinfo(CD_OPEN, "Use count for \"/dev/%s\" now %d\n", cdi->name, cdi->use_count);
 	/* Do this on open.  Don't wait for mount, because they might
 	    not be mounting, but opening with O_NONBLOCK */
 	check_disk_change(dev);
-out:
-	if (ret)
-		cdi->use_count--;
 	return ret;
 }
 
@@ -760,14 +657,15 @@
 
 	cdinfo(CD_CLOSE, "entering cdrom_release\n"); 
 
-	if (!--cdi->use_count) {
+	if (cdi->use_count > 0)
+		cdi->use_count--;
+	if (cdi->use_count == 0)
 		cdinfo(CD_CLOSE, "Use count for \"/dev/%s\" now zero\n", cdi->name);
-		if ((cdo->capability & CDC_LOCK) && !keeplocked) {
-			cdinfo(CD_CLOSE, "Unlocking door!\n");
-			cdo->lock_door(cdi, 0);
-		}
+	if (cdi->use_count == 0 &&
+	    cdo->capability & CDC_LOCK && !keeplocked) {
+		cdinfo(CD_CLOSE, "Unlocking door!\n");
+		cdo->lock_door(cdi, 0);
 	}
-
 	opened_for_data = !(cdi->options & CDO_USE_FFLAGS) ||
 		!(fp && fp->f_flags & O_NONBLOCK);
 	cdo->release(cdi);
@@ -2011,24 +1909,10 @@
 		}
 	}
 
-	/*
-	 * queue command and wait for it to complete
-	 */
 	ret = cdi->ops->generic_packet(cdi, cgc);
-
-	/*
-	 * always copy back sense, command need not have failed for it to
-	 * contain useful info
-	 */
-	if (usense)
-		__copy_to_user(usense, cgc->sense, sizeof(*usense));
-
-	/*
-	 * this really needs to be modified to copy back good bytes
-	 */
+	__copy_to_user(usense, cgc->sense, sizeof(*usense));
 	if (!ret && cgc->data_direction == CGC_DATA_READ)
 		__copy_to_user(ubuf, cgc->buffer, cgc->buflen);
-
 	if (cgc->data_direction == CGC_DATA_READ ||
 	    cgc->data_direction == CGC_DATA_WRITE) {
 		kfree(cgc->buffer);
@@ -2508,7 +2392,6 @@
 EXPORT_SYMBOL(cdrom_mode_sense);
 EXPORT_SYMBOL(init_cdrom_command);
 EXPORT_SYMBOL(cdrom_find_device);
-EXPORT_SYMBOL(cdrom_is_random_writable);
 
 #ifdef CONFIG_SYSCTL
 
@@ -2605,10 +2488,6 @@
 	for (cdi=topCdromPtr;cdi!=NULL;cdi=cdi->next)
 	    pos += sprintf(info+pos, "\t%d", CDROM_CAN(CDC_DVD_RAM) != 0);
 
-	pos += sprintf(info+pos, "\nCan write RAM:\t");
-	for (cdi=topCdromPtr;cdi!=NULL;cdi=cdi->next)
-	    pos += sprintf(info+pos, "\t%d", CDROM_CAN(CDC_RAM) != 0);
-
 	strcpy(info+pos,"\n\n");
 		
         return proc_dostring(ctl, write, filp, buffer, lenp);
diff -urN linux-2.4.27-rc4/drivers/char/i8k.c linux-2.4.27-rc5/drivers/char/i8k.c
--- linux-2.4.27-rc4/drivers/char/i8k.c	2002-11-28 15:53:12.000000000 -0800
+++ linux-2.4.27-rc5/drivers/char/i8k.c	2004-08-03 16:53:26.351918702 -0700
@@ -493,6 +493,7 @@
 
 static ssize_t i8k_read(struct file *f, char *buffer, size_t len, loff_t *fpos)
 {
+    loff_t pos = *fpos;
     int n;
     char info[128];
 
@@ -501,19 +502,19 @@
 	return n;
     }
 
-    if (*fpos >= n) {
+    if (pos != (unsigned)pos || pos >= n) {
 	return 0;
     }
 
-    if ((*fpos + len) >= n) {
-	len = n - *fpos;
+    if (len >= n - pos) {
+	len = n - pos;
     }
 
     if (copy_to_user(buffer, info, len) != 0) {
 	return -EFAULT;
     }
 
-    *fpos += len;
+    *fpos = pos + len;
     return len;
 }
 
diff -urN linux-2.4.27-rc4/drivers/char/istallion.c linux-2.4.27-rc5/drivers/char/istallion.c
--- linux-2.4.27-rc4/drivers/char/istallion.c	2002-08-02 17:39:43.000000000 -0700
+++ linux-2.4.27-rc5/drivers/char/istallion.c	2004-08-03 16:53:26.354918826 -0700
@@ -4854,6 +4854,7 @@
 	void		*memptr;
 	stlibrd_t	*brdp;
 	int		brdnr, size, n;
+	loff_t		pos = *offp;
 
 #if DEBUG
 	printk(KERN_DEBUG "stli_memread(fp=%x,buf=%x,count=%x,offp=%x)\n",
@@ -4868,25 +4869,26 @@
 		return(-ENODEV);
 	if (brdp->state == 0)
 		return(-ENODEV);
-	if (fp->f_pos >= brdp->memsize)
+	if (pos != (unsigned)pos || pos >= brdp->memsize)
 		return(0);
 
-	size = MIN(count, (brdp->memsize - fp->f_pos));
+	size = MIN(count, (brdp->memsize - pos));
 
 	save_flags(flags);
 	cli();
 	EBRDENABLE(brdp);
 	while (size > 0) {
-		memptr = (void *) EBRDGETMEMPTR(brdp, fp->f_pos);
-		n = MIN(size, (brdp->pagesize - (((unsigned long) fp->f_pos) % brdp->pagesize)));
+		memptr = (void *) EBRDGETMEMPTR(brdp, pos);
+		n = MIN(size, (brdp->pagesize - (((unsigned long) pos) % brdp->pagesize)));
 		if (copy_to_user(buf, memptr, n)) {
 			count = -EFAULT;
 			goto out;
 		}
-		fp->f_pos += n;
+		pos += n;
 		buf += n;
 		size -= n;
 	}
+	*offp = pos;
 out:
 	EBRDDISABLE(brdp);
 	restore_flags(flags);
@@ -4909,6 +4911,7 @@
 	stlibrd_t	*brdp;
 	char		*chbuf;
 	int		brdnr, size, n;
+	loff_t		pos = *offp;
 
 #if DEBUG
 	printk(KERN_DEBUG "stli_memwrite(fp=%x,buf=%x,count=%x,offp=%x)\n",
@@ -4923,26 +4926,27 @@
 		return(-ENODEV);
 	if (brdp->state == 0)
 		return(-ENODEV);
-	if (fp->f_pos >= brdp->memsize)
+	if (pos != (unsigned)pos || pos >= brdp->memsize)
 		return(0);
 
 	chbuf = (char *) buf;
-	size = MIN(count, (brdp->memsize - fp->f_pos));
+	size = MIN(count, (brdp->memsize - pos));
 
 	save_flags(flags);
 	cli();
 	EBRDENABLE(brdp);
 	while (size > 0) {
-		memptr = (void *) EBRDGETMEMPTR(brdp, fp->f_pos);
-		n = MIN(size, (brdp->pagesize - (((unsigned long) fp->f_pos) % brdp->pagesize)));
+		memptr = (void *) EBRDGETMEMPTR(brdp, pos);
+		n = MIN(size, (brdp->pagesize - (((unsigned long) pos) % brdp->pagesize)));
 		if (copy_from_user(memptr, chbuf, n)) {
 			count = -EFAULT;
 			goto out;
 		}
-		fp->f_pos += n;
+		pos += n;
 		chbuf += n;
 		size -= n;
 	}
+	*offp = pos;
 out:
 	EBRDDISABLE(brdp);
 	restore_flags(flags);
diff -urN linux-2.4.27-rc4/drivers/char/mem.c linux-2.4.27-rc5/drivers/char/mem.c
--- linux-2.4.27-rc4/drivers/char/mem.c	2003-11-28 10:26:20.000000000 -0800
+++ linux-2.4.27-rc5/drivers/char/mem.c	2004-08-03 16:53:26.355918867 -0700
@@ -64,7 +64,7 @@
 	if (copy_from_user(p, buf, count))
 		return -EFAULT;
 	written += count;
-	*ppos += written;
+	*ppos = realp + written;
 	return written;
 }
 
@@ -105,7 +105,7 @@
 	if (copy_to_user(buf, __va(p), count))
 		return -EFAULT;
 	read += count;
-	*ppos += read;
+	*ppos = p + read;
 	return read;
 }
 
diff -urN linux-2.4.27-rc4/drivers/char/nvram.c linux-2.4.27-rc5/drivers/char/nvram.c
--- linux-2.4.27-rc4/drivers/char/nvram.c	2003-06-13 07:51:33.000000000 -0700
+++ linux-2.4.27-rc5/drivers/char/nvram.c	2004-08-03 16:53:26.356918908 -0700
@@ -252,9 +252,13 @@
 nvram_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 {
 	unsigned char contents[NVRAM_BYTES];
-	unsigned i = *ppos;
+	loff_t n = *ppos;
+	unsigned i = n;
 	unsigned char *tmp;
 
+	if (i != n || i >= NVRAM_BYTES)
+		return 0;
+
 	spin_lock_irq(&rtc_lock);
 
 	if (!__nvram_check_checksum())
@@ -281,10 +285,14 @@
 nvram_write(struct file *file, const char *buf, size_t count, loff_t *ppos)
 {
 	unsigned char contents[NVRAM_BYTES];
-	unsigned i = *ppos;
+	loff_t n = *ppos;
+	unsigned i = n;
 	unsigned char *tmp;
 	int len;
 
+	if (i != n || i >= NVRAM_BYTES)
+		return 0;
+
 	len = (NVRAM_BYTES - i) < count ? (NVRAM_BYTES - i) : count;
 	if (copy_from_user(contents, buf, len))
 		return -EFAULT;
diff -urN linux-2.4.27-rc4/drivers/char/nwflash.c linux-2.4.27-rc5/drivers/char/nwflash.c
--- linux-2.4.27-rc4/drivers/char/nwflash.c	2001-10-12 13:48:42.000000000 -0700
+++ linux-2.4.27-rc5/drivers/char/nwflash.c	2004-08-03 16:53:26.356918908 -0700
@@ -133,7 +133,8 @@
 
 static ssize_t flash_read(struct file *file, char *buf, size_t size, loff_t * ppos)
 {
-	unsigned long p = *ppos;
+	loff_t n = *ppos;
+	unsigned long p = n;
 	unsigned int count = size;
 	int ret = 0;
 
@@ -144,7 +145,7 @@
 	if (count)
 		ret = -ENXIO;
 
-	if (p < gbFlashSize) {
+	if (n == p && p < gbFlashSize) {
 		if (count > gbFlashSize - p)
 			count = gbFlashSize - p;
 
@@ -157,7 +158,7 @@
 		ret = copy_to_user(buf, (void *)(FLASH_BASE + p), count);
 		if (ret == 0) {
 			ret = count;
-			*ppos += count;
+			*ppos = p + count;
 		}
 		up(&nwflash_sem);
 	}
@@ -166,7 +167,8 @@
 
 static ssize_t flash_write(struct file *file, const char *buf, size_t size, loff_t * ppos)
 {
-	unsigned long p = *ppos;
+	loff_t n = *ppos;
+	unsigned long p = n;
 	unsigned int count = size;
 	int written;
 	int nBlock, temp, rc;
@@ -185,7 +187,7 @@
 	/*
 	 * check for out of range pos or count
 	 */
-	if (p >= gbFlashSize)
+	if (p != n || p >= gbFlashSize)
 		return count ? -ENXIO : 0;
 
 	if (count > gbFlashSize - p)
@@ -274,7 +276,7 @@
 		p += rc;
 		buf += rc;
 		written += rc;
-		*ppos += rc;
+		*ppos = p;
 
 		if (flashdebug)
 			printk(KERN_DEBUG "flash_write: written 0x%X bytes OK.\n", written);
diff -urN linux-2.4.27-rc4/drivers/char/raw.c linux-2.4.27-rc5/drivers/char/raw.c
--- linux-2.4.27-rc4/drivers/char/raw.c	2003-06-13 07:51:33.000000000 -0700
+++ linux-2.4.27-rc5/drivers/char/raw.c	2004-08-03 16:53:26.358918990 -0700
@@ -301,6 +301,7 @@
 	int		minor;
 	kdev_t		dev;
 	unsigned long	limit;
+	loff_t		off = *offp;
 
 	int		sector_size, sector_bits, sector_mask;
 	int		max_sectors;
@@ -338,12 +339,12 @@
 		 MAJOR(dev), MINOR(dev), limit);
 	
 	err = -EINVAL;
-	if ((*offp & sector_mask) || (size & sector_mask))
+	if ((off & sector_mask) || (size & sector_mask))
 		goto out_free;
 	err = 0;
 	if (size)
 		err = -ENXIO;
-	if ((*offp >> sector_bits) >= limit)
+	if ((off >> sector_bits) >= limit)
 		goto out_free;
 
 	/*
@@ -353,7 +354,7 @@
 	 */
 
 	transferred = 0;
-	blocknr = *offp >> sector_bits;
+	blocknr = off >> sector_bits;
 	while (size > 0) {
 		blocks = size >> sector_bits;
 		if (blocks > max_sectors)
@@ -390,7 +391,7 @@
 	}
 	
 	if (transferred) {
-		*offp += transferred;
+		*offp = off + transferred;
 		err = transferred;
 	}
 
diff -urN linux-2.4.27-rc4/drivers/char/tpqic02.c linux-2.4.27-rc5/drivers/char/tpqic02.c
--- linux-2.4.27-rc4/drivers/char/tpqic02.c	2002-11-28 15:53:12.000000000 -0800
+++ linux-2.4.27-rc5/drivers/char/tpqic02.c	2004-08-03 16:53:26.362919154 -0700
@@ -1818,6 +1818,7 @@
 	kdev_t dev = filp->f_dentry->d_inode->i_rdev;
 	unsigned short flags = filp->f_flags;
 	unsigned long bytes_todo, bytes_done, total_bytes_done = 0;
+	loff_t pos = *ppos;
 	int stat;
 
 	if (status_zombie == YES) {
@@ -1898,6 +1899,7 @@
 
 	/*****************************/
 		if (bytes_todo == 0) {
+			*ppos = pos;
 			return total_bytes_done;
 		}
 
@@ -1966,7 +1968,7 @@
 		if (bytes_done > 0) {
 			status_bytes_rd = YES;
 			buf += bytes_done;
-			*ppos += bytes_done;
+			pos += bytes_done;
 			total_bytes_done += bytes_done;
 			count -= bytes_done;
 		}
diff -urN linux-2.4.27-rc4/drivers/char/vc_screen.c linux-2.4.27-rc5/drivers/char/vc_screen.c
--- linux-2.4.27-rc4/drivers/char/vc_screen.c	2001-09-16 21:22:40.000000000 -0700
+++ linux-2.4.27-rc5/drivers/char/vc_screen.c	2004-08-03 16:53:26.363919195 -0700
@@ -64,12 +64,25 @@
 	return size;
 }
 
+/* We share this temporary buffer with the console write code
+ * so that we can easily avoid touching user space while holding the
+ * console spinlock.
+ */
+extern char con_buf[PAGE_SIZE];
+#define CON_BUF_SIZE	PAGE_SIZE
+extern struct semaphore con_buf_sem;
+
 static loff_t vcs_lseek(struct file *file, loff_t offset, int orig)
 {
-	int size = vcs_size(file->f_dentry->d_inode);
+	int size;
+
+	down(&con_buf_sem);
+
+	size = vcs_size(file->f_dentry->d_inode);
 
 	switch (orig) {
 		default:
+			up(&con_buf_sem);
 			return -EINVAL;
 		case 2:
 			offset += size;
@@ -79,26 +92,22 @@
 		case 0:
 			break;
 	}
-	if (offset < 0 || offset > size)
+	if (offset < 0 || offset > size) {
+		up(&con_buf_sem);
 		return -EINVAL;
+	}
 	file->f_pos = offset;
+	up (&con_buf_sem);
 	return file->f_pos;
 }
 
-/* We share this temporary buffer with the console write code
- * so that we can easily avoid touching user space while holding the
- * console spinlock.
- */
-extern char con_buf[PAGE_SIZE];
-#define CON_BUF_SIZE	PAGE_SIZE
-extern struct semaphore con_buf_sem;
-
 static ssize_t
 vcs_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 {
 	struct inode *inode = file->f_dentry->d_inode;
 	unsigned int currcons = MINOR(inode->i_rdev);
-	long pos = *ppos;
+	loff_t n;
+	unsigned pos;
 	long viewed, attr, read;
 	int col, maxcol;
 	unsigned short *org = NULL;
@@ -106,6 +115,9 @@
 
 	down(&con_buf_sem);
 
+	n = *ppos; 
+	pos = n;
+
 	/* Select the proper current console and verify
 	 * sanity of the situation under the console lock.
 	 */
@@ -124,11 +136,10 @@
 	if (!vc_cons_allocated(currcons))
 		goto unlock_out;
 
-	ret = -EINVAL;
-	if (pos < 0)
-		goto unlock_out;
 	read = 0;
 	ret = 0;
+	if (pos != n)
+		goto unlock_out;
 	while (count) {
 		char *con_buf0, *con_buf_start;
 		long this_round, size;
@@ -244,16 +255,15 @@
 		acquire_console_sem();
 
 		if (ret) {
-			read += (orig_count - ret);
 			ret = -EFAULT;
-			break;
+			goto unlock_out;
 		}
 		buf += orig_count;
 		pos += orig_count;
 		read += orig_count;
 		count -= orig_count;
 	}
-	*ppos += read;
+	*ppos = pos;
 	if (read)
 		ret = read;
 unlock_out:
@@ -267,7 +277,8 @@
 {
 	struct inode *inode = file->f_dentry->d_inode;
 	unsigned int currcons = MINOR(inode->i_rdev);
-	long pos = *ppos;
+	loff_t n;
+	unsigned pos;
 	long viewed, attr, size, written;
 	char *con_buf0;
 	int col, maxcol;
@@ -276,6 +287,9 @@
 
 	down(&con_buf_sem);
 
+	n = *ppos;
+	pos = n;
+
 	/* Select the proper current console and verify
 	 * sanity of the situation under the console lock.
 	 */
@@ -297,7 +311,7 @@
 
 	size = vcs_size(inode);
 	ret = -EINVAL;
-	if (pos < 0 || pos > size)
+	if (pos != n || pos > size)
 		goto unlock_out;
 	if (count > size - pos)
 		count = size - pos;
@@ -435,7 +449,7 @@
 		if (org0)
 			update_region(currcons, (unsigned long)(org0), org-org0);
 	}
-	*ppos += written;
+	*ppos = pos;
 	ret = written;
 
 unlock_out:
diff -urN linux-2.4.27-rc4/drivers/gsc/eisa_eeprom.c linux-2.4.27-rc5/drivers/gsc/eisa_eeprom.c
--- linux-2.4.27-rc4/drivers/gsc/eisa_eeprom.c	2002-11-28 15:53:12.000000000 -0800
+++ linux-2.4.27-rc5/drivers/gsc/eisa_eeprom.c	2004-08-03 16:53:26.363919195 -0700
@@ -34,24 +34,30 @@
 	unsigned char *tmp;
 	ssize_t ret;
 	int i;
+	loff_t n = *ppos;
+	unsigned pos = n;
 	
-	if (*ppos >= HPEE_MAX_LENGTH)
+	if (n != pos || pos >= HPEE_MAX_LENGTH)
 		return 0;
 	
-	count = *ppos + count < HPEE_MAX_LENGTH ? count : HPEE_MAX_LENGTH - *ppos;
+	if (count > HPEE_MAX_LENGTH - pos)
+		count = HPEE_MAX_LENGTH - pos;
+
 	tmp = kmalloc(count, GFP_KERNEL);
 	if (tmp) {
 		for (i = 0; i < count; i++)
-			tmp[i] = gsc_readb(eeprom_addr+(*ppos)++);
+			tmp[i] = gsc_readb(eeprom_addr+(pos)++);
 
 		if (copy_to_user (buf, tmp, count))
 			ret = -EFAULT;
-		else
+		else {
 			ret = count;
+			*ppos = pos;
+		}
 		kfree (tmp);
 	} else
 		ret = -ENOMEM;
-	
+
 	return ret;
 }
 
diff -urN linux-2.4.27-rc4/drivers/hotplug/pci_hotplug_core.c linux-2.4.27-rc5/drivers/hotplug/pci_hotplug_core.c
--- linux-2.4.27-rc4/drivers/hotplug/pci_hotplug_core.c	2004-08-03 16:53:22.555762864 -0700
+++ linux-2.4.27-rc5/drivers/hotplug/pci_hotplug_core.c	2004-08-03 16:53:26.380919893 -0700
@@ -616,7 +616,7 @@
 		retval = -EFAULT;
 		goto exit;
 	}
-	*offset += len;
+	*offset = len;
 	retval = len;
 
 exit:
@@ -727,7 +727,7 @@
 		retval = -EFAULT;
 		goto exit;
 	}
-	*offset += len;
+	*offset = len;
 	retval = len;
 
 exit:
@@ -792,14 +792,15 @@
 	int retval;
 	int len;
 	u8 value;
+	loff_t off = *offset;
 
-	dbg("count = %d, offset = %lld\n", count, *offset);
+	dbg("count = %d, offset = %lld\n", count, off);
 
-	if (*offset < 0)
+	if (off < 0)
 		return -EINVAL;
 	if (count <= 0)
 		return 0;
-	if (*offset != 0)
+	if (off != 0)
 		return 0;
 
 	if (slot == NULL) {
@@ -820,7 +821,7 @@
 		retval = -EFAULT;
 		goto exit;
 	}
-	*offset += len;
+	*offset = off + len;
 	retval = len;
 
 exit:
@@ -835,14 +836,15 @@
 	int retval;
 	int len;
 	u8 value;
+	loff_t off = *offset;
 
 	dbg("count = %d, offset = %lld\n", count, *offset);
 
-	if (*offset < 0)
+	if (off < 0)
 		return -EINVAL;
 	if (count <= 0)
 		return 0;
-	if (*offset != 0)
+	if (off != 0)
 		return 0;
 
 	if (slot == NULL) {
@@ -863,7 +865,7 @@
 		retval = -EFAULT;
 		goto exit;
 	}
-	*offset += len;
+	*offset = off + len;
 	retval = len;
 
 exit:
@@ -878,14 +880,15 @@
 	int retval;
 	int len;
 	u32 address;
+	loff_t off = *offset;
 
-	dbg("count = %d, offset = %lld\n", count, *offset);
+	dbg("count = %d, offset = %lld\n", count, off);
 
-	if (*offset < 0)
+	if (off < 0)
 		return -EINVAL;
 	if (count <= 0)
 		return 0;
-	if (*offset != 0)
+	if (off != 0)
 		return 0;
 
 	if (slot == NULL) {
@@ -909,7 +912,7 @@
 		retval = -EFAULT;
 		goto exit;
 	}
-	*offset += len;
+	*offset  = off + len;
 	retval = len;
 
 exit:
@@ -927,14 +930,15 @@
 	int retval;
 	int len = 0;
 	enum pci_bus_speed value;
+	loff_t off = *offset;
 	
-	dbg ("count = %d, offset = %lld\n", count, *offset);
+	dbg ("count = %d, offset = %lld\n", count, off);
 
-	if (*offset < 0)
+	if (off < 0)
 		return -EINVAL;
 	if (count <= 0)
 		return 0;
-	if (*offset != 0)
+	if (off != 0)
 		return 0;
 
 	if (slot == NULL) {
@@ -961,7 +965,7 @@
 		retval = -EFAULT;
 		goto exit;
 	}
-	*offset += len;
+	*offset = off + len;
 	retval = len;
 
 exit:
@@ -977,14 +981,15 @@
 	int retval;
 	int len = 0;
 	enum pci_bus_speed value;
+	loff_t off = *offset;
 
-	dbg ("count = %d, offset = %lld\n", count, *offset);
+	dbg ("count = %d, offset = %lld\n", count, off);
 
-	if (*offset < 0)
+	if (off < 0)
 		return -EINVAL;
 	if (count <= 0)
 		return 0;
-	if (*offset != 0)
+	if (off != 0)
 		return 0;
 
 	if (slot == NULL) {
@@ -1011,7 +1016,7 @@
 		retval = -EFAULT;
 		goto exit;
 	}
-	*offset += len;
+	*offset = off + len;
 	retval = len;
 
 exit:
diff -urN linux-2.4.27-rc4/drivers/ide/ide-cd.c linux-2.4.27-rc5/drivers/ide/ide-cd.c
--- linux-2.4.27-rc4/drivers/ide/ide-cd.c	2004-08-03 16:53:22.596764548 -0700
+++ linux-2.4.27-rc5/drivers/ide/ide-cd.c	2003-11-28 10:26:20.000000000 -0800
@@ -3,8 +3,7 @@
  *
  * Copyright (C) 1994, 1995, 1996  scott snyder  <snyder@fnald0.fnal.gov>
  * Copyright (C) 1996-1998  Erik Andersen <andersee@debian.org>
- * Copyright (C) 1998-2004  Jens Axboe <axboe@suse.de>
- * Copyright (C) 2004 Iomega Corp
+ * Copyright (C) 1998-2000  Jens Axboe <axboe@suse.de>
  *
  * May be copied or modified under the terms of the GNU General Public
  * License.  See linux/COPYING for more information.
@@ -2684,7 +2683,7 @@
 				CDC_MEDIA_CHANGED | CDC_PLAY_AUDIO | CDC_RESET |
 				CDC_IOCTLS | CDC_DRIVE_STATUS | CDC_CD_R |
 				CDC_CD_RW | CDC_DVD | CDC_DVD_R| CDC_DVD_RAM |
-				CDC_GENERIC_PACKET | CDC_RAM,
+				CDC_GENERIC_PACKET,
 	generic_packet:		ide_cdrom_packet,
 };
 
@@ -2719,8 +2718,6 @@
 		devinfo->mask |= CDC_PLAY_AUDIO;
 	if (!CDROM_CONFIG_FLAGS(drive)->close_tray)
 		devinfo->mask |= CDC_CLOSE_TRAY;
-	if (!CDROM_CONFIG_FLAGS(drive)->ram)
-		devinfo->mask |= CDC_RAM;
 
 	devinfo->de = devfs_register(drive->de, "cd", DEVFS_FL_DEFAULT,
 				     HWIF(drive)->major, minor,
@@ -2769,7 +2766,7 @@
 	struct cdrom_info *info = drive->driver_data;
 	struct cdrom_device_info *cdi = &info->devinfo;
 	struct atapi_capabilities_page cap;
-	int nslots = 1, ram_write = 0;
+	int nslots = 1;
 
 	if (CDROM_CONFIG_FLAGS(drive)->nec260) {
 		CDROM_CONFIG_FLAGS(drive)->no_eject = 0;                       
@@ -2779,9 +2776,7 @@
 
 	if (ide_cdrom_get_capabilities(drive, &cap))
 		return 0;
-	cdrom_is_random_writable(cdi, &ram_write);
-	if (ram_write) 
-		CDROM_CONFIG_FLAGS(drive)->ram = 1;
+
 	if (cap.lock == 0)
 		CDROM_CONFIG_FLAGS(drive)->no_doorlock = 1;
 	if (cap.eject)
@@ -2794,10 +2789,8 @@
 		CDROM_CONFIG_FLAGS(drive)->test_write = 1;
 	if (cap.dvd_ram_read || cap.dvd_r_read || cap.dvd_rom)
 		CDROM_CONFIG_FLAGS(drive)->dvd = 1;
-	if (cap.dvd_ram_write) {
+	if (cap.dvd_ram_write)
 		CDROM_CONFIG_FLAGS(drive)->dvd_ram = 1;
-		CDROM_CONFIG_FLAGS(drive)->ram = 1;
-	}
 	if (cap.dvd_r_write)
 		CDROM_CONFIG_FLAGS(drive)->dvd_r = 1;
 	if (cap.audio_play)
@@ -3007,8 +3000,7 @@
 
 	nslots = ide_cdrom_probe_capabilities (drive);
 
-	if ((CDROM_CONFIG_FLAGS(drive)->dvd_ram) ||
-	    (CDROM_CONFIG_FLAGS(drive)->ram))
+	if (CDROM_CONFIG_FLAGS(drive)->dvd_ram)
 		set_device_ro(MKDEV(HWIF(drive)->major, minor), 0);
 
 #if 0
diff -urN linux-2.4.27-rc4/drivers/ide/ide-cd.h linux-2.4.27-rc5/drivers/ide/ide-cd.h
--- linux-2.4.27-rc4/drivers/ide/ide-cd.h	2004-08-03 16:53:22.597764589 -0700
+++ linux-2.4.27-rc5/drivers/ide/ide-cd.h	2003-06-13 07:51:33.000000000 -0700
@@ -2,8 +2,7 @@
  *  linux/drivers/ide/ide_cd.h
  *
  *  Copyright (C) 1996-98  Erik Andersen
- *  Copyright (C) 1998-2004 Jens Axboe
- *  Copyright (C) 2004 Iomega Corp
+ *  Copyright (C) 1998-2000 Jens Axboe
  */
 #ifndef _IDE_CD_H
 #define _IDE_CD_H
@@ -76,7 +75,6 @@
 	__u8 dvd		: 1; /* Drive is a DVD-ROM */
 	__u8 dvd_r		: 1; /* Drive can write DVD-R */
 	__u8 dvd_ram		: 1; /* Drive can write DVD-RAM */
-	__u8 ram		: 1; /* generic WRITE (dvd-ram/mrw) */
 	__u8 test_write		: 1; /* Drive can fake writes */
 	__u8 supp_disc_present	: 1; /* Changer can report exact contents
 					of slots. */
diff -urN linux-2.4.27-rc4/drivers/ieee1394/pcilynx.c linux-2.4.27-rc5/drivers/ieee1394/pcilynx.c
--- linux-2.4.27-rc4/drivers/ieee1394/pcilynx.c	2004-08-03 16:53:22.614765287 -0700
+++ linux-2.4.27-rc5/drivers/ieee1394/pcilynx.c	2004-08-03 16:53:26.509925189 -0700
@@ -1065,12 +1065,15 @@
         ssize_t retval;
         void *membase;
 
-        if ((off + count) > PCILYNX_MAX_MEMORY+1) {
-                count = PCILYNX_MAX_MEMORY+1 - off;
-        }
-        if (count == 0 || off > PCILYNX_MAX_MEMORY) {
+	if (!count)
+		return 0;
+	if (off < 0)
+		return -EINVAL;
+	if (off > PCILYNX_MAX_MEMORY)
                 return -ENOSPC;
-        }
+
+	if (count > PCILYNX_MAX_MEMORY + 1 - off)
+		count = PCILYNX_MAX_MEMORY + 1 - off;
 
         switch (md->type) {
         case rom:
@@ -1091,6 +1094,7 @@
 
         if (count < mem_mindma) {
                 memcpy_fromio(md->lynx->mem_dma_buffer, membase+off, count);
+		off += count;
                 goto out;
         }
 
@@ -1121,6 +1125,7 @@
         if (bcount) {
                 memcpy_fromio(md->lynx->mem_dma_buffer + count - bcount,
                               membase+off, bcount);
+		off += bcount;
         }
 
  out:
@@ -1128,7 +1133,7 @@
         up(&md->lynx->mem_dma_mutex);
 
 	if (retval) return -EFAULT;
-        *offset += count;
+        *offset = off;
         return count;
 }
 
@@ -1137,32 +1142,36 @@
                          loff_t *offset)
 {
         struct memdata *md = (struct memdata *)file->private_data;
+	loff_t off = *offset;
 
-        if (((*offset) + count) > PCILYNX_MAX_MEMORY+1) {
-                count = PCILYNX_MAX_MEMORY+1 - *offset;
-        }
-        if (count == 0 || *offset > PCILYNX_MAX_MEMORY) {
-                return -ENOSPC;
-        }
+	if (!count)
+		return 0;
+	if (off < 0)
+		return -EINVAL;
+	if (off > PCILYNX_MAX_MEMORY)
+		return -ENOSPC;
+
+	if (count > PCILYNX_MAX_MEMORY + 1 - off)
+		count = PCILYNX_MAX_MEMORY + 1 - off;
 
         /* FIXME: dereferencing pointers to PCI mem doesn't work everywhere */
         switch (md->type) {
         case aux:
-		if (copy_from_user(md->lynx->aux_port+(*offset), buffer, count))
+		if (copy_from_user(md->lynx->aux_port+off, buffer, count))
 			return -EFAULT;
                 break;
         case ram:
-		if (copy_from_user(md->lynx->local_ram+(*offset), buffer, count))
+		if (copy_from_user(md->lynx->local_ram+off, buffer, count))
 			return -EFAULT;
                 break;
         case rom:
                 /* the ROM may be writeable */
-		if (copy_from_user(md->lynx->local_rom+(*offset), buffer, count))
+		if (copy_from_user(md->lynx->local_rom+off, buffer, count))
 			return -EFAULT;
                 break;
         }
 
-        file->f_pos += count;
+	*offset = off + count;
         return count;
 }
 #endif /* CONFIG_IEEE1394_PCILYNX_PORTS */
diff -urN linux-2.4.27-rc4/drivers/isdn/divert/divert_procfs.c linux-2.4.27-rc5/drivers/isdn/divert/divert_procfs.c
--- linux-2.4.27-rc4/drivers/isdn/divert/divert_procfs.c	2001-12-21 09:41:54.000000000 -0800
+++ linux-2.4.27-rc5/drivers/isdn/divert/divert_procfs.c	2004-08-03 16:53:26.513925353 -0700
@@ -80,6 +80,7 @@
 isdn_divert_read(struct file *file, char *buf, size_t count, loff_t * off)
 {
 	struct divert_info *inf;
+	loff_t pos = *off;
 	int len;
 
 	if (!*((struct divert_info **) file->private_data)) {
@@ -95,7 +96,7 @@
 	if ((len = strlen(inf->info_start)) <= count) {
 		if (copy_to_user(buf, inf->info_start, len))
 			return -EFAULT;
-		file->f_pos += len;
+		*off = pos + len;
 		return (len);
 	}
 	return (0);
diff -urN linux-2.4.27-rc4/drivers/isdn/hysdn/hysdn_procconf.c linux-2.4.27-rc5/drivers/isdn/hysdn/hysdn_procconf.c
--- linux-2.4.27-rc4/drivers/isdn/hysdn/hysdn_procconf.c	2001-12-21 09:41:54.000000000 -0800
+++ linux-2.4.27-rc5/drivers/isdn/hysdn/hysdn_procconf.c	2004-08-03 16:53:26.514925394 -0700
@@ -212,29 +212,27 @@
 static ssize_t
 hysdn_conf_read(struct file *file, char *buf, size_t count, loff_t * off)
 {
+	loff_t pos = *off;
 	char *cp;
 	int i;
 
 	if (off != &file->f_pos)	/* fs error check */
 		return -ESPIPE;
 
-	if (file->f_mode & FMODE_READ) {
-		if (!(cp = file->private_data))
-			return (-EFAULT);	/* should never happen */
-		i = strlen(cp);	/* get total string length */
-		if (*off < i) {
-			/* still bytes to transfer */
-			cp += *off;	/* point to desired data offset */
-			i -= *off;	/* remaining length */
-			if (i > count)
-				i = count;	/* limit length to transfer */
-			if (copy_to_user(buf, cp, i))
-				return (-EFAULT);	/* copy error */
-			*off += i;	/* adjust offset */
-		} else
-			return (0);
+	if (!(cp = file->private_data))
+		return (-EFAULT);	/* should never happen */
+	i = strlen(cp);	/* get total string length */
+	if (pos == (unsigned)pos && pos < i) {
+		/* still bytes to transfer */
+		cp += pos;	/* point to desired data offset */
+		i -= pos;	/* remaining length */
+		if (i > count)
+			i = count;	/* limit length to transfer */
+		if (copy_to_user(buf, cp, i))
+			return (-EFAULT);	/* copy error */
+		*off = pos + i;	/* adjust offset */
 	} else
-		return (-EPERM);	/* no permission to read */
+		return (0);
 
 	return (i);
 }				/* hysdn_conf_read */
diff -urN linux-2.4.27-rc4/drivers/isdn/hysdn/hysdn_proclog.c linux-2.4.27-rc5/drivers/isdn/hysdn/hysdn_proclog.c
--- linux-2.4.27-rc4/drivers/isdn/hysdn/hysdn_proclog.c	2001-12-21 09:41:54.000000000 -0800
+++ linux-2.4.27-rc5/drivers/isdn/hysdn/hysdn_proclog.c	2004-08-03 16:53:26.515925435 -0700
@@ -210,6 +210,7 @@
 	word ino;
 	struct procdata *pd = NULL;
 	hysdn_card *card;
+	loff_t pos = *off;
 
 	if (!*((struct log_data **) file->private_data)) {
 		if (file->f_flags & O_NONBLOCK)
@@ -238,7 +239,7 @@
 	if ((len = strlen(inf->log_start)) <= count) {
 		if (copy_to_user(buf, inf->log_start, len))
 			return -EFAULT;
-		file->f_pos += len;
+		*off = pos + len;
 		return (len);
 	}
 	return (0);
diff -urN linux-2.4.27-rc4/drivers/isdn/isdn_common.c linux-2.4.27-rc5/drivers/isdn/isdn_common.c
--- linux-2.4.27-rc4/drivers/isdn/isdn_common.c	2002-08-02 17:39:44.000000000 -0700
+++ linux-2.4.27-rc5/drivers/isdn/isdn_common.c	2004-08-03 16:53:26.516925476 -0700
@@ -976,10 +976,14 @@
 	int chidx;
 	int retval;
 	char *p;
+	loff_t pos = *off;
 
 	if (off != &file->f_pos)
 		return -ESPIPE;
 
+	if (pos != (unsigned) pos)
+		return -EINVAL;
+
 	lock_kernel();
 	if (minor == ISDN_MINOR_STATUS) {
 		if (!file->private_data) {
@@ -996,7 +1000,7 @@
 				retval = -EFAULT;
 				goto out;
 			}
-			*off += len;
+			*off = pos + len;
 			retval = len;
 			goto out;
 		}
@@ -1027,7 +1031,7 @@
 		cli();
 		len = isdn_readbchan(drvidx, chidx, p, 0, count,
 				     &dev->drv[drvidx]->rcv_waitq[chidx]);
-		*off += len;
+		*off = pos + len;
 		restore_flags(flags);
 		if (copy_to_user(buf,p,len)) 
 			len = -EFAULT;
@@ -1064,7 +1068,7 @@
 		else
 			dev->drv[drvidx]->stavail = 0;
 		restore_flags(flags);
-		*off += len;
+		*off = pos + len;
 		retval = len;
 		goto out;
 	}
diff -urN linux-2.4.27-rc4/drivers/macintosh/ans-lcd.c linux-2.4.27-rc5/drivers/macintosh/ans-lcd.c
--- linux-2.4.27-rc4/drivers/macintosh/ans-lcd.c	2002-02-25 11:37:58.000000000 -0800
+++ linux-2.4.27-rc5/drivers/macintosh/ans-lcd.c	2004-08-03 16:53:26.521925681 -0700
@@ -53,7 +53,6 @@
 				size_t count, loff_t *ppos )
 {
 	const char * p = buf;
-	int i;
 
 #ifdef DEBUG
 	printk(KERN_DEBUG "LCD: write\n");
@@ -61,13 +60,13 @@
 
 	if ( verify_area(VERIFY_READ, buf, count) )
 		return -EFAULT;
-	for ( i = *ppos; count > 0; ++i, ++p, --count ) 
-	{
+	while (count--) {
 		char c;
-		__get_user(c, p);
+		if (__get_user(c, p++))
+			return -EFAULT;
 		anslcd_write_byte_data( c );
 	}
-	*ppos = i;
+	*ppos = p - buf;
 	return p - buf;
 }
 
diff -urN linux-2.4.27-rc4/drivers/macintosh/nvram.c linux-2.4.27-rc5/drivers/macintosh/nvram.c
--- linux-2.4.27-rc4/drivers/macintosh/nvram.c	2003-06-13 07:51:34.000000000 -0700
+++ linux-2.4.27-rc5/drivers/macintosh/nvram.c	2004-08-03 16:53:26.534926215 -0700
@@ -37,14 +37,15 @@
 static ssize_t read_nvram(struct file *file, char *buf,
 			  size_t count, loff_t *ppos)
 {
-	unsigned int i;
+	loff_t n = *ppos
+	unsigned int i = n;
 	char *p = buf;
 
 	if (verify_area(VERIFY_WRITE, buf, count))
 		return -EFAULT;
-	if (*ppos >= NVRAM_SIZE)
+	if (i != n || i >= NVRAM_SIZE)
 		return 0;
-	for (i = *ppos; count > 0 && i < NVRAM_SIZE; ++i, ++p, --count)
+	for (; count > 0 && i < NVRAM_SIZE; ++i, ++p, --count)
 		if (__put_user(nvram_read_byte(i), p))
 			return -EFAULT;
 	*ppos = i;
@@ -54,15 +55,16 @@
 static ssize_t write_nvram(struct file *file, const char *buf,
 			   size_t count, loff_t *ppos)
 {
-	unsigned int i;
+	loff_t n = *ppos;
+	unsigned int i = n;
 	const char *p = buf;
 	char c;
 
 	if (verify_area(VERIFY_READ, buf, count))
 		return -EFAULT;
-	if (*ppos >= NVRAM_SIZE)
+	if (i != n || i >= NVRAM_SIZE)
 		return 0;
-	for (i = *ppos; count > 0 && i < NVRAM_SIZE; ++i, ++p, --count) {
+	for (; count > 0 && i < NVRAM_SIZE; ++i, ++p, --count) {
 		if (__get_user(c, p))
 			return -EFAULT;
 		nvram_write_byte(c, i);
diff -urN linux-2.4.27-rc4/drivers/mtd/mtdchar.c linux-2.4.27-rc5/drivers/mtd/mtdchar.c
--- linux-2.4.27-rc4/drivers/mtd/mtdchar.c	2003-06-13 07:51:34.000000000 -0700
+++ linux-2.4.27-rc5/drivers/mtd/mtdchar.c	2004-08-03 16:53:26.589928473 -0700
@@ -125,11 +125,15 @@
 	int ret=0;
 	int len;
 	char *kbuf;
+	loff_t pos = *ppos;
 	
 	DEBUG(MTD_DEBUG_LEVEL0,"MTD_read\n");
 
-	if (*ppos + count > mtd->size)
-		count = mtd->size - *ppos;
+	if (pos < 0 || pos > mtd->size)
+		return 0;
+
+	if (count > mtd->size - pos)
+		count = mtd->size - pos;
 
 	if (!count)
 		return 0;
@@ -146,9 +150,9 @@
 		if (!kbuf)
 			return -ENOMEM;
 		
-		ret = MTD_READ(mtd, *ppos, len, &retlen, kbuf);
+		ret = MTD_READ(mtd, pos, len, &retlen, kbuf);
 		if (!ret) {
-			*ppos += retlen;
+			pos += retlen;
 			if (copy_to_user(buf, kbuf, retlen)) {
 			        kfree(kbuf);
 				return -EFAULT;
@@ -167,6 +171,8 @@
 		kfree(kbuf);
 	}
 	
+	*ppos = pos;
+	
 	return total_retlen;
 } /* mtd_read */
 
@@ -176,17 +182,18 @@
 	char *kbuf;
 	size_t retlen;
 	size_t total_retlen=0;
+	loff_t pos = *ppos;
 	int ret=0;
 	int len;
 
 	DEBUG(MTD_DEBUG_LEVEL0,"MTD_write\n");
 	
-	if (*ppos == mtd->size)
+	if (pos < 0 || pos >= mtd->size)
 		return -ENOSPC;
-	
-	if (*ppos + count > mtd->size)
-		count = mtd->size - *ppos;
 
+	if (count > mtd->size - pos)
+		count = mtd->size - pos;
+	
 	if (!count)
 		return 0;
 
@@ -207,9 +214,9 @@
 			return -EFAULT;
 		}
 		
-	        ret = (*(mtd->write))(mtd, *ppos, len, &retlen, kbuf);
+	        ret = (*(mtd->write))(mtd, pos, len, &retlen, kbuf);
 		if (!ret) {
-			*ppos += retlen;
+			pos += retlen;
 			total_retlen += retlen;
 			count -= retlen;
 			buf += retlen;
@@ -221,6 +228,7 @@
 		
 		kfree(kbuf);
 	}
+	*ppos = pos;
 
 	return total_retlen;
 } /* mtd_write */
diff -urN linux-2.4.27-rc4/drivers/net/hamradio/6pack.c linux-2.4.27-rc5/drivers/net/hamradio/6pack.c
--- linux-2.4.27-rc4/drivers/net/hamradio/6pack.c	2002-02-25 11:37:59.000000000 -0800
+++ linux-2.4.27-rc5/drivers/net/hamradio/6pack.c	2004-08-03 16:53:26.633930279 -0700
@@ -6,6 +6,9 @@
  * Version:	@(#)6pack.c	0.3.0	04/07/98
  *
  * Authors:	Andreas Könsgen <ajk@iehk.rwth-aachen.de>
+ * Changes for SuSE Kernel 2.4.21-99 (stolen from 2.6.0-test8)
+ * to avoid the "resyncing TNC" messages: 
+ *		Tim Fischer <tim.fischer@onlinehome.de>
  *
  * Quite a lot of stuff "stolen" by Jörg Reuter from slip.c, written by
  *
@@ -67,11 +70,11 @@
 #define SIXP_DAMA_OFF		0
 
 /* default level 2 parameters */
-#define SIXP_TXDELAY			25	/* in 10 ms */
+#define SIXP_TXDELAY			(HZ/4)	/* in 1 s */
 #define SIXP_PERSIST			50	/* in 256ths */
-#define SIXP_SLOTTIME			10	/* in 10 ms */
-#define SIXP_INIT_RESYNC_TIMEOUT	150	/* in 10 ms */
-#define SIXP_RESYNC_TIMEOUT		500	/* in 10 ms */
+#define SIXP_SLOTTIME			(HZ/10)	/* in 1 s */
+#define SIXP_INIT_RESYNC_TIMEOUT	(3*HZ/2) /* in 1 s */
+#define SIXP_RESYNC_TIMEOUT		5*HZ	/* in 1 s */
 
 /* 6pack configuration. */
 #define SIXP_NRUNIT			31      /* MAX number of 6pack channels */
diff -urN linux-2.4.27-rc4/drivers/pci/proc.c linux-2.4.27-rc5/drivers/pci/proc.c
--- linux-2.4.27-rc4/drivers/pci/proc.c	2002-11-28 15:53:14.000000000 -0800
+++ linux-2.4.27-rc5/drivers/pci/proc.c	2004-08-03 16:53:26.741934713 -0700
@@ -47,7 +47,8 @@
 	const struct inode *ino = file->f_dentry->d_inode;
 	const struct proc_dir_entry *dp = ino->u.generic_ip;
 	struct pci_dev *dev = dp->data;
-	unsigned int pos = *ppos;
+	loff_t n = *ppos;
+	unsigned pos = n;
 	unsigned int cnt, size;
 
 	/*
@@ -63,7 +64,7 @@
 	else
 		size = 64;
 
-	if (pos >= size)
+	if (pos != n || pos >= size)
 		return 0;
 	if (nbytes >= size)
 		nbytes = size;
@@ -129,10 +130,11 @@
 	const struct inode *ino = file->f_dentry->d_inode;
 	const struct proc_dir_entry *dp = ino->u.generic_ip;
 	struct pci_dev *dev = dp->data;
-	int pos = *ppos;
+	loff_t n = *ppos;
+	unsigned pos = n;
 	int cnt;
 
-	if (pos >= PCI_CFG_SPACE_SIZE)
+	if (pos != n || pos >= PCI_CFG_SPACE_SIZE)
 		return 0;
 	if (nbytes >= PCI_CFG_SPACE_SIZE)
 		nbytes = PCI_CFG_SPACE_SIZE;
diff -urN linux-2.4.27-rc4/drivers/pnp/isapnp_proc.c linux-2.4.27-rc5/drivers/pnp/isapnp_proc.c
--- linux-2.4.27-rc4/drivers/pnp/isapnp_proc.c	2002-11-28 15:53:14.000000000 -0800
+++ linux-2.4.27-rc5/drivers/pnp/isapnp_proc.c	2004-08-03 16:53:26.751935124 -0700
@@ -102,6 +102,7 @@
 				      size_t count, loff_t * offset)
 {
 	isapnp_info_buffer_t *buf;
+	loff_t pos = *offset;
 	long size = 0, size1;
 	int mode;
 
@@ -111,15 +112,15 @@
 	buf = (isapnp_info_buffer_t *) file->private_data;
 	if (!buf)
 		return -EIO;
-	if (file->f_pos >= buf->size)
+	if (pos != (unsigned) pos || pos >= buf->size)
 		return 0;
 	size = buf->size < count ? buf->size : count;
-	size1 = buf->size - file->f_pos;
+	size1 = buf->size - pos;
 	if (size1 < size)
 		size = size1;
-	if (copy_to_user(buffer, buf->buffer + file->f_pos, size))
+	if (copy_to_user(buffer, buf->buffer + pos, size))
 		return -EFAULT;
-	file->f_pos += size;
+	*offset = pos + size;
 	return size;
 }
 
@@ -128,6 +129,7 @@
 {
 	isapnp_info_buffer_t *buf;
 	long size = 0, size1;
+	loff_t pos = *offset;
 	int mode;
 
 	mode = file->f_flags & O_ACCMODE;
@@ -136,19 +138,19 @@
 	buf = (isapnp_info_buffer_t *) file->private_data;
 	if (!buf)
 		return -EIO;
-	if (file->f_pos < 0)
+	if (pos < 0)
 		return -EINVAL;
-	if (file->f_pos >= buf->len)
+	if (pos >= buf->len)
 		return -ENOMEM;
 	size = buf->len < count ? buf->len : count;
-	size1 = buf->len - file->f_pos;
+	size1 = buf->len - pos;
 	if (size1 < size)
 		size = size1;
-	if (copy_from_user(buf->buffer + file->f_pos, buffer, size))
+	if (copy_from_user(buf->buffer + pos, buffer, size))
 		return -EFAULT;
-	if (buf->size < file->f_pos + size)
-		buf->size = file->f_pos + size;
-	file->f_pos += size;
+	if (buf->size < pos + size)
+		buf->size = pos + size;
+	*offset = pos + size;
 	return size;
 }
 
@@ -240,14 +242,15 @@
 	struct inode *ino = file->f_dentry->d_inode;
 	struct proc_dir_entry *dp = ino->u.generic_ip;
 	struct pci_dev *dev = dp->data;
-	int pos = *ppos;
+	loff_t n = *ppos;
+	unsigned pos = n;
 	int cnt, size = 256;
 
-	if (pos >= size)
+	if (pos != n || pos >= size)
 		return 0;
 	if (nbytes >= size)
 		nbytes = size;
-	if (pos + nbytes > size)
+	if (nbytes > size - pos)
 		nbytes = size - pos;
 	cnt = nbytes;
 
diff -urN linux-2.4.27-rc4/drivers/s390/block/dasd.c linux-2.4.27-rc5/drivers/s390/block/dasd.c
--- linux-2.4.27-rc4/drivers/s390/block/dasd.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.27-rc5/drivers/s390/block/dasd.c	2004-08-03 16:53:26.782936396 -0700
@@ -4655,15 +4655,17 @@
 		   loff_t * offset)
 {
 	loff_t len;
+	loff_t n = *offset;
+	unsigned pos = n;
 	tempinfo_t *p_info = (tempinfo_t *) file->private_data;
 
-	if (*offset >= p_info->len) {
+	if (n != pos || pos >= p_info->len) {
 		return 0;	/* EOF */
 	} else {
-		len = MIN (user_len, (p_info->len - *offset));
-		if (copy_to_user (user_buf, &(p_info->data[*offset]), len))
+		len = MIN (user_len, (p_info->len - pos));
+		if (copy_to_user (user_buf, &(p_info->data[pos]), len))
 			return -EFAULT;
-		(*offset) += len;
+		*offset = pos + len;
 		return len;	/* number of bytes "read" */
 	}
 }
diff -urN linux-2.4.27-rc4/drivers/s390/char/tapechar.c linux-2.4.27-rc5/drivers/s390/char/tapechar.c
--- linux-2.4.27-rc4/drivers/s390/char/tapechar.c	2001-11-09 14:05:02.000000000 -0800
+++ linux-2.4.27-rc5/drivers/s390/char/tapechar.c	2004-08-03 16:53:26.802937217 -0700
@@ -161,6 +161,7 @@
 	size_t block_size;
 	ccw_req_t *cqr;
 	int rc;
+	loff_t pos = *ppos;
 #ifdef TAPE_DEBUG
         debug_text_event (tape_debug_area,6,"c:read");
 #endif /* TAPE_DEBUG */
@@ -230,7 +231,7 @@
 	debug_text_event (tape_debug_area,6,"c:rbytes:");
 	debug_int_event (tape_debug_area,6,block_size - ti->devstat.rescnt);
 #endif	/* TAPE_DEBUG */
-	filp->f_pos += block_size - ti->devstat.rescnt;
+	*ppos = pos + (block_size - ti->devstat.rescnt);
 	return block_size - ti->devstat.rescnt;
 }
 
@@ -246,6 +247,8 @@
 	ccw_req_t *cqr;
 	int nblocks, i, rc;
 	size_t written = 0;
+	loff_t pos = *ppos;
+
 #ifdef TAPE_DEBUG
 	debug_text_event (tape_debug_area,6,"c:write");
 #endif
@@ -318,15 +321,17 @@
 	        debug_text_event (tape_debug_area,6,"c:wbytes:"); 
 		debug_int_event (tape_debug_area,6,block_size - ti->devstat.rescnt);
 #endif
-		filp->f_pos += block_size - ti->devstat.rescnt;
 		written += block_size - ti->devstat.rescnt;
-		if (ti->devstat.rescnt > 0)
+		if (ti->devstat.rescnt > 0) {
+			*ppos = pos + written;
 			return written;
+		}
 	}
 #ifdef TAPE_DEBUG
 	debug_text_event (tape_debug_area,6,"c:wtotal:");
 	debug_int_event (tape_debug_area,6,written);
 #endif
+	*ppos = pos + written;
 	return written;
 }
 
diff -urN linux-2.4.27-rc4/drivers/s390/net/ctcmain.c linux-2.4.27-rc5/drivers/s390/net/ctcmain.c
--- linux-2.4.27-rc4/drivers/s390/net/ctcmain.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.27-rc5/drivers/s390/net/ctcmain.c	2004-08-03 16:53:26.820937956 -0700
@@ -2934,6 +2934,7 @@
 	file->private_data = kmalloc(CTRL_BUFSIZE, GFP_KERNEL);
 	if (file->private_data == NULL)
 		return -ENOMEM;
+	*(char *)file->private_data = '\0';
 	MOD_INC_USE_COUNT;
 	return 0;
 }
@@ -2999,6 +3000,7 @@
 	ctc_priv *privptr;
 	ssize_t ret = 0;
 	char *p = sbuf;
+	loff_t pos = *off;
 	int l;
 
 	if (!(dev = find_netdev_by_ino(ino)))
@@ -3008,19 +3010,19 @@
 
 	privptr = (ctc_priv *)dev->priv;
 
-	if (file->f_pos == 0)
+	if (!*sbuf || pos == 0)
 		sprintf(sbuf, "%d\n", privptr->channel[READ]->max_bufsize);
 
 	l = strlen(sbuf);
 	p = sbuf;
-	if (file->f_pos < l) {
-		p += file->f_pos;
+	if (pos == (unsigned)pos && pos < l) {
+		p += pos;
 		l = strlen(p);
 		ret = (count > l) ? l : count;
 		if (copy_to_user(buf, p, ret))
 			return -EFAULT;
+		*off = pos + ret;
 	}
-	file->f_pos += ret;
 	return ret;
 }
 
@@ -3084,6 +3086,7 @@
 	ctc_priv *privptr;
 	ssize_t ret = 0;
 	char *p = sbuf;
+	loff_t pos = *off;
 	int l;
 
 	if (!(dev = find_netdev_by_ino(ino)))
@@ -3093,19 +3096,19 @@
 
 	privptr = (ctc_priv *)dev->priv;
 
-	if (file->f_pos == 0)
+	if (!*sbus || pos == 0)
 		sprintf(sbuf, "0x%02x\n", loglevel);
 
 	l = strlen(sbuf);
 	p = sbuf;
-	if (file->f_pos < l) {
-		p += file->f_pos;
+	if (pos == (unsigned)pos && pos < l) {
+		p += pos;
 		l = strlen(p);
 		ret = (count > l) ? l : count;
 		if (copy_to_user(buf, p, ret))
 			return -EFAULT;
+		*off = pos + ret;
 	}
-	file->f_pos += ret;
 	return ret;
 }
 
@@ -3116,6 +3119,7 @@
 	file->private_data = kmalloc(STATS_BUFSIZE, GFP_KERNEL);
 	if (file->private_data == NULL)
 		return -ENOMEM;
+	*(char *)file->private_data = '\0';
 	MOD_INC_USE_COUNT;
 	return 0;
 }
@@ -3155,6 +3159,7 @@
 	ctc_priv *privptr;
 	ssize_t ret = 0;
 	char *p = sbuf;
+	loff_t pos = *off;
 	int l;
 
 	if (!(dev = find_netdev_by_ino(ino)))
@@ -3164,7 +3169,7 @@
 
 	privptr = (ctc_priv *)dev->priv;
 
-	if (file->f_pos == 0) {
+	if (!*sbus || pos == 0) {
 		p += sprintf(p, "Device FSM state: %s\n",
 			     fsm_getstate_str(privptr->fsm));
 		p += sprintf(p, "RX channel FSM state: %s\n",
@@ -3186,14 +3191,14 @@
 	}
 	l = strlen(sbuf);
 	p = sbuf;
-	if (file->f_pos < l) {
-		p += file->f_pos;
+	if (pos == (unsigned)pos && pos < l) {
+		p += pos;
 		l = strlen(p);
 		ret = (count > l) ? l : count;
 		if (copy_to_user(buf, p, ret))
 			return -EFAULT;
+		*off = pos + ret;
 	}
-	file->f_pos += ret;
 	return ret;
 }
 
diff -urN linux-2.4.27-rc4/drivers/s390/net/netiucv.c linux-2.4.27-rc5/drivers/s390/net/netiucv.c
--- linux-2.4.27-rc4/drivers/s390/net/netiucv.c	2003-08-25 04:44:42.000000000 -0700
+++ linux-2.4.27-rc5/drivers/s390/net/netiucv.c	2004-08-03 16:53:26.838938695 -0700
@@ -1375,6 +1375,7 @@
 	file->private_data = kmalloc(CTRL_BUFSIZE, GFP_KERNEL);
 	if (file->private_data == NULL)
 		return -ENOMEM;
+	*(char *)file->private_data = '\0';
 	MOD_INC_USE_COUNT;
 	return 0;
 }
@@ -1440,6 +1441,7 @@
 	netiucv_priv *privptr;
 	ssize_t ret = 0;
 	char *p = sbuf;
+	loff_t pos = *ppos;
 	int l;
 
 	if (!(dev = find_netdev_by_ino(ino)))
@@ -1449,19 +1451,20 @@
 
 	privptr = (netiucv_priv *)dev->priv;
 
-	if (file->f_pos == 0)
+	if (!*sbuf || pos == 0)
 		sprintf(sbuf, "%d\n", privptr->conn->max_buffsize);
 
 	l = strlen(sbuf);
 	p = sbuf;
-	if (file->f_pos < l) {
-		p += file->f_pos;
+	if (pos == (unsigned)pos && pos < l) {
+		p += pos;
 		l = strlen(p);
 		ret = (count > l) ? l : count;
 		if (copy_to_user(buf, p, ret))
 			return -EFAULT;
 	}
-	file->f_pos += ret;
+	pos += ret;
+	*ppos = pos;
 	return ret;
 }
 
@@ -1471,6 +1474,7 @@
 	file->private_data = kmalloc(CTRL_BUFSIZE, GFP_KERNEL);
 	if (file->private_data == NULL)
 		return -ENOMEM;
+	*(char *)file->private_data = '\0';
 	MOD_INC_USE_COUNT;
 	return 0;
 }
@@ -1535,6 +1539,7 @@
 	netiucv_priv *privptr;
 	ssize_t ret = 0;
 	char *p = sbuf;
+	loff_t pos = *ppos;
 	int l;
 
 	if (!(dev = find_netdev_by_ino(ino)))
@@ -1545,20 +1550,20 @@
 	privptr = (netiucv_priv *)dev->priv;
 
 
-	if (file->f_pos == 0)
+	if (!*sbuf || pos == 0)
 		sprintf(sbuf, "%s\n",
 			netiucv_printname(privptr->conn->userid));
 
 	l = strlen(sbuf);
 	p = sbuf;
-	if (file->f_pos < l) {
-		p += file->f_pos;
+	if (pos == (unsigned)pos && pos < l) {
+		p += pos;
 		l = strlen(p);
 		ret = (count > l) ? l : count;
 		if (copy_to_user(buf, p, ret))
 			return -EFAULT;
+		*ppos = pos + ret;
 	}
-	file->f_pos += ret;
 	return ret;
 }
 
@@ -1570,6 +1575,7 @@
 	file->private_data = kmalloc(STATS_BUFSIZE, GFP_KERNEL);
 	if (file->private_data == NULL)
 		return -ENOMEM;
+	*(char *)file->private_data = '\0';
 	MOD_INC_USE_COUNT;
 	return 0;
 }
@@ -1600,6 +1606,7 @@
 netiucv_stat_read(struct file *file, char *buf, size_t count, loff_t *off)
 {
 	unsigned int ino = ((struct inode *)file->f_dentry->d_inode)->i_ino;
+	loff_t pos = *ppos;
 	char *sbuf = (char *)file->private_data;
 	net_device *dev;
 	netiucv_priv *privptr;
@@ -1614,7 +1621,7 @@
 
 	privptr = (netiucv_priv *)dev->priv;
 
-	if (file->f_pos == 0) {
+	if (!*sbuf || pos == 0) {
 		p += sprintf(p, "Device FSM state: %s\n",
 			     fsm_getstate_str(privptr->fsm));
 		p += sprintf(p, "Connection FSM state: %s\n",
@@ -1638,14 +1645,14 @@
 	}
 	l = strlen(sbuf);
 	p = sbuf;
-	if (file->f_pos < l) {
-		p += file->f_pos;
+	if (pos == (unsigned)pos && pos < l) {
+		p += pos;
 		l = strlen(p);
 		ret = (count > l) ? l : count;
 		if (copy_to_user(buf, p, ret))
 			return -EFAULT;
+		*ppos = pos + ret;
 	}
-	file->f_pos += ret;
 	return ret;
 }
 
diff -urN linux-2.4.27-rc4/drivers/s390/net/qeth.c linux-2.4.27-rc5/drivers/s390/net/qeth.c
--- linux-2.4.27-rc4/drivers/s390/net/qeth.c	2003-08-25 04:44:42.000000000 -0700
+++ linux-2.4.27-rc5/drivers/s390/net/qeth.c	2004-08-03 16:53:26.856939434 -0700
@@ -9792,7 +9792,7 @@
 	int pos=0,end_pos;
 	char dbf_text[15];
 
-	if (*offset>0) return user_len;
+	if (*offset) return user_len;
 	buffer=vmalloc(__max(user_len+1,QETH_DBF_MISC_LEN));
 	if (buffer == NULL)
 		return -ENOMEM;
@@ -10308,14 +10308,16 @@
 {
 	loff_t len;
 	tempinfo_t *p_info = (tempinfo_t *) file->private_data;
+	loff_t n = *offset;
+	unsigned long pos = n;
 	
-	if (*offset >= p_info->len) {
+	if (pos != n || pos >= p_info->len) {
 		return 0;
 	} else {
-		len = __min(user_len, (p_info->len - *offset));
-		if (copy_to_user (user_buf, &(p_info->data[*offset]), len))
+		len = __min(user_len, (p_info->len - pos));
+		if (copy_to_user (user_buf, &(p_info->data[pos]), len))
 			return -EFAULT;
-		(*offset) += len;
+		*offset = pos + len;
 		return len;
 	}
 }
@@ -10350,7 +10352,7 @@
 	qeth_card_t *card;
 #define BUFFER_LEN (10+32+1+5+1+DEV_NAME_LEN+1)
 
-	if (*offset>0) return user_len;
+	if (*offset) return user_len;
 	buffer=vmalloc(__max(__max(user_len+1,BUFFER_LEN),QETH_DBF_MISC_LEN));
 
 	if (buffer == NULL)
@@ -10474,7 +10476,7 @@
 	PRINT_ERR("unknown ipato information command\n");
 out:
 	vfree(buffer);
-	*offset = *offset + user_len;
+	*offset = user_len;
 #undef BUFFER_LEN
 	return user_len;
 }
diff -urN linux-2.4.27-rc4/drivers/s390/s390io.c linux-2.4.27-rc5/drivers/s390/s390io.c
--- linux-2.4.27-rc4/drivers/s390/s390io.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.27-rc5/drivers/s390/s390io.c	2004-08-03 16:53:26.899941200 -0700
@@ -8328,14 +8328,15 @@
 {
 	loff_t len;
 	tempinfo_t *p_info = (tempinfo_t *) file->private_data;
+	loff_t pos = *offset;
 
-	if (*offset >= p_info->len) {
+	if (pos < 0 || pos >= p_info->len) {
 		return 0;
 	} else {
-		len = MIN (user_len, (p_info->len - *offset));
-		if (copy_to_user (user_buf, &(p_info->data[*offset]), len))
+		len = MIN (user_len, (p_info->len - pos));
+		if (copy_to_user (user_buf, &(p_info->data[pos]), len))
 			return -EFAULT;
-		(*offset) += len;
+		*offset = pos + len;
 		return len;
 	}
 }
@@ -8410,14 +8411,15 @@
 {
 	loff_t len;
 	tempinfo_t *p_info = (tempinfo_t *) file->private_data;
+	loff_t pos = *offset;
 
-	if (*offset >= p_info->len) {
+	if (pos < 0 || pos >= p_info->len) {
 		return 0;
 	} else {
-		len = MIN (user_len, (p_info->len - *offset));
-		if (copy_to_user (user_buf, &(p_info->data[*offset]), len))
+		len = MIN (user_len, (p_info->len - pos));
+		if (copy_to_user (user_buf, &(p_info->data[pos]), len))
 			return -EFAULT;
-		(*offset) += len;
+		*offset = pos + len;
 		return len;
 	}
 }
@@ -8874,14 +8876,15 @@
 {
 	loff_t len;
 	tempinfo_t *p_info = (tempinfo_t *) file->private_data;
+	loff_t pos = *offset;
 
-	if (*offset >= p_info->len) {
+	if (pos < 0 || pos >= p_info->len) {
 		return 0;
 	} else {
 		len = MIN (user_len, (p_info->len - *offset));
 		if (copy_to_user (user_buf, &(p_info->data[*offset]), len))
 			return -EFAULT;
-		(*offset) += len;
+		(*offset) = pos + len;
 		return len;
 	}
 }
@@ -8994,14 +8997,15 @@
 {
 	loff_t len;
 	tempinfo_t *p_info = (tempinfo_t *) file->private_data;
+	loff_t pos = *offset;
 
-	if (*offset >= p_info->len) {
+	if (pos < 0 || pos >= p_info->len) {
 		return 0;
 	} else {
 		len = MIN (user_len, (p_info->len - *offset));
 		if (copy_to_user (user_buf, &(p_info->data[*offset]), len))
 			return -EFAULT;
-		(*offset) += len;
+		(*offset) = pos + len;
 		return len;
 	}
 }
@@ -9123,14 +9127,15 @@
 {
      loff_t len;
      tempinfo_t *p_info = (tempinfo_t *) file->private_data;
+     loff_t pos = *offset;
      
-     if ( *offset>=p_info->len) {
+     if (pos < 0 || pos >= p_info->len) {
 	  return 0;
      } else {
-	  len = MIN(user_len, (p_info->len - *offset));
-	  if (copy_to_user( user_buf, &(p_info->data[*offset]), len))
+	  len = MIN(user_len, (p_info->len - pos));
+	  if (copy_to_user( user_buf, &(p_info->data[pos]), len))
 	       return -EFAULT; 
-	  (* offset) += len;
+	  *offset = pos + len;
 	  return len;
      }
 }
diff -urN linux-2.4.27-rc4/drivers/sbus/char/flash.c linux-2.4.27-rc5/drivers/sbus/char/flash.c
--- linux-2.4.27-rc4/drivers/sbus/char/flash.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.27-rc5/drivers/sbus/char/flash.c	2004-08-03 16:53:26.900941241 -0700
@@ -105,9 +105,15 @@
 flash_read(struct file * file, char * buf,
 	   size_t count, loff_t *ppos)
 {
-	unsigned long p = file->f_pos;
+	loff_t p = *ppos;
 	int i;
 	
+	if (p > flash.read_size)
+		return 0;
+
+	if (p < 0)
+		return -EINVAL;
+
 	if (count > flash.read_size - p)
 		count = flash.read_size - p;
 
@@ -118,7 +124,7 @@
 		buf++;
 	}
 
-	file->f_pos += count;
+	*ppos = p + count;
 	return count;
 }
 
diff -urN linux-2.4.27-rc4/drivers/scsi/osst.c linux-2.4.27-rc5/drivers/scsi/osst.c
--- linux-2.4.27-rc4/drivers/scsi/osst.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.27-rc5/drivers/scsi/osst.c	2004-08-03 16:53:26.933942595 -0700
@@ -3148,6 +3148,7 @@
 	ST_mode * STm;
 	ST_partstat * STps;
 	int dev = TAPE_NR(inode->i_rdev);
+	loff_t pos = *ppos;
 
 	STp = os_scsi_tapes[dev];
 
@@ -3369,7 +3370,7 @@
 		if (i == (-ENOSPC)) {
 			transfer = STp->buffer->writing;	/* FIXME -- check this logic */
 			if (transfer <= do_count) {
-				filp->f_pos += do_count - transfer;
+				pos += do_count - transfer;
 				count -= do_count - transfer;
 				if (STps->drv_block >= 0) {
 					STps->drv_block += (do_count - transfer) / STp->block_size;
@@ -3407,7 +3408,7 @@
 			goto out;
 		}
 
-		filp->f_pos += do_count;
+		pos += do_count;
 		b_point += do_count;
 		count -= do_count;
 		if (STps->drv_block >= 0) {
@@ -3429,7 +3430,7 @@
 		if (STps->drv_block >= 0) {
 			STps->drv_block += blks;
 		}
-		filp->f_pos += count;
+		pos += count;
 		count = 0;
 	}
 
@@ -3459,6 +3460,7 @@
 	retval = total;
 
 out:
+	*ppos = pos;
 	if (SRpnt != NULL) scsi_release_request(SRpnt);
 
 	up(&STp->lock);
@@ -3479,6 +3481,7 @@
 	ST_partstat * STps;
 	Scsi_Request *SRpnt = NULL;
 	int dev = TAPE_NR(inode->i_rdev);
+	loff_t pos = *ppos;
 
 	STp = os_scsi_tapes[dev];
 
@@ -3614,7 +3617,7 @@
 			}
 			STp->logical_blk_num += transfer / STp->block_size;
 			STps->drv_block      += transfer / STp->block_size;
-			filp->f_pos          += transfer;
+			pos                  += transfer;
 			buf                  += transfer;
 			total                += transfer;
 		}
@@ -3653,6 +3656,7 @@
 	retval = total;
 
 out:
+	*ppos = pos;
 	if (SRpnt != NULL) scsi_release_request(SRpnt);
 
 	up(&STp->lock);
@@ -5501,6 +5505,7 @@
 	read:		osst_read,
 	write:		osst_write,
 	ioctl:		osst_ioctl,
+	llseek:		no_llseek,
 	open:		os_scsi_tape_open,
 	flush:		os_scsi_tape_flush,
 	release:	os_scsi_tape_close,
diff -urN linux-2.4.27-rc4/drivers/scsi/sr.c linux-2.4.27-rc5/drivers/scsi/sr.c
--- linux-2.4.27-rc4/drivers/scsi/sr.c	2004-08-03 16:53:22.876776042 -0700
+++ linux-2.4.27-rc5/drivers/scsi/sr.c	2003-06-13 07:51:36.000000000 -0700
@@ -1,7 +1,6 @@
 /*
  *  sr.c Copyright (C) 1992 David Giller
  *           Copyright (C) 1993, 1994, 1995, 1999 Eric Youngdale
- *       Copyright (C) 2004 Iomega Corp
  *
  *  adapted from:
  *      sd.c Copyright (C) 1992 Drew Eckhardt
@@ -129,7 +128,7 @@
 				CDC_MEDIA_CHANGED | CDC_PLAY_AUDIO |
 				CDC_RESET | CDC_IOCTLS | CDC_DRIVE_STATUS |
 				CDC_CD_R | CDC_CD_RW | CDC_DVD | CDC_DVD_R |
-				CDC_DVD_RAM | CDC_GENERIC_PACKET | CDC_RAM,
+				CDC_DVD_RAM | CDC_GENERIC_PACKET,
 	generic_packet:		sr_packet,
 };
 
@@ -694,7 +693,7 @@
 {
 	unsigned char cmd[6];
 	unsigned char *buffer;
-	int rc, n, ram_write=0;
+	int rc, n;
 
 	static char *loadmech[] =
 	{
@@ -732,11 +731,6 @@
 		printk("sr%i: scsi-1 drive\n", i);
 		return;
 	}
-	if (cdrom_is_random_writable(&scsi_CDs[i].cdi, &ram_write))
-		scsi_CDs[i].cdi.mask |= CDC_RAM;
-	if (!ram_write)
-		scsi_CDs[i].cdi.mask |= CDC_RAM;
-
 	n = buffer[3] + 4;
 	scsi_CDs[i].cdi.speed = ((buffer[n + 8] << 8) + buffer[n + 9]) / 176;
 	scsi_CDs[i].readcd_known = 1;
@@ -760,6 +754,8 @@
 	if ((buffer[n + 3] & 0x20) == 0) {
 		/* can't write DVD-RAM media */
 		scsi_CDs[i].cdi.mask |= CDC_DVD_RAM;
+	} else {
+		scsi_CDs[i].device->writeable = 1;
 	}
 	if ((buffer[n + 3] & 0x10) == 0)
 		/* can't write DVD-R media */
@@ -784,13 +780,6 @@
 	/*else    I don't think it can close its tray
 	   scsi_CDs[i].cdi.mask |= CDC_CLOSE_TRAY; */
 
-	/*
-	 * if DVD-RAM of MRW-W, we are randomly writeable
-	 */
-	if ((scsi_CDs[i].cdi.mask & (CDC_DVD_RAM | CDC_RAM)) !=
-	    (CDC_DVD_RAM | CDC_RAM))
-		scsi_CDs[i].device->writeable = 1;
-
 	scsi_free(buffer, 512);
 }
 
diff -urN linux-2.4.27-rc4/drivers/scsi/st.c linux-2.4.27-rc5/drivers/scsi/st.c
--- linux-2.4.27-rc4/drivers/scsi/st.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.27-rc5/drivers/scsi/st.c	2004-08-03 16:53:26.948943211 -0700
@@ -1202,6 +1202,7 @@
 	ST_mode *STm;
 	ST_partstat *STps;
 	int dev = TAPE_NR(inode->i_rdev);
+	loff_t pos = *ppos;
 
 	read_lock(&st_dev_arr_lock);
 	STp = scsi_tapes[dev];
@@ -1433,7 +1434,7 @@
 					residual *= STp->block_size;
 				if (residual <= do_count) {
 					/* Within the data in this write() */
-					filp->f_pos += do_count - residual;
+					pos += do_count - residual;
 					count -= do_count - residual;
 					if (STps->drv_block >= 0) {
 						if (STp->block_size == 0 &&
@@ -1489,7 +1490,7 @@
 				retval = total - count;
 			goto out;
 		}
-		filp->f_pos += do_count;
+		pos += do_count;
 		b_point += do_count;
 		count -= do_count;
 		if (STps->drv_block >= 0) {
@@ -1508,7 +1509,7 @@
 			retval = i;
 			goto out;
 		}
-		filp->f_pos += count;
+		pos += count;
 		count = 0;
 	}
 
@@ -1543,6 +1544,7 @@
 	retval = total - count;
 
  out:
+	*ppos = pos;
 	if (SRpnt != NULL)
 		scsi_release_request(SRpnt);
 	up(&STp->lock);
@@ -1743,6 +1745,7 @@
 	ST_mode *STm;
 	ST_partstat *STps;
 	int dev = TAPE_NR(inode->i_rdev);
+	loff_t pos = *ppos;
 
 	read_lock(&st_dev_arr_lock);
 	STp = scsi_tapes[dev];
@@ -1887,7 +1890,7 @@
 				retval = i;
 				goto out;
 			}
-			filp->f_pos += transfer;
+			pos += transfer;
 			buf += transfer;
 			total += transfer;
 		}
@@ -1917,6 +1920,7 @@
 	retval = total;
 
  out:
+	*ppos = pos;
 	if (SRpnt != NULL) {
 		scsi_release_request(SRpnt);
 		SRpnt = NULL;
@@ -3774,6 +3778,7 @@
 	read:		st_read,
 	write:		st_write,
 	ioctl:		st_ioctl,
+	llseek:		no_llseek,
 	open:		st_open,
 	flush:		st_flush,
 	release:	st_release,
diff -urN linux-2.4.27-rc4/drivers/usb/brlvger.c linux-2.4.27-rc5/drivers/usb/brlvger.c
--- linux-2.4.27-rc4/drivers/usb/brlvger.c	2004-08-03 16:53:22.927778136 -0700
+++ linux-2.4.27-rc5/drivers/usb/brlvger.c	2004-08-03 16:53:27.021946208 -0700
@@ -596,6 +596,9 @@
 
 	off = *pos;
 
+	if (off < 0)
+		return -EINVAL;
+
 	if(off > priv->plength)
 		return -ESPIPE;;
 
diff -urN linux-2.4.27-rc4/drivers/usb/devio.c linux-2.4.27-rc5/drivers/usb/devio.c
--- linux-2.4.27-rc4/drivers/usb/devio.c	2003-11-28 10:26:20.000000000 -0800
+++ linux-2.4.27-rc5/drivers/usb/devio.c	2004-08-03 16:53:27.022946249 -0700
@@ -80,7 +80,7 @@
 	struct dev_state *ps = (struct dev_state *)file->private_data;
 	ssize_t ret = 0;
 	unsigned len;
-	loff_t pos;
+	loff_t pos, last;
 	int i;
 
 	pos = *ppos;
@@ -102,37 +102,38 @@
 			goto err;
 		}
 
-		*ppos += len;
+		pos += len;
 		buf += len;
 		nbytes -= len;
 		ret += len;
 	}
 
-	pos = sizeof(struct usb_device_descriptor);
+	last = sizeof(struct usb_device_descriptor);
 	for (i = 0; nbytes && i < ps->dev->descriptor.bNumConfigurations; i++) {
 		struct usb_config_descriptor *config =
 			(struct usb_config_descriptor *)ps->dev->rawdescriptors[i];
 		unsigned int length = le16_to_cpu(config->wTotalLength);
 
-		if (*ppos < pos + length) {
-			len = length - (*ppos - pos);
+		if (pos < last + length) {
+			len = length - (pos - last);
 			if (len > nbytes)
 				len = nbytes;
 
 			if (copy_to_user(buf,
-			    ps->dev->rawdescriptors[i] + (*ppos - pos), len)) {
+			    ps->dev->rawdescriptors[i] + (pos - last), len)) {
 				ret = -EFAULT;
 				goto err;
 			}
 
-			*ppos += len;
+			pos += len;
 			buf += len;
 			nbytes -= len;
 			ret += len;
 		}
 
-		pos += length;
+		last += length;
 	}
+	*ppos = pos;
 
 err:
 	up_read(&ps->devsem);
diff -urN linux-2.4.27-rc4/drivers/usb/drivers.c linux-2.4.27-rc5/drivers/usb/drivers.c
--- linux-2.4.27-rc4/drivers/usb/drivers.c	2000-04-26 15:22:55.000000000 -0700
+++ linux-2.4.27-rc5/drivers/usb/drivers.c	2004-08-03 16:53:27.034946742 -0700
@@ -52,9 +52,10 @@
 	struct list_head *tmp = usb_driver_list.next;
 	char *page, *start, *end;
 	ssize_t ret = 0;
-	unsigned int pos, len;
+	loff_t n = *ppos;
+	unsigned int pos = n, len;
 
-	if (*ppos < 0)
+	if (pos != n)
 		return -EINVAL;
 	if (nbytes <= 0)
 		return 0;
@@ -64,7 +65,6 @@
                 return -ENOMEM;
 	start = page;
 	end = page + (PAGE_SIZE - 100);
-	pos = *ppos;
 	for (; tmp != &usb_driver_list; tmp = tmp->next) {
 		struct usb_driver *driver = list_entry(tmp, struct usb_driver, driver_list);
 		int minor = driver->fops ? driver->minor : -1;
@@ -88,7 +88,7 @@
 		if (copy_to_user(buf, page + pos, len))
 			ret = -EFAULT;
 		else
-			*ppos += len;
+			*ppos = pos + len;
 	}
 	free_page((unsigned long)page);
 	return ret;
diff -urN linux-2.4.27-rc4/drivers/usb/host/uhci-debug.h linux-2.4.27-rc5/drivers/usb/host/uhci-debug.h
--- linux-2.4.27-rc4/drivers/usb/host/uhci-debug.h	2003-11-28 10:26:20.000000000 -0800
+++ linux-2.4.27-rc5/drivers/usb/host/uhci-debug.h	2004-08-03 16:53:27.182952818 -0700
@@ -530,16 +530,14 @@
 			loff_t *ppos)
 {
 	struct uhci_proc *up = file->private_data;
-	unsigned int pos;
+	loff_t n = *ppos;
+	unsigned int pos = n;
 	unsigned int size;
 
-	pos = *ppos;
 	size = up->size;
-	if (pos >= size)
+	if (pos != n || pos >= size)
 		return 0;
-	if (nbytes >= size)
-		nbytes = size;
-	if (pos + nbytes > size)
+	if (nbytes > size - pos)
 		nbytes = size - pos;
 
 	if (!access_ok(VERIFY_WRITE, buf, nbytes))
@@ -548,7 +546,7 @@
 	if (copy_to_user(buf, up->data + pos, nbytes))
 		return -EFAULT;
 
-	*ppos += nbytes;
+	*ppos = pos + nbytes;
 
 	return nbytes;
 }
diff -urN linux-2.4.27-rc4/drivers/video/fbmem.c linux-2.4.27-rc5/drivers/video/fbmem.c
--- linux-2.4.27-rc4/drivers/video/fbmem.c	2004-02-18 05:36:31.000000000 -0800
+++ linux-2.4.27-rc5/drivers/video/fbmem.c	2004-08-03 16:53:27.315958278 -0700
@@ -404,7 +404,7 @@
 static ssize_t
 fb_read(struct file *file, char *buf, size_t count, loff_t *ppos)
 {
-	unsigned long p = *ppos;
+	loff_t p = *ppos;
 	struct inode *inode = file->f_dentry->d_inode;
 	int fbidx = GET_FB_IDX(inode->i_rdev);
 	struct fb_info *info = registered_fb[fbidx];
@@ -414,12 +414,13 @@
 	if (! fb || ! info->disp)
 		return -ENODEV;
 
+	if (p < 0)
+		return -EINVAL;
+
 	fb->fb_get_fix(&fix,PROC_CONSOLE(info), info);
 	if (p >= fix.smem_len)
 	    return 0;
-	if (count >= fix.smem_len)
-	    count = fix.smem_len;
-	if (count + p > fix.smem_len)
+	if (count > fix.smem_len - p)
 		count = fix.smem_len - p;
 	if (count) {
 	    char *base_addr;
@@ -428,7 +429,7 @@
 	    count -= copy_to_user(buf, base_addr+p, count);
 	    if (!count)
 		return -EFAULT;
-	    *ppos += count;
+	    *ppos = p + count;
 	}
 	return count;
 }
@@ -436,7 +437,7 @@
 static ssize_t
 fb_write(struct file *file, const char *buf, size_t count, loff_t *ppos)
 {
-	unsigned long p = *ppos;
+	loff_t p = *ppos;
 	struct inode *inode = file->f_dentry->d_inode;
 	int fbidx = GET_FB_IDX(inode->i_rdev);
 	struct fb_info *info = registered_fb[fbidx];
@@ -447,13 +448,14 @@
 	if (! fb || ! info->disp)
 		return -ENODEV;
 
+	if (p < 0)
+		return -EINVAL;
+
 	fb->fb_get_fix(&fix, PROC_CONSOLE(info), info);
 	if (p > fix.smem_len)
 	    return -ENOSPC;
-	if (count >= fix.smem_len)
-	    count = fix.smem_len;
 	err = 0;
-	if (count + p > fix.smem_len) {
+	if (count > fix.smem_len - p) {
 	    count = fix.smem_len - p;
 	    err = -ENOSPC;
 	}
@@ -462,7 +464,7 @@
 
 	    base_addr = info->disp->screen_base;
 	    count -= copy_from_user(base_addr+p, buf, count);
-	    *ppos += count;
+	    *ppos = p + count;
 	    err = -EFAULT;
 	}
 	if (count)
diff -urN linux-2.4.27-rc4/drivers/zorro/proc.c linux-2.4.27-rc5/drivers/zorro/proc.c
--- linux-2.4.27-rc4/drivers/zorro/proc.c	2002-11-28 15:53:15.000000000 -0800
+++ linux-2.4.27-rc5/drivers/zorro/proc.c	2004-08-03 16:53:27.564968500 -0700
@@ -50,11 +50,9 @@
 	struct ConfigDev cd;
 	loff_t pos = *ppos;
 
-	if (pos >= sizeof(struct ConfigDev))
+	if (pos < 0 || pos >= sizeof(struct ConfigDev))
 		return 0;
-	if (nbytes >= sizeof(struct ConfigDev))
-		nbytes = sizeof(struct ConfigDev);
-	if (pos + nbytes > sizeof(struct ConfigDev))
+	if (nbytes > sizeof(struct ConfigDev) - pos)
 		nbytes = sizeof(struct ConfigDev) - pos;
 
 	/* Construct a ConfigDev */
@@ -67,7 +65,7 @@
 
 	if (copy_to_user(buf, &cd, nbytes))
 		return -EFAULT;
-	*ppos += nbytes;
+	*ppos = pos + nbytes;
 
 	return nbytes;
 }
diff -urN linux-2.4.27-rc4/fs/devfs/base.c linux-2.4.27-rc5/fs/devfs/base.c
--- linux-2.4.27-rc4/fs/devfs/base.c	2004-04-14 06:05:40.000000000 -0700
+++ linux-2.4.27-rc5/fs/devfs/base.c	2004-08-03 16:53:27.572968828 -0700
@@ -3312,7 +3312,7 @@
 {
     int done = FALSE;
     int ival;
-    loff_t pos, devname_offset, tlen, rpos;
+    loff_t pos, devname_offset, tlen, rpos, old_pos;
     devfs_handle_t de;
     struct devfsd_buf_entry *entry;
     struct fs_info *fs_info = file->f_dentry->d_inode->i_sb->u.generic_sbp;
@@ -3363,8 +3363,8 @@
     info->namelen = DEVFS_PATHLEN - pos - 1;
     if (info->mode == 0) info->mode = de->mode;
     devname_offset = info->devname - (char *) info;
-    rpos = *ppos;
-    if (rpos < devname_offset)
+    old_pos = rpos = *ppos;
+    if (rpos >= 0 && rpos < devname_offset)
     {
 	/*  Copy parts of the header  */
 	tlen = devname_offset - rpos;
@@ -3390,7 +3390,7 @@
 	}
 	rpos += tlen;
     }
-    tlen = rpos - *ppos;
+    tlen = rpos - old_pos;
     if (done)
     {
 	devfs_handle_t parent;
@@ -3504,16 +3504,17 @@
 			  loff_t *ppos)
 {
     ssize_t num;
+    loff_t n = *ppos;
     char txt[80];
 
     num = sprintf (txt, "Number of entries: %u  number of bytes: %u\n",
 		   stat_num_entries, stat_num_bytes) + 1;
     /*  Can't seek (pread) on this device  */
     if (ppos != &file->f_pos) return -ESPIPE;
-    if (*ppos >= num) return 0;
-    if (*ppos + len > num) len = num - *ppos;
-    if ( copy_to_user (buf, txt + *ppos, len) ) return -EFAULT;
-    *ppos += len;
+    if (n != (unsigned)n || n >= num) return 0;
+    if (len > num - n) len = num - n;
+    if ( copy_to_user (buf, txt + n, len) ) return -EFAULT;
+    *ppos = n + len;
     return len;
 }   /*  End Function stat_read  */
 #endif
diff -urN linux-2.4.27-rc4/fs/hfs/file.c linux-2.4.27-rc5/fs/hfs/file.c
--- linux-2.4.27-rc4/fs/hfs/file.c	2002-02-25 11:38:08.000000000 -0800
+++ linux-2.4.27-rc5/fs/hfs/file.c	2004-08-03 16:53:27.604970142 -0700
@@ -150,7 +150,7 @@
 		return -EINVAL;
 	}
 	pos = *ppos;
-	if (pos >= HFS_FORK_MAX) {
+	if (pos < 0 || pos >= HFS_FORK_MAX) {
 		return 0;
 	}
 	size = inode->i_size;
@@ -167,7 +167,7 @@
 	}
 	if ((read = hfs_do_read(inode, HFS_I(inode)->fork, pos,
 				buf, left, filp->f_reada != 0)) > 0) {
-	        *ppos += read;
+	        *ppos = pos + read;
 		filp->f_reada = 1;
 	}
 
@@ -197,7 +197,7 @@
 
 	pos = (filp->f_flags & O_APPEND) ? inode->i_size : *ppos;
 
-	if (pos >= HFS_FORK_MAX) {
+	if (pos < 0 || pos >= HFS_FORK_MAX) {
 		return 0;
 	}
 	if (count > HFS_FORK_MAX) {
@@ -207,8 +207,8 @@
 	        pos += written;
 
 	*ppos = pos;
-	if (*ppos > inode->i_size) {
-	        inode->i_size = *ppos;
+	if (pos > inode->i_size) {
+	        inode->i_size = pos;
 		mark_inode_dirty(inode);
 	}
 
diff -urN linux-2.4.27-rc4/fs/hfs/file_cap.c linux-2.4.27-rc5/fs/hfs/file_cap.c
--- linux-2.4.27-rc4/fs/hfs/file_cap.c	2001-09-10 07:31:25.000000000 -0700
+++ linux-2.4.27-rc5/fs/hfs/file_cap.c	2004-08-03 16:53:27.605970183 -0700
@@ -191,7 +191,7 @@
 				  hfs_rwarg_t count, loff_t *ppos)
 {
         struct inode *inode = filp->f_dentry->d_inode;
-	hfs_u32 pos;
+	hfs_u32 pos, last;
 
 	if (!S_ISREG(inode->i_mode)) {
 		hfs_warn("hfs_file_write: mode = %07o\n", inode->i_mode);
@@ -207,14 +207,14 @@
 		return 0;
 	}
 
-	*ppos += count;
-	if (*ppos > HFS_FORK_MAX) {
-		*ppos = HFS_FORK_MAX;
+	last = pos + count;
+	if (last > HFS_FORK_MAX) {
+		last = HFS_FORK_MAX;
 		count = HFS_FORK_MAX - pos;
 	}
 
-	if (*ppos > inode->i_size)
-	        inode->i_size = *ppos;
+	if (last > inode->i_size)
+	        inode->i_size = last;
 
 	/* Only deal with the part we store in memory */
 	if (pos < sizeof(struct hfs_cap_info)) {
@@ -272,6 +272,7 @@
 		}
 	}
 
+	*ppos = last;
 	inode->i_mtime = inode->i_ctime = CURRENT_TIME;
 	mark_inode_dirty(inode);
 	return count;
diff -urN linux-2.4.27-rc4/fs/hfs/file_hdr.c linux-2.4.27-rc5/fs/hfs/file_hdr.c
--- linux-2.4.27-rc4/fs/hfs/file_hdr.c	2001-08-12 10:56:56.000000000 -0700
+++ linux-2.4.27-rc5/fs/hfs/file_hdr.c	2004-08-03 16:53:27.606970224 -0700
@@ -384,7 +384,7 @@
 	struct hfs_cat_entry *entry = HFS_I(inode)->entry;
 	const struct hfs_hdr_layout *layout;
 	off_t start, length, offset;
-	off_t pos = *ppos;
+	loff_t pos = *ppos;
 	int left, lcv, read = 0;
 
 	if (!S_ISREG(inode->i_mode)) {
@@ -399,7 +399,7 @@
 	}
 
 	/* Adjust count to fit within the bounds of the file */
-	if ((pos >= inode->i_size) || (count <= 0)) {
+	if (pos != (unsigned)pos || pos >= inode->i_size || count <= 0) {
 		return 0;
 	} else if (count > inode->i_size - pos) {
 		count = inode->i_size - pos;
@@ -646,7 +646,7 @@
 		hfs_warn("hfs_hdr_write: mode = %07o\n", inode->i_mode);
 		return -EINVAL;
 	}
-	if (count <= 0) {
+	if (count <= 0 || pos != (unsigned)pos) {
 		return 0;
 	}
 
diff -urN linux-2.4.27-rc4/fs/openpromfs/inode.c linux-2.4.27-rc5/fs/openpromfs/inode.c
--- linux-2.4.27-rc4/fs/openpromfs/inode.c	2001-12-21 09:42:03.000000000 -0800
+++ linux-2.4.27-rc5/fs/openpromfs/inode.c	2004-08-03 16:53:27.640971620 -0700
@@ -69,17 +69,18 @@
 			    size_t count, loff_t *ppos)
 {
 	struct inode *inode = file->f_dentry->d_inode;
+	loff_t pos = *ppos;
 	char buffer[10];
 	
 	if (count < 0 || !inode->u.generic_ip)
 		return -EINVAL;
 	sprintf (buffer, "%8.8x\n", (u32)(long)(inode->u.generic_ip));
-	if (file->f_pos >= 9)
+	if (pos != (unsigned)pos || pos >= 9)
 		return 0;
-	if (count > 9 - file->f_pos)
-		count = 9 - file->f_pos;
-	copy_to_user(buf, buffer + file->f_pos, count);
-	file->f_pos += count;
+	if (count > 9 - pos)
+		count = 9 - pos;
+	copy_to_user(buf, buffer + pos, count);
+	*ppos = pos + count;
 	return count;
 }
 
@@ -87,6 +88,7 @@
 			     size_t count, loff_t *ppos)
 {
 	struct inode *inode = filp->f_dentry->d_inode;
+	loff_t pos = *ppos;
 	int i, j, k;
 	u32 node;
 	char *p, *s;
@@ -94,7 +96,7 @@
 	openprom_property *op;
 	char buffer[64];
 	
-	if (filp->f_pos >= 0xffffff)
+	if (pos < 0 || pos >= 0xffffff)
 		return -EINVAL;
 	if (!filp->private_data) {
 		node = nodes[(u16)((long)inode->u.generic_ip)].node;
@@ -180,7 +182,7 @@
 	} else {
 		i = (op->len << 1) + 1;
 	}
-	k = filp->f_pos;
+	k = pos;
 	if (k >= i) return 0;
 	if (count > i - k) count = i - k;
 	if (op->flag & OPP_STRING) {
@@ -196,16 +198,16 @@
 			j = count;
 
 		if (j >= 0) {
-			copy_to_user(buf + k - filp->f_pos,
+			copy_to_user(buf + k - pos,
 				     op->value + k - 1, j);
 			count -= j;
 			k += j;
 		}
 
 		if (count)
-			__put_user('\'', &buf [k++ - filp->f_pos]);
+			__put_user('\'', &buf [k++ - pos]);
 		if (count > 1)
-			__put_user('\n', &buf [k++ - filp->f_pos]);
+			__put_user('\n', &buf [k++ - pos]);
 
 	} else if (op->flag & OPP_STRINGLIST) {
 		char *tmp;
@@ -273,47 +275,48 @@
 
 		if ((k < i - 1) && (k & 1)) {
 			sprintf (buffer, "%02x", *(op->value + (k >> 1)));
-			__put_user(buffer[1], &buf[k++ - filp->f_pos]);
+			__put_user(buffer[1], &buf[k++ - pos]);
 			count--;
 		}
 
 		for (; (count > 1) && (k < i - 1); k += 2) {
 			sprintf (buffer, "%02x", *(op->value + (k >> 1)));
-			copy_to_user (buf + k - filp->f_pos, buffer, 2);
+			copy_to_user (buf + k - pos, buffer, 2);
 			count -= 2;
 		}
 
 		if (count && (k < i - 1)) {
 			sprintf (buffer, "%02x", *(op->value + (k >> 1)));
-			__put_user(buffer[0], &buf[k++ - filp->f_pos]);
+			__put_user(buffer[0], &buf[k++ - pos]);
 			count--;
 		}
 
 		if (count)
-			__put_user('\n', &buf [k++ - filp->f_pos]);
+			__put_user('\n', &buf [k++ - pos]);
 	}
-	count = k - filp->f_pos;
-	filp->f_pos = k;
+	count = k - pos;
+	*ppos = k;
 	return count;
 }
 
 static ssize_t property_write(struct file *filp, const char *buf,
 			      size_t count, loff_t *ppos)
 {
+	loff_t pos = *ppos;
 	int i, j, k;
 	char *p;
 	u32 *q;
 	void *b;
 	openprom_property *op;
 	
-	if (filp->f_pos >= 0xffffff)
+	if (pos < 0 || pos >= 0xffffff)
 		return -EINVAL;
 	if (!filp->private_data) {
 		i = property_read (filp, NULL, 0, 0);
 		if (i)
 			return i;
 	}
-	k = filp->f_pos;
+	k = pos;
 	op = (openprom_property *)filp->private_data;
 	if (!(op->flag & OPP_STRING)) {
 		u32 *first, *last;
@@ -433,7 +436,8 @@
 				op->len = i;
 		} else
 			op->len = i;
-		filp->f_pos += count;
+		pos += count;
+		*ppos = pos;
 	}
 write_try_string:
 	if (!(op->flag & OPP_BINARY)) {
@@ -450,7 +454,8 @@
 				op->flag |= OPP_QUOTED;
 				buf++;
 				count--;
-				filp->f_pos++;
+				pos++;
+				*ppos = pos;
 				if (!count) {
 					op->flag |= OPP_STRING;
 					return 1;
@@ -459,9 +464,9 @@
 				op->flag |= OPP_NOTQUOTED;
 		}
 		op->flag |= OPP_STRING;
-		if (op->alloclen <= count + filp->f_pos) {
+		if (op->alloclen <= count + pos) {
 			b = kmalloc (sizeof (openprom_property)
-				     + 2 * (count + filp->f_pos), GFP_KERNEL);
+				     + 2 * (count + pos), GFP_KERNEL);
 			if (!b)
 				return -ENOMEM;
 			memcpy (b, filp->private_data,
@@ -469,14 +474,14 @@
 				+ strlen (op->name) + op->alloclen);
 			memset (((char *)b) + sizeof (openprom_property)
 				+ strlen (op->name) + op->alloclen, 
-				0, 2*(count - filp->f_pos) - op->alloclen);
+				0, 2*(count - pos) - op->alloclen);
 			op = (openprom_property *)b;
-			op->alloclen = 2*(count + filp->f_pos);
+			op->alloclen = 2*(count + pos);
 			b = filp->private_data;
 			filp->private_data = (void *)op;
 			kfree (b);
 		}
-		p = op->value + filp->f_pos - ((op->flag & OPP_QUOTED) ? 1 : 0);
+		p = op->value + pos - ((op->flag & OPP_QUOTED) ? 1 : 0);
 		copy_from_user (p, buf, count);
 		op->flag |= OPP_DIRTY;
 		for (i = 0; i < count; i++, p++)
@@ -486,17 +491,19 @@
 			}
 		if (i < count) {
 			op->len = p - op->value;
-			filp->f_pos += i + 1;
+			pos += i + 1;
+			*ppos = pos;
 			if ((p > op->value) && (op->flag & OPP_QUOTED)
 			    && (*(p - 1) == '\''))
 				op->len--;
 		} else {
 			if (p - op->value > op->len)
 				op->len = p - op->value;
-			filp->f_pos += count;
+			pos += count;
+			*ppos = pos;
 		}
 	}
-	return filp->f_pos - k;
+	return pos - k;
 }
 
 int property_release (struct inode *inode, struct file *filp)
diff -urN linux-2.4.27-rc4/fs/proc/base.c linux-2.4.27-rc5/fs/proc/base.c
--- linux-2.4.27-rc4/fs/proc/base.c	2004-08-03 16:53:23.076784253 -0700
+++ linux-2.4.27-rc5/fs/proc/base.c	2004-08-03 16:53:27.641971661 -0700
@@ -337,6 +337,7 @@
 	ssize_t length;
 	ssize_t end;
 	struct task_struct *task = inode->u.proc_i.task;
+	loff_t pos = *ppos;
 
 	if (count > PROC_BLOCK_SIZE)
 		count = PROC_BLOCK_SIZE;
@@ -350,14 +351,14 @@
 		return length;
 	}
 	/* Static 4kB (or whatever) block capacity */
-	if (*ppos >= length) {
+	if (pos < 0 || pos >= length) {
 		free_page(page);
 		return 0;
 	}
-	if (count + *ppos > length)
-		count = length - *ppos;
-	end = count + *ppos;
-	copy_to_user(buf, (char *) page + *ppos, count);
+	if (count > length - pos)
+		count = length - pos;
+	end = count + pos;
+	copy_to_user(buf, (char *) page + pos, count);
 	*ppos = end;
 	free_page(page);
 	return count;
diff -urN linux-2.4.27-rc4/fs/proc/generic.c linux-2.4.27-rc5/fs/proc/generic.c
--- linux-2.4.27-rc4/fs/proc/generic.c	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.27-rc5/fs/proc/generic.c	2004-08-03 16:53:27.641971661 -0700
@@ -56,6 +56,7 @@
 	ssize_t	n, count;
 	char	*start;
 	struct proc_dir_entry * dp;
+	loff_t pos = *ppos;
 
 	dp = (struct proc_dir_entry *) inode->u.generic_ip;
 	if (!(page = (char*) __get_free_page(GFP_KERNEL)))
@@ -64,6 +65,8 @@
 	while ((nbytes > 0) && !eof)
 	{
 		count = MIN(PROC_BLOCK_SIZE, nbytes);
+		if ((unsigned)pos > INT_MAX)
+			break;
 
 		start = NULL;
 		if (dp->get_info) {
@@ -71,11 +74,11 @@
 			 * Handle backwards compatibility with the old net
 			 * routines.
 			 */
-			n = dp->get_info(page, &start, *ppos, count);
+			n = dp->get_info(page, &start, pos, count);
 			if (n < count)
 				eof = 1;
 		} else if (dp->read_proc) {
-			n = dp->read_proc(page, &start, *ppos,
+			n = dp->read_proc(page, &start, pos,
 					  count, &eof, dp->data);
 		} else
 			break;
@@ -84,8 +87,8 @@
 			/*
 			 * For proc files that are less than 4k
 			 */
-			start = page + *ppos;
-			n -= *ppos;
+			start = page + pos;
+			n -= pos;
 			if (n <= 0)
 				break;
 			if (n > count)
@@ -111,12 +114,13 @@
 			break;
 		}
 
-		*ppos += start < page ? (long)start : n; /* Move down the file */
+		pos += start < page ? (long)start : n; /* Move down the file */
 		nbytes -= n;
 		buf += n;
 		retval += n;
 	}
 	free_page((unsigned long) page);
+	*ppos = pos;
 	return retval;
 }
 
diff -urN linux-2.4.27-rc4/fs/proc/kcore.c linux-2.4.27-rc5/fs/proc/kcore.c
--- linux-2.4.27-rc4/fs/proc/kcore.c	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.27-rc5/fs/proc/kcore.c	2004-08-03 16:53:27.642971702 -0700
@@ -96,8 +96,9 @@
 		if (copy_to_user(buf, (void *) (PAGE_OFFSET+p-PAGE_SIZE), count))
 			return -EFAULT;
 		read += count;
+		p += count;
 	}
-	*ppos += read;
+	*ppos = p;
 	return read;
 }
 #else /* CONFIG_KCORE_AOUT */
diff -urN linux-2.4.27-rc4/fs/proc/proc_misc.c linux-2.4.27-rc5/fs/proc/proc_misc.c
--- linux-2.4.27-rc4/fs/proc/proc_misc.c	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.27-rc5/fs/proc/proc_misc.c	2004-08-03 16:53:27.643971743 -0700
@@ -500,12 +500,13 @@
 static ssize_t read_profile(struct file *file, char *buf,
 			    size_t count, loff_t *ppos)
 {
-	unsigned long p = *ppos;
+	loff_t n = *ppos;
+	unsigned p = n;
 	ssize_t read;
 	char * pnt;
 	unsigned int sample_step = 1 << prof_shift;
 
-	if (p >= (prof_len+1)*sizeof(unsigned int))
+	if (p != n || p >= (prof_len+1)*sizeof(unsigned int))
 		return 0;
 	if (count > (prof_len+1)*sizeof(unsigned int) - p)
 		count = (prof_len+1)*sizeof(unsigned int) - p;
@@ -519,7 +520,7 @@
 	if (copy_to_user(buf,(void *)pnt,count))
 		return -EFAULT;
 	read += count;
-	*ppos += read;
+	*ppos = n + read;
 	return read;
 }
 
diff -urN linux-2.4.27-rc4/fs/udf/file.c linux-2.4.27-rc5/fs/udf/file.c
--- linux-2.4.27-rc4/fs/udf/file.c	2002-08-02 17:39:45.000000000 -0700
+++ linux-2.4.27-rc5/fs/udf/file.c	2004-08-03 16:53:27.667972728 -0700
@@ -155,7 +155,8 @@
 {
 	ssize_t retval;
 	struct inode *inode = file->f_dentry->d_inode;
-	int err, pos;
+	int err;
+	loff_t pos;
 
 	if (UDF_I_ALLOCTYPE(inode) == ICBTAG_FLAG_AD_IN_ICB)
 	{
@@ -164,8 +165,11 @@
 		else
 			pos = *ppos;
 
-		if (inode->i_sb->s_blocksize < (udf_file_entry_alloc_offset(inode) +
-			pos + count))
+		if (pos < 0 || pos + count < pos)
+			return 0;
+
+		if (inode->i_sb->s_blocksize - udf_file_entry_alloc_offset(inode) <
+			pos + count)
 		{
 			udf_expand_file_adinicb(inode, pos + count, &err);
 			if (UDF_I_ALLOCTYPE(inode) == ICBTAG_FLAG_AD_IN_ICB)
diff -urN linux-2.4.27-rc4/fs/xfs/linux-2.4/xfs_buf.c linux-2.4.27-rc5/fs/xfs/linux-2.4/xfs_buf.c
--- linux-2.4.27-rc4/fs/xfs/linux-2.4/xfs_buf.c	2004-08-03 16:53:23.132786552 -0700
+++ linux-2.4.27-rc5/fs/xfs/linux-2.4/xfs_buf.c	2004-08-03 16:53:27.719974863 -0700
@@ -1830,7 +1830,7 @@
 	cur_offset = pb->pb_offset;
 	cur_len = buffer_len;
 
-	if (!pb->pb_locked &&
+	if (!pb->pb_locked && !(pb->pb_flags & PBF_DIRECTIO) &&
 	    (pb->pb_target->pbr_bsize < PAGE_CACHE_SIZE)) {
 		for (index = 0; index < pb->pb_page_count; index++)
 			lock_page(pb->pb_pages[index]);
diff -urN linux-2.4.27-rc4/fs/xfs/linux-2.4/xfs_iops.c linux-2.4.27-rc5/fs/xfs/linux-2.4/xfs_iops.c
--- linux-2.4.27-rc4/fs/xfs/linux-2.4/xfs_iops.c	2004-08-03 16:53:23.142786963 -0700
+++ linux-2.4.27-rc5/fs/xfs/linux-2.4/xfs_iops.c	2004-08-03 16:53:27.730975315 -0700
@@ -82,9 +82,14 @@
 
 	va.va_mask = XFS_AT_NLINK|XFS_AT_SIZE|XFS_AT_NBLOCKS;
 	VOP_GETATTR(vp, &va, ATTR_LAZY, NULL, error);
-	ip->i_nlink = va.va_nlink;
-	ip->i_size = va.va_size;
-	ip->i_blocks = va.va_nblocks;
+	if (likely(!error)) {
+		ip->i_nlink = va.va_nlink;
+		ip->i_blocks = va.va_nblocks;
+
+		/* we're under i_sem so i_size can't change under us */
+		if (i_size_read(ip) != va.va_size)
+			i_size_write(ip, va.va_size);
+	}
 }
 
 #ifdef CONFIG_XFS_POSIX_ACL
diff -urN linux-2.4.27-rc4/fs/xfs/linux-2.4/xfs_lrw.c linux-2.4.27-rc5/fs/xfs/linux-2.4/xfs_lrw.c
--- linux-2.4.27-rc4/fs/xfs/linux-2.4/xfs_lrw.c	2004-08-03 16:53:23.146787127 -0700
+++ linux-2.4.27-rc5/fs/xfs/linux-2.4/xfs_lrw.c	2004-08-03 16:53:27.733975438 -0700
@@ -283,6 +283,8 @@
 	XFS_STATS_INC(xs_read_calls);
 
 	if (unlikely(ioflags & IO_ISDIRECT)) {
+		if ((ssize_t)size < 0)
+			return -XFS_ERROR(EINVAL);
 		if (((__psint_t)buf & BBMASK) ||
 		    (*offset & mp->m_blockmask) ||
 		    (size & mp->m_blockmask)) {
@@ -325,7 +327,8 @@
 	if (unlikely(ioflags & IO_ISDIRECT)) {
 		xfs_rw_enter_trace(XFS_DIORD_ENTER, &ip->i_iocore,
 					buf, size, *offset, ioflags);
-		ret = do_generic_direct_read(file, buf, size, offset);
+		ret = (*offset < ip->i_d.di_size) ?
+			do_generic_direct_read(file, buf, size, offset) : 0;
 		UPDATE_ATIME(file->f_dentry->d_inode);
 	} else {
 		xfs_rw_enter_trace(XFS_READ_ENTER, &ip->i_iocore,
diff -urN linux-2.4.27-rc4/fs/xfs/linux-2.4/xfs_vnode.c linux-2.4.27-rc5/fs/xfs/linux-2.4/xfs_vnode.c
--- linux-2.4.27-rc4/fs/xfs/linux-2.4/xfs_vnode.c	2004-08-03 16:53:23.157787578 -0700
+++ linux-2.4.27-rc5/fs/xfs/linux-2.4/xfs_vnode.c	2004-08-03 16:53:27.744975890 -0700
@@ -199,13 +199,50 @@
 }
 
 /*
+ * Revalidate the Linux inode from the vattr.
+ * Note: i_size _not_ updated; we must hold the inode
+ * semaphore when doing that - callers responsibility.
+ */
+void
+vn_revalidate_core(
+	struct vnode	*vp,
+	vattr_t		*vap)
+{
+	struct inode	*inode = LINVFS_GET_IP(vp);
+
+	inode->i_mode	    = VTTOIF(vap->va_type) | vap->va_mode;
+	inode->i_nlink	    = vap->va_nlink;
+	inode->i_uid	    = vap->va_uid;
+	inode->i_gid	    = vap->va_gid;
+	inode->i_blocks	    = vap->va_nblocks;
+	inode->i_mtime	    = vap->va_mtime.tv_sec;
+	inode->i_ctime	    = vap->va_ctime.tv_sec;
+	inode->i_atime	    = vap->va_atime.tv_sec;
+	if (vap->va_xflags & XFS_XFLAG_IMMUTABLE)
+		inode->i_flags |= S_IMMUTABLE;
+	else
+		inode->i_flags &= ~S_IMMUTABLE;
+	if (vap->va_xflags & XFS_XFLAG_APPEND)
+		inode->i_flags |= S_APPEND;
+	else
+		inode->i_flags &= ~S_APPEND;
+	if (vap->va_xflags & XFS_XFLAG_SYNC)
+		inode->i_flags |= S_SYNC;
+	else
+		inode->i_flags &= ~S_SYNC;
+	if (vap->va_xflags & XFS_XFLAG_NOATIME)
+		inode->i_flags |= S_NOATIME;
+	else
+		inode->i_flags &= ~S_NOATIME;
+}
+
+/*
  * Revalidate the Linux inode from the vnode.
  */
 int
 vn_revalidate(
 	struct vnode	*vp)
 {
-	struct inode	*inode;
 	vattr_t		va;
 	int		error;
 
@@ -215,33 +252,7 @@
 	va.va_mask = XFS_AT_STAT|XFS_AT_XFLAGS;
 	VOP_GETATTR(vp, &va, 0, NULL, error);
 	if (!error) {
-		inode = LINVFS_GET_IP(vp);
-		inode->i_mode	    = VTTOIF(va.va_type) | va.va_mode;
-		inode->i_nlink	    = va.va_nlink;
-		inode->i_uid	    = va.va_uid;
-		inode->i_gid	    = va.va_gid;
-		i_size_write(inode, va.va_size);
-		inode->i_blocks	    = va.va_nblocks;
-		inode->i_mtime	    = va.va_mtime.tv_sec;
-		inode->i_ctime	    = va.va_ctime.tv_sec;
-		inode->i_atime	    = va.va_atime.tv_sec;
-		if (va.va_xflags & XFS_XFLAG_IMMUTABLE)
-			inode->i_flags |= S_IMMUTABLE;
-		else
-			inode->i_flags &= ~S_IMMUTABLE;
-		if (va.va_xflags & XFS_XFLAG_APPEND)
-			inode->i_flags |= S_APPEND;
-		else
-			inode->i_flags &= ~S_APPEND;
-		if (va.va_xflags & XFS_XFLAG_SYNC)
-			inode->i_flags |= S_SYNC;
-		else
-			inode->i_flags &= ~S_SYNC;
-		if (va.va_xflags & XFS_XFLAG_NOATIME)
-			inode->i_flags |= S_NOATIME;
-		else
-			inode->i_flags &= ~S_NOATIME;
-
+		vn_revalidate_core(vp, &va);
 		VUNMODIFY(vp);
 	}
 	return -error;
diff -urN linux-2.4.27-rc4/fs/xfs/linux-2.4/xfs_vnode.h linux-2.4.27-rc5/fs/xfs/linux-2.4/xfs_vnode.h
--- linux-2.4.27-rc4/fs/xfs/linux-2.4/xfs_vnode.h	2004-08-03 16:53:23.159787661 -0700
+++ linux-2.4.27-rc5/fs/xfs/linux-2.4/xfs_vnode.h	2004-08-03 16:53:27.746975972 -0700
@@ -528,6 +528,7 @@
 extern void	vn_purge(struct vnode *, vmap_t *);
 extern vnode_t	*vn_get(struct vnode *, vmap_t *);
 extern int	vn_revalidate(struct vnode *);
+extern void	vn_revalidate_core(struct vnode *, vattr_t *);
 extern void	vn_remove(struct vnode *);
 
 static inline int vn_count(struct vnode *vp)
diff -urN linux-2.4.27-rc4/include/linux/cdrom.h linux-2.4.27-rc5/include/linux/cdrom.h
--- linux-2.4.27-rc4/include/linux/cdrom.h	2004-08-03 16:53:23.228790493 -0700
+++ linux-2.4.27-rc5/include/linux/cdrom.h	2001-11-22 11:47:04.000000000 -0800
@@ -5,8 +5,7 @@
  *               1994, 1995   Eberhard Moenkeberg, emoenke@gwdg.de
  *               1996         David van Leeuwen, david@tm.tno.nl
  *               1997, 1998   Erik Andersen, andersee@debian.org
- *               1998-2004    Jens Axboe, axboe@suse.de
- *               2004         Iomega Corp
+ *               1998-2000    Jens Axboe, axboe@suse.de
  */
  
 #ifndef	_LINUX_CDROM_H
@@ -388,7 +387,6 @@
 #define CDC_DVD			0x8000	/* drive is a DVD */
 #define CDC_DVD_R		0x10000	/* drive can write DVD-R */
 #define CDC_DVD_RAM		0x20000	/* drive can write DVD-RAM */
-#define CDC_RAM			0x100000 /* ok to open WRITE */
 
 /* drive status possibilities returned by CDROM_DRIVE_STATUS ioctl */
 #define CDS_NO_INFO		0	/* if not implemented */
@@ -716,43 +714,16 @@
 	__u8 asb[46];
 };
 
-/*
- * feature profile
- */
-#define CDF_RWRT	0x0020
-#define CDF_HWDM	0x0024
-
-/* cf. mmc4r02g.pdf 5.3.10 Random Writable Feature (0020h) pg 197 of 635 */
-struct rwrt_feature_desc {
-	__u16 feature_code;
-#if defined(__BIG_ENDIAN_BITFIELD)
-	__u8 reserved1		: 2;
-	__u8 feature_version	: 4;
-	__u8 persistent		: 1;
-	__u8 curr		: 1;
-#elif defined(__LITTLE_ENDIAN_BITFIELD)
-	__u8 curr		: 1;
-	__u8 persistent		: 1;
-	__u8 feature_version	: 4;
-	__u8 reserved1		: 2;
-#endif
-	__u8 add_len;
-	__u32 last_lba;
-	__u32 block_size;
-	__u16 blocking;
-#if defined(__BIG_ENDIAN_BITFIELD)
-	__u8 reserved2		: 7;
-	__u8 page_present	: 1;
-#elif defined(__LITTLE_ENDIAN_BITFIELD)
-	__u8 page_present	: 1;
-	__u8 reserved2		: 7;
-#endif
-	__u8 reserved3;
-};
-
 #ifdef __KERNEL__
 #include <linux/devfs_fs_kernel.h>
 
+struct cdrom_write_settings {
+	unsigned char fpacket;		/* fixed/variable packets */
+	unsigned long packet_size;	/* write out this number of packets */
+	unsigned long nwa;		/* next writeable address */
+	unsigned char writeable;	/* cdrom is writeable */
+};
+
 /* Uniform cdrom data structures for cdrom.c */
 struct cdrom_device_info {
 	struct cdrom_device_ops  *ops;  /* link to device_ops */
@@ -773,6 +744,7 @@
 /* per-device flags */
         __u8 sanyo_slot		: 2;	/* Sanyo 3 CD changer support */
         __u8 reserved		: 6;	/* not used yet */
+	struct cdrom_write_settings write;
 };
 
 struct cdrom_device_ops {
@@ -1081,17 +1053,6 @@
 	__u8 reserved3;
 } rpc_state_t;
 
-struct feature_header {
-	__u32 data_len;
-	__u8 reserved1;
-	__u8 reserved2;
-	__u16 curr_profile;
-};
-
-extern int cdrom_get_disc_info(kdev_t dev, disc_information *di);
-extern int cdrom_get_track_info(kdev_t dev, __u16 track, __u8 type,
-				track_information *ti);
-extern int cdrom_is_random_writable(struct cdrom_device_info *cdi, int *write);
-#endif /* __KERNEL__ */
+#endif  /* End of kernel only stuff */ 
 
 #endif  /* _LINUX_CDROM_H */
diff -urN linux-2.4.27-rc4/include/net/sock.h linux-2.4.27-rc5/include/net/sock.h
--- linux-2.4.27-rc4/include/net/sock.h	2004-08-03 16:53:23.260791807 -0700
+++ linux-2.4.27-rc5/include/net/sock.h	2004-08-03 16:53:27.874981227 -0700
@@ -477,6 +477,7 @@
 		__u32	cnt;		/* increase cwnd by 1 after this number of ACKs */
 		__u32 	last_max_cwnd;	/* last maximium snd_cwnd */
 		__u32	last_cwnd;	/* the last snd_cwnd */
+		__u32   last_stamp;     /* time when updated last_cwnd */
 	} bictcp;
 };
 
diff -urN linux-2.4.27-rc4/mm/page_alloc.c linux-2.4.27-rc5/mm/page_alloc.c
--- linux-2.4.27-rc4/mm/page_alloc.c	2004-08-03 16:53:23.266792053 -0700
+++ linux-2.4.27-rc5/mm/page_alloc.c	2004-08-03 16:53:27.879981432 -0700
@@ -46,8 +46,6 @@
 
 int vm_gfp_debug = 0;
 
-int free_dbg_count = 0;
-
 static void FASTCALL(__free_pages_ok (struct page *page, unsigned int order));
 
 static spinlock_t free_pages_ok_no_irq_lock = SPIN_LOCK_UNLOCKED;
@@ -123,7 +121,7 @@
 	 * a reference to a page in order to pin it for io. -ben
 	 */
 	if (PageLRU(page)) {
-		if (unlikely(in_interrupt()) || ((free_dbg_count++ % 10000) == 0)) {
+		if (unlikely(in_interrupt())) {
 			unsigned long flags;
 
 			spin_lock_irqsave(&free_pages_ok_no_irq_lock, flags);
diff -urN linux-2.4.27-rc4/mm/shmem.c linux-2.4.27-rc5/mm/shmem.c
--- linux-2.4.27-rc4/mm/shmem.c	2004-08-03 16:53:23.267792094 -0700
+++ linux-2.4.27-rc5/mm/shmem.c	2004-08-03 16:53:27.881981514 -0700
@@ -1051,9 +1051,13 @@
 	struct inode *inode = filp->f_dentry->d_inode;
 	struct address_space *mapping = inode->i_mapping;
 	unsigned long index, offset;
+	loff_t pos = *ppos;
 
-	index = *ppos >> PAGE_CACHE_SHIFT;
-	offset = *ppos & ~PAGE_CACHE_MASK;
+	if (unlikely(pos < 0))
+		return;
+
+	index = pos >> PAGE_CACHE_SHIFT;
+	offset = pos & ~PAGE_CACHE_MASK;
 
 	for (;;) {
 		struct page *page = NULL;
diff -urN linux-2.4.27-rc4/net/8021q/vlanproc.c linux-2.4.27-rc5/net/8021q/vlanproc.c
--- linux-2.4.27-rc4/net/8021q/vlanproc.c	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.27-rc5/net/8021q/vlanproc.c	2004-08-03 16:53:27.884981637 -0700
@@ -234,7 +234,9 @@
 	struct inode *inode = file->f_dentry->d_inode;
 	struct proc_dir_entry *dent;
 	char *page;
-	int pos, offs, len;
+	int pos, len;
+	loff_t n = *ppos;
+	unsigned offs = n;
 
 	if (count <= 0)
 		return 0;
@@ -251,15 +253,14 @@
 		return -ENOBUFS;
 
 	pos = dent->get_info(page, dent->data, 0, 0);
-	offs = file->f_pos;
-	if (offs < pos) {
+	if (offs == n && offs < pos) {
 		len = min_t(int, pos - offs, count);
 		if (copy_to_user(buf, (page + offs), len)) {
 			kfree(page);
 			return -EFAULT;
 		}
 
-		file->f_pos += len;
+		*ppos = offs + len;
 	} else {
 		len = 0;
 	}
diff -urN linux-2.4.27-rc4/net/atm/br2684.c linux-2.4.27-rc5/net/atm/br2684.c
--- linux-2.4.27-rc4/net/atm/br2684.c	2004-02-18 05:36:32.000000000 -0800
+++ linux-2.4.27-rc5/net/atm/br2684.c	2004-08-03 16:53:27.885981678 -0700
@@ -737,6 +737,7 @@
 	unsigned long page;
 	int len = 0, x, left;
 	page = get_free_page(GFP_KERNEL);
+	loff_t n = *pos;
 	if (!page)
 		return -ENOMEM;
 	left = PAGE_SIZE - 256;
@@ -744,7 +745,7 @@
 		left = count;
 	read_lock(&devs_lock);
 	for (;;) {
-		x = br2684_proc_engine(*pos, &((char *) page)[len]);
+		x = br2684_proc_engine(n, &((char *) page)[len]);
 		if (x == 0)
 			break;
 		if (x > left)
@@ -759,11 +760,12 @@
 		}
 		len += x;
 		left -= x;
-		(*pos)++;
+		n++;
 		if (left < 256)
 			break;
 	}
 	read_unlock(&devs_lock);
+	*pos = n;
 	if (len > 0 && copy_to_user(buf, (char *) page, len))
 		len = -EFAULT;
 	free_page(page);
diff -urN linux-2.4.27-rc4/net/atm/mpoa_proc.c linux-2.4.27-rc5/net/atm/mpoa_proc.c
--- linux-2.4.27-rc4/net/atm/mpoa_proc.c	2004-04-14 06:05:41.000000000 -0700
+++ linux-2.4.27-rc5/net/atm/mpoa_proc.c	2004-08-03 16:53:27.889981842 -0700
@@ -109,6 +109,7 @@
 	eg_cache_entry *eg_entry;
 	struct timeval now;
 	unsigned char ip_string[16];
+	loff_t n = *pos;
 	if(count == 0)
 	        return 0;
 	page = get_free_page(GFP_KERNEL);
@@ -150,14 +151,14 @@
 		mpc = mpc->next;
 	}
 
-	if (*pos >= length) length = 0;
+	if (n != (unsigned)n || n >= length) length = 0;
 	else {
-	  if ((count + *pos) > length) count = length - *pos;
+	  if (count > length - n) count = length - n;
 	  if (copy_to_user(buff, (char *)page , count)) {
  		  free_page(page);
 		  return -EFAULT;
           }
-	  *pos += count;
+	  *pos = n + count;
 	}
 
  	free_page(page);
diff -urN linux-2.4.27-rc4/net/bluetooth/bnep/core.c linux-2.4.27-rc5/net/bluetooth/bnep/core.c
--- linux-2.4.27-rc4/net/bluetooth/bnep/core.c	2003-08-25 04:44:44.000000000 -0700
+++ linux-2.4.27-rc5/net/bluetooth/bnep/core.c	2004-08-03 16:53:27.890981883 -0700
@@ -63,7 +63,7 @@
 #define BT_DBG(D...)
 #endif
 
-#define VERSION "1.1"
+#define VERSION "1.2"
 
 static LIST_HEAD(bnep_session_list);
 static DECLARE_RWSEM(bnep_session_sem);
@@ -113,13 +113,28 @@
 	return bnep_send(s, &rsp, sizeof(rsp));
 }
 
+#ifdef CONFIG_BLUEZ_BNEP_PROTO_FILTER
+static inline void bnep_set_default_proto_filter(struct bnep_session *s)
+{
+	/* (IPv4, ARP)  */
+	s->proto_filter[0].start = htons(0x0800);
+	s->proto_filter[0].end   = htons(0x0806);
+	/* (RARP, AppleTalk) */
+	s->proto_filter[1].start = htons(0x8035);
+	s->proto_filter[1].end   = htons(0x80F3);
+	/* (IPX, IPv6) */
+	s->proto_filter[2].start = htons(0x8137);
+	s->proto_filter[2].end   = htons(0x86DD);
+}
+#endif
+
 static int bnep_ctrl_set_netfilter(struct bnep_session *s, u16 *data, int len)
 {
 	int n;
 
 	if (len < 2)
 		return -EILSEQ;
-	
+
 	n = ntohs(get_unaligned(data));
 	data++; len -= 2;
 
@@ -141,9 +156,13 @@
 			BT_DBG("proto filter start %d end %d",
 				f[i].start, f[i].end);
 		}
+
 		if (i < BNEP_MAX_PROTO_FILTERS)
 			memset(f + i, 0, sizeof(*f));
 
+		if (n == 0)
+			bnep_set_default_proto_filter(s);
+
 		bnep_send_rsp(s, BNEP_FILTER_NET_TYPE_RSP, BNEP_SUCCESS);
 	} else {
 		bnep_send_rsp(s, BNEP_FILTER_NET_TYPE_RSP, BNEP_FILTER_LIMIT_REACHED);
@@ -160,7 +179,7 @@
 
 	if (len < 2)
 		return -EILSEQ;
-	
+
 	n = ntohs(get_unaligned((u16 *) data)); 
 	data += 2; len -= 2;
 
@@ -214,7 +233,7 @@
 	int err = 0;
 
 	data++; len--;
-	
+
 	switch (cmd) {
 	case BNEP_CMD_NOT_UNDERSTOOD:
 	case BNEP_SETUP_CONN_REQ:
@@ -268,13 +287,13 @@
 			/* Unknown extension, skip it. */
 			break;
 		}
-	
+
 		if (!skb_pull(skb, h->len)) {
 			err = -EILSEQ;
 			break;
 		}
 	} while (!err && (h->type & BNEP_EXT_HEADER));
-	
+
 	return err;
 }
 
@@ -300,7 +319,7 @@
 
 	if ((type & BNEP_TYPE_MASK) > BNEP_RX_TYPES)
 		goto badframe;
-	
+
 	if ((type & BNEP_TYPE_MASK) == BNEP_CONTROL) {
 		bnep_rx_control(s, skb->data, skb->len);
 		kfree_skb(skb);
@@ -326,7 +345,7 @@
 			goto badframe;
 		s->eh.h_proto = get_unaligned((u16 *) (skb->data - 2));
 	}
-	
+
 	/* We have to alloc new skb and copy data here :(. Because original skb
 	 * may not be modified and because of the alignment requirements. */
 	nskb = alloc_skb(2 + ETH_HLEN + skb->len, GFP_KERNEL);
@@ -342,7 +361,7 @@
 	case BNEP_COMPRESSED:
 		memcpy(__skb_put(nskb, ETH_HLEN), &s->eh, ETH_HLEN);
 		break;
-	
+
 	case BNEP_COMPRESSED_SRC_ONLY:
 		memcpy(__skb_put(nskb, ETH_ALEN), s->eh.h_dest, ETH_ALEN);
 		memcpy(__skb_put(nskb, ETH_ALEN), skb->mac.raw, ETH_ALEN);
@@ -362,7 +381,7 @@
 
 	memcpy(__skb_put(nskb, skb->len), skb->data, skb->len);
 	kfree_skb(skb);
-	
+
 	s->stats.rx_packets++;
 	nskb->dev       = dev;
 	nskb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -426,9 +445,9 @@
 send:
 	iv[il++] = (struct iovec) { skb->data, skb->len };
 	len += skb->len;
-	
+
 	/* FIXME: linearize skb */
-	
+
 	s->msg.msg_iov    = iv;
 	s->msg.msg_iovlen = il;
 	len = sock->ops->sendmsg(sock, &s->msg, len, NULL);
@@ -453,16 +472,16 @@
 
 	BT_DBG("");
 
-        daemonize(); reparent_to_init();
+	daemonize(); reparent_to_init();
 
-        sprintf(current->comm, "kbnepd %s", dev->name);
-	
-        sigfillset(&current->blocked);
+	sprintf(current->comm, "kbnepd %s", dev->name);
+
+	sigfillset(&current->blocked);
 	flush_signals(current);
 
 	current->nice = -15;
 
-        set_fs(KERNEL_DS);
+	set_fs(KERNEL_DS);
 
 	init_waitqueue_entry(&wait, current);
 	add_wait_queue(sk->sleep, &wait);
@@ -477,13 +496,13 @@
 
 		if (sk->state != BT_CONNECTED)
 			break;
-	
+
 		// TX
 		while ((skb = skb_dequeue(&sk->write_queue)))
 			if (bnep_tx_frame(s, skb))
 				break;
 		netif_wake_queue(dev);
-	
+
 		schedule();
 	}
 	set_current_state(TASK_RUNNING);
@@ -547,28 +566,19 @@
 	s->sock  = sock;
 	s->role  = req->role;
 	s->state = BT_CONNECTED;
-	
+
 	s->msg.msg_flags = MSG_NOSIGNAL;
 
 #ifdef CONFIG_BLUEZ_BNEP_MC_FILTER
 	/* Set default mc filter */
 	set_bit(bnep_mc_hash(dev->broadcast), &s->mc_filter);
 #endif
-	
+
 #ifdef CONFIG_BLUEZ_BNEP_PROTO_FILTER
 	/* Set default protocol filter */
-
-	/* (IPv4, ARP)  */
-	s->proto_filter[0].start = htons(0x0800);
-	s->proto_filter[0].end   = htons(0x0806);
-	/* (RARP, AppleTalk) */
-	s->proto_filter[1].start = htons(0x8035);
-	s->proto_filter[1].end   = htons(0x80F3);
-	/* (IPX, IPv6) */
-	s->proto_filter[2].start = htons(0x8137);
-	s->proto_filter[2].end   = htons(0x86DD);
+	bnep_set_default_proto_filter(s);
 #endif
-	
+
 	dev->init = bnep_net_init;
 	dev->priv = s;
 	err = register_netdev(dev);
@@ -577,7 +587,7 @@
 	}
 
 	__bnep_link_session(s);
-	
+
 	err = kernel_thread(bnep_session, s, CLONE_FS | CLONE_FILES | CLONE_SIGHAND);
 	if (err < 0) {
 		/* Session thread start failed, gotta cleanup. */
diff -urN linux-2.4.27-rc4/net/bridge/br_if.c linux-2.4.27-rc5/net/bridge/br_if.c
--- linux-2.4.27-rc4/net/bridge/br_if.c	2004-08-03 16:53:23.288792956 -0700
+++ linux-2.4.27-rc5/net/bridge/br_if.c	2004-08-03 16:53:27.895982089 -0700
@@ -23,8 +23,6 @@
 #include <asm/uaccess.h>
 #include "br_private.h"
 
-static struct net_bridge *bridge_list;
-
 static int br_initial_port_cost(struct net_device *dev)
 {
 	if (!strncmp(dev->name, "lec", 3))
@@ -70,22 +68,6 @@
 	return 0;
 }
 
-static struct net_bridge **__find_br(char *name)
-{
-	struct net_bridge **b;
-	struct net_bridge *br;
-
-	b = &bridge_list;
-	while ((br = *b) != NULL) {
-		if (!strncmp(br->dev.name, name, IFNAMSIZ))
-			return b;
-
-		b = &(br->next);
-	}
-
-	return NULL;
-}
-
 static void del_ifs(struct net_bridge *br)
 {
 	br_write_lock_bh(BR_NETPROTO_LOCK);
@@ -178,42 +160,48 @@
 int br_add_bridge(char *name)
 {
 	struct net_bridge *br;
+	struct net_device *dev;
+	int err;
 
 	if ((br = new_nb(name)) == NULL)
 		return -ENOMEM;
 
-	if (__dev_get_by_name(name) != NULL) {
-		kfree(br);
-		return -EEXIST;
+	dev = &br->dev;
+	if (strchr(dev->name, '%')) {
+		err = dev_alloc_name(dev, dev->name);
+		if (err < 0)
+			goto  out;
 	}
 
-	br->next = bridge_list;
-	bridge_list = br;
+	err = register_netdevice(dev);
+	if (err == 0)
+		br_inc_use_count();
 
-	br_inc_use_count();
-	register_netdev(&br->dev);
-
-	return 0;
+ out:
+	return err;
 }
 
 int br_del_bridge(char *name)
 {
-	struct net_bridge **b;
+	struct net_device *dev;
 	struct net_bridge *br;
 
-	if ((b = __find_br(name)) == NULL)
+	dev = __dev_get_by_name(name);
+	if (!dev)
 		return -ENXIO;
 
-	br = *b;
+	if (dev->hard_start_xmit != br_dev_xmit)
+		return -EPERM;
 
-	if (br->dev.flags & IFF_UP)
+	if (dev->flags & IFF_UP)
 		return -EBUSY;
 
-	del_ifs(br);
+	br = dev->priv;
+	BUG_ON(&br->dev != dev);
 
-	*b = br->next;
+	del_ifs(br);
 
-	unregister_netdev(&br->dev);
+	unregister_netdevice(dev);
 	kfree(br);
 	br_dec_use_count();
 
@@ -271,16 +259,12 @@
 
 int br_get_bridge_ifindices(int *indices, int num)
 {
-	struct net_bridge *br;
-	int i;
-
-	br = bridge_list;
-	for (i=0;i<num;i++) {
-		if (br == NULL)
-			break;
+	struct net_device *dev;
+	int i = 0;
 
-		indices[i] = br->dev.ifindex;
-		br = br->next;
+	for (dev = dev_base; i < num && dev != NULL; dev = dev->next) {
+		if (dev->hard_start_xmit == br_dev_xmit)
+			indices[i++] = dev->ifindex;
 	}
 
 	return i;
diff -urN linux-2.4.27-rc4/net/bridge/br_ioctl.c linux-2.4.27-rc5/net/bridge/br_ioctl.c
--- linux-2.4.27-rc4/net/bridge/br_ioctl.c	2004-08-03 16:53:23.289792997 -0700
+++ linux-2.4.27-rc5/net/bridge/br_ioctl.c	2004-08-03 16:53:27.895982089 -0700
@@ -250,14 +250,9 @@
 
 int br_ioctl(struct net_bridge *br, unsigned int cmd, unsigned long arg0, unsigned long arg1, unsigned long arg2)
 {
-	int err;
-
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 
 	ASSERT_RTNL();
-	err = br_ioctl_deviceless(cmd, arg0, arg1);
-	if (err == -EOPNOTSUPP)
-		err = br_ioctl_device(br, cmd, arg0, arg1, arg2);
-	return err;
+	return br_ioctl_device(br, cmd, arg0, arg1, arg2);
 }
diff -urN linux-2.4.27-rc4/net/bridge/br_private.h linux-2.4.27-rc5/net/bridge/br_private.h
--- linux-2.4.27-rc4/net/bridge/br_private.h	2004-08-03 16:53:23.289792997 -0700
+++ linux-2.4.27-rc5/net/bridge/br_private.h	2004-08-03 16:53:27.896982130 -0700
@@ -79,7 +79,6 @@
 
 struct net_bridge
 {
-	struct net_bridge		*next;
 	rwlock_t			lock;
 	struct net_bridge_port		*port_list;
 	struct net_device		dev;
diff -urN linux-2.4.27-rc4/net/core/ethtool.c linux-2.4.27-rc5/net/core/ethtool.c
--- linux-2.4.27-rc4/net/core/ethtool.c	2004-08-03 16:53:23.292793121 -0700
+++ linux-2.4.27-rc5/net/core/ethtool.c	2004-08-03 16:53:27.898982212 -0700
@@ -159,7 +159,7 @@
 	if (copy_to_user(useraddr, &regs, sizeof(regs)))
 		goto out;
 	useraddr += offsetof(struct ethtool_regs, data);
-	if (copy_to_user(useraddr, regbuf, reglen))
+	if (copy_to_user(useraddr, regbuf, regs.len))
 		goto out;
 	ret = 0;
 
diff -urN linux-2.4.27-rc4/net/ipv4/netfilter/ip_nat_rule.c linux-2.4.27-rc5/net/ipv4/netfilter/ip_nat_rule.c
--- linux-2.4.27-rc4/net/ipv4/netfilter/ip_nat_rule.c	2003-11-28 10:26:21.000000000 -0800
+++ linux-2.4.27-rc5/net/ipv4/netfilter/ip_nat_rule.c	2004-08-03 16:53:27.913982828 -0700
@@ -121,7 +121,8 @@
 	ct = ip_conntrack_get(*pskb, &ctinfo);
 
 	/* Connection must be valid and new. */
-	IP_NF_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED));
+	IP_NF_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED
+	                    || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
 	IP_NF_ASSERT(out);
 
 	return ip_nat_setup_info(ct, targinfo, hooknum);
diff -urN linux-2.4.27-rc4/net/ipv4/netfilter/ipt_MASQUERADE.c linux-2.4.27-rc5/net/ipv4/netfilter/ipt_MASQUERADE.c
--- linux-2.4.27-rc4/net/ipv4/netfilter/ipt_MASQUERADE.c	2004-08-03 16:53:23.329794640 -0700
+++ linux-2.4.27-rc5/net/ipv4/netfilter/ipt_MASQUERADE.c	2004-08-03 16:53:27.915982910 -0700
@@ -79,8 +79,8 @@
 		return NF_ACCEPT;
 
 	ct = ip_conntrack_get(*pskb, &ctinfo);
-	IP_NF_ASSERT(ct && (ctinfo == IP_CT_NEW
-				  || ctinfo == IP_CT_RELATED));
+	IP_NF_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED
+	                    || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
 
 	mr = targinfo;
 
diff -urN linux-2.4.27-rc4/net/ipv4/netfilter/ipt_ULOG.c linux-2.4.27-rc5/net/ipv4/netfilter/ipt_ULOG.c
--- linux-2.4.27-rc4/net/ipv4/netfilter/ipt_ULOG.c	2003-08-25 04:44:44.000000000 -0700
+++ linux-2.4.27-rc5/net/ipv4/netfilter/ipt_ULOG.c	2004-08-03 16:53:27.917982992 -0700
@@ -89,7 +89,6 @@
 static ulog_buff_t ulog_buffers[ULOG_MAXNLGROUPS];	/* array of buffers */
 
 static struct sock *nflognl;	/* our socket */
-static size_t qlen;		/* current length of multipart-nlmsg */
 DECLARE_LOCK(ulog_lock);	/* spinlock */
 
 /* send one ulog_buff_t to userspace */
@@ -108,7 +107,7 @@
 
 	NETLINK_CB(ub->skb).dst_groups = (1 << nlgroupnum);
 	DEBUGP("ipt_ULOG: throwing %d packets to netlink mask %u\n",
-		ub->qlen, nlgroup);
+		ub->qlen, nlgroupnum);
 	netlink_broadcast(nflognl, ub->skb, 0, (1 << nlgroupnum), GFP_ATOMIC);
 
 	ub->qlen = 0;
@@ -118,7 +117,7 @@
 }
 
 
-/* timer function to flush queue in ULOG_FLUSH_INTERVAL time */
+/* timer function to flush queue in flushtimeout time */
 static void ulog_timer(unsigned long data)
 {
 	DEBUGP("ipt_ULOG: timer function called, calling ulog_send\n");
@@ -246,12 +245,6 @@
 		ub->lastnlh->nlmsg_flags |= NLM_F_MULTI;
 	}
 
-	/* if threshold is reached, send message to userspace */
-	if (qlen >= loginfo->qthreshold) {
-		if (loginfo->qthreshold > 1)
-			nlh->nlmsg_type = NLMSG_DONE;
-	}
-
 	ub->lastnlh = nlh;
 
 	/* if timer isn't already running, start it */
@@ -260,6 +253,13 @@
 		add_timer(&ub->timer);
 	}
 
+	/* if threshold is reached, send message to userspace */
+	if (ub->qlen >= loginfo->qthreshold) {
+		if (loginfo->qthreshold > 1)
+			nlh->nlmsg_type = NLMSG_DONE;
+		ulog_send(groupnum);
+	}
+
 	UNLOCK_BH(&ulog_lock);
 
 	return IPT_CONTINUE;
diff -urN linux-2.4.27-rc4/net/ipv4/tcp_input.c linux-2.4.27-rc5/net/ipv4/tcp_input.c
--- linux-2.4.27-rc4/net/ipv4/tcp_input.c	2004-08-03 16:53:23.356795748 -0700
+++ linux-2.4.27-rc5/net/ipv4/tcp_input.c	2004-08-03 16:53:27.926983361 -0700
@@ -333,6 +333,15 @@
 	tp->snd_cwnd_stamp = tcp_time_stamp;
 }
 
+static void init_bictcp(struct tcp_opt *tp)
+{
+	tp->bictcp.cnt = 0;
+
+	tp->bictcp.last_max_cwnd = 0;
+	tp->bictcp.last_cwnd = 0;
+	tp->bictcp.last_stamp = 0;
+}
+
 /* 5. Recalculate window clamp after socket hit its memory bounds. */
 static void tcp_clamp_window(struct sock *sk, struct tcp_opt *tp)
 {
@@ -1221,6 +1230,8 @@
 	tcp_set_ca_state(tp, TCP_CA_Loss);
 	tp->high_seq = tp->frto_highmark;
 	TCP_ECN_queue_cwr(tp);
+
+	init_bictcp(tp);
 }
 
 void tcp_clear_retrans(struct tcp_opt *tp)
@@ -1997,10 +2008,12 @@
 	if (!sysctl_tcp_bic)
 		return tp->snd_cwnd;
 
-	if (tp->bictcp.last_cwnd == tp->snd_cwnd)
-		return tp->bictcp.cnt; /*  same cwnd, no update */
-      
+	if (tp->bictcp.last_cwnd == tp->snd_cwnd &&
+	   (s32)(tcp_time_stamp - tp->bictcp.last_stamp) <= (HZ>>5))
+		return tp->bictcp.cnt;
+
 	tp->bictcp.last_cwnd = tp->snd_cwnd;
+	tp->bictcp.last_stamp = tcp_time_stamp;
       
 	/* start off normal */
 	if (tp->snd_cwnd <= sysctl_tcp_bic_low_window)
@@ -4563,6 +4576,7 @@
 				return 1;
 
 			tcp_init_westwood(sk);
+			init_bictcp(tp);
 
 			/* Now we have several options: In theory there is 
 			 * nothing else in the frame. KA9Q has an option to 
@@ -4586,6 +4600,7 @@
 
 	case TCP_SYN_SENT:
 		tcp_init_westwood(sk);
+		init_bictcp(tp);
 
 		queued = tcp_rcv_synsent_state_process(sk, skb, th, len);
 		if (queued >= 0)
diff -urN linux-2.4.27-rc4/net/ipv4/tcp_minisocks.c linux-2.4.27-rc5/net/ipv4/tcp_minisocks.c
--- linux-2.4.27-rc4/net/ipv4/tcp_minisocks.c	2004-08-03 16:53:23.357795789 -0700
+++ linux-2.4.27-rc5/net/ipv4/tcp_minisocks.c	2004-08-03 16:53:27.927983402 -0700
@@ -717,9 +717,6 @@
 		newtp->snd_cwnd = 2;
 		newtp->snd_cwnd_cnt = 0;
 
-		newtp->bictcp.cnt = 0;
-		newtp->bictcp.last_max_cwnd = newtp->bictcp.last_cwnd = 0;
-
 		newtp->frto_counter = 0;
 		newtp->frto_highmark = 0;
 
diff -urN linux-2.4.27-rc4/net/sched/sch_netem.c linux-2.4.27-rc5/net/sched/sch_netem.c
--- linux-2.4.27-rc4/net/sched/sch_netem.c	2004-08-03 16:53:23.390797144 -0700
+++ linux-2.4.27-rc5/net/sched/sch_netem.c	2004-08-03 16:53:27.947984223 -0700
@@ -833,7 +833,7 @@
 
 	qopt.latency = q->latency;
 	qopt.jitter = q->jitter;
-	qopt.limit = sch->dev->tx_queue_len;
+	qopt.limit = q->limit;
 	qopt.loss = q->loss;
 	qopt.gap = q->gap;
 
diff -urN linux-2.4.27-rc4/net/wanrouter/wanproc.c linux-2.4.27-rc5/net/wanrouter/wanproc.c
--- linux-2.4.27-rc4/net/wanrouter/wanproc.c	2001-09-10 07:58:35.000000000 -0700
+++ linux-2.4.27-rc5/net/wanrouter/wanproc.c	2004-08-03 16:53:27.974985332 -0700
@@ -243,7 +243,9 @@
 		struct inode *inode = file->f_dentry->d_inode;
 		struct proc_dir_entry* dent;
 		char* page;
-		int pos, offs, len;
+		int pos, len;
+		loff_t n = *ppos;
+		unsigned offs = n;
 
 		if (count <= 0)
 			return 0;
@@ -257,14 +259,13 @@
 			return -ENOBUFS;
 			
 		pos = dent->get_info(page, dent->data, 0, 0);
-		offs = file->f_pos;
-		if (offs < pos) {
+		if (offs == n && offs < pos) {
 			len = min_t(unsigned int, pos - offs, count);
 			if (copy_to_user(buf, (page + offs), len)) {
 				kfree(page);
 				return -EFAULT;
 			}
-			file->f_pos += len;
+			*ppos = offs + len;
 		}
 		else
 			len = 0;
