diff --git a/debian/arch/arm/config.nslu2 b/debian/arch/arm/config.nslu2
index d6992a6e9..fdf5c0d1b 100644
--- a/debian/arch/arm/config.nslu2
+++ b/debian/arch/arm/config.nslu2
@@ -1387,6 +1387,7 @@ CONFIG_NFS_ACL_SUPPORT=m
 CONFIG_SUNRPC=m
 CONFIG_SUNRPC_GSS=m
 CONFIG_RPCSEC_GSS_KRB5=m
+# CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
 # CONFIG_SMB_NLS_DEFAULT is not set
 # CONFIG_CIFS is not set
diff --git a/debian/arch/armeb/config.nslu2 b/debian/arch/armeb/config.nslu2
index 73f5accde..7e84de814 100644
--- a/debian/arch/armeb/config.nslu2
+++ b/debian/arch/armeb/config.nslu2
@@ -1387,6 +1387,7 @@ CONFIG_NFS_ACL_SUPPORT=m
 CONFIG_SUNRPC=m
 CONFIG_SUNRPC_GSS=m
 CONFIG_RPCSEC_GSS_KRB5=m
+# CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
 # CONFIG_SMB_NLS_DEFAULT is not set
 # CONFIG_CIFS is not set
diff --git a/debian/bin/gencontrol.py b/debian/bin/gencontrol.py
index 2e9691f28..94bcef51d 100755
--- a/debian/bin/gencontrol.py
+++ b/debian/bin/gencontrol.py
@@ -22,31 +22,28 @@ class gencontrol(debian_linux.gencontrol.gencontrol):
 
     def do_arch_packages(self, packages, makefile, arch, vars, makeflags, extra):
         headers_arch = self.templates["control.headers.arch"]
-        package_headers_arch = self.process_package(headers_arch[0], vars)
-        extra['headers_arch_depends'] = []
+        packages_headers_arch = self.process_packages(headers_arch, vars)
+        extra['headers_arch_depends'] = packages_headers_arch[2]['Depends']
 
-        name = package_headers_arch['Package']
-        if packages.has_key(name):
-            package_headers_arch = packages.get(name)
-            package_headers_arch['Architecture'].append(arch)
-        else:
-            package_headers_arch['Architecture'] = [arch]
-            packages.append(package_headers_arch)
+        for package in packages_headers_arch:
+            name = package['Package']
+            if packages.has_key(name):
+                package = packages.get(name)
+                package['Architecture'].append(arch)
+            else:
+                package['Architecture'] = [arch]
+                packages.append(package)
 
         makeflags_string = ' '.join(["%s='%s'" % i for i in makeflags.iteritems()])
 
-        cmds_source = []
-        cmds_source.append(("$(MAKE) -f debian/rules.real source-arch %s" % makeflags_string,))
-        makefile.append(("build-%s-real:" % arch))
-        makefile.append(("setup-%s-real:" % arch))
-        makefile.append(("source-%s-real:" % arch, cmds_source))
-
-    def do_arch_packages_post(self, packages, makefile, arch, vars, makeflags, extra):
-        makeflags_string = ' '.join(["%s='%s'" % i for i in makeflags.iteritems()])
-
         cmds_binary_arch = []
-        cmds_binary_arch.append(("$(MAKE) -f debian/rules.real install-headers-all GENCONTROL_ARGS='\"-Vkernel:Depends=%s\"' %s" % (', '.join(["%s (= %s)" % (i, self.version['source']) for i in extra['headers_arch_depends']]), makeflags_string),))
+        cmds_binary_arch.append(("$(MAKE) -f debian/rules.real binary-arch-arch %s" % makeflags_string))
+        cmds_source = []
+        cmds_source.append(("$(MAKE) -f debian/rules.real source-arch %s" % makeflags_string,))
         makefile.append(("binary-arch-%s-real:" % arch, cmds_binary_arch))
+        makefile.append(("build-%s-real:" % arch))
+        makefile.append(("setup-%s-real:" % arch))
+        makefile.append(("source-%s-real:" % arch, cmds_source))
 
     def do_subarch_setup(self, vars, makeflags, arch, subarch):
         vars.update(self.config.get(('image', arch, subarch), {}))
@@ -139,7 +136,7 @@ class gencontrol(debian_linux.gencontrol.gencontrol):
                 package['Architecture'] = [arch]
                 packages.append(package)
 
-        extra['headers_arch_depends'].append(packages_own[1]['Package'])
+        extra['headers_arch_depends'].append('%s (= ${Source-Version})' % packages_own[1]['Package'])
 
         makeflags_string = ' '.join(["%s='%s'" % i for i in makeflags.iteritems()])
 
diff --git a/debian/changelog b/debian/changelog
index 73c7ddb2f..6bc4c7fc1 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -4,6 +4,35 @@ linux-2.6 (2.6.16-99experimental.1) UNRELEASED; urgency=low
 
  -- Bastian Blank <waldi@debian.org>  Thu, 23 Mar 2006 21:40:17 +0100
 
+linux-2.6 (2.6.16-4) unstable; urgency=medium
+
+  [ Martin Michlmayr ]
+  * [arm/armeb] Update nslu2 config.
+  * Add stable release 2.6.16.1:
+    - Fix speedstep-smi assembly bug in speedstep_smi_ownership
+    - DMI: fix DMI onboard device discovery
+    - cciss: fix use-after-free in cciss_init_one
+    - DM: Fix bug: BIO_RW_BARRIER requests to md/raid1 hang.
+    - fix scheduler deadlock
+    - proc: fix duplicate line in /proc/devices
+    - rtc.h broke strace(1) builds
+    - dm: bio split bvec fix
+    - v9fs: assign dentry ops to negative dentries
+    - i810fb_cursor(): use GFP_ATOMIC
+    - NET: Ensure device name passed to SO_BINDTODEVICE is NULL terminated.
+    - XFS writeout fix
+    - sysfs: fix a kobject leak in sysfs_add_link on the error path
+    - get_cpu_sysdev() signedness fix
+    - firmware: fix BUG: in fw_realloc_buffer
+    - sysfs: sysfs_remove_dir() needs to invalidate the dentry
+    - TCP: Do not use inet->id of global tcp_socket when sending RST (CVE-2006-1242)
+    - 2.6.xx: sata_mv: another critical fix
+    - Kconfig: VIDEO_DECODER must select FW_LOADER
+    - V4L/DVB (3324): Fix Samsung tuner frequency ranges
+    - sata_mv: fix irq port status usage
+
+ -- Bastian Blank <waldi@debian.org>  Tue, 28 Mar 2006 17:19:10 +0200
+
 linux-2.6 (2.6.16-3) unstable; urgency=low
 
   [ Frederik Schüler ]
diff --git a/debian/lib/python/debian_linux/gencontrol.py b/debian/lib/python/debian_linux/gencontrol.py
index b5fad289c..e75147b28 100644
--- a/debian/lib/python/debian_linux/gencontrol.py
+++ b/debian/lib/python/debian_linux/gencontrol.py
@@ -96,6 +96,7 @@ class gencontrol(object):
     def do_arch(self, packages, makefile, arch, vars, makeflags):
         config_entry = self.config['base', arch]
         vars.update(config_entry)
+        vars['arch'] = arch
 
         if not config_entry.get('available', True):
             for i in self.makefile_targets:
diff --git a/debian/modules/gencontrol.py b/debian/modules/gencontrol.py
index 341280b6c..c9f7abfe3 100755
--- a/debian/modules/gencontrol.py
+++ b/debian/modules/gencontrol.py
@@ -12,9 +12,8 @@ class gencontrol(debian_linux.gencontrol.gencontrol):
         packages.extend(self.process_packages(main, vars))
 
     def do_main_packages(self, packages):
-        l = package_relation_group()
-        l.extend([package_relation('linux-headers-%s%s-%s [%s]' % (self.version['upstream'], self.abiname, arch, arch)) for arch in self.config['base',]['arches']])
-        packages['source']['Build-Depends'].append(l)
+        l = ['linux-headers-%s%s-all-%s [%s]' % (self.version['upstream'], self.abiname, arch, arch) for arch in self.config['base',]['arches']]
+        packages['source']['Build-Depends'].extend(l)
 
     def do_flavour_packages(self, packages, makefile, arch, subarch, flavour, vars, makeflags, extra):
         modules = self.templates["control.modules"]
diff --git a/debian/patches/2.6.16.1 b/debian/patches/2.6.16.1
new file mode 100644
index 000000000..fc61da876
--- /dev/null
+++ b/debian/patches/2.6.16.1
@@ -0,0 +1,449 @@
+diff --git a/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c b/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
+index 28cc5d5..cfc4276 100644
+--- a/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
++++ b/arch/i386/kernel/cpu/cpufreq/speedstep-smi.c
+@@ -75,7 +75,9 @@ static int speedstep_smi_ownership (void
+ 	__asm__ __volatile__(
+ 		"out %%al, (%%dx)\n"
+ 		: "=D" (result)
+-		: "a" (command), "b" (function), "c" (0), "d" (smi_port), "D" (0), "S" (magic)
++		: "a" (command), "b" (function), "c" (0), "d" (smi_port),
++			"D" (0), "S" (magic)
++		: "memory"
+ 	);
+ 
+ 	dprintk("result is %x\n", result);
+diff --git a/arch/i386/kernel/dmi_scan.c b/arch/i386/kernel/dmi_scan.c
+index 6a93d75..ca2a0cb 100644
+--- a/arch/i386/kernel/dmi_scan.c
++++ b/arch/i386/kernel/dmi_scan.c
+@@ -106,7 +106,7 @@ static void __init dmi_save_devices(stru
+ 	struct dmi_device *dev;
+ 
+ 	for (i = 0; i < count; i++) {
+-		char *d = ((char *) dm) + (i * 2);
++		char *d = (char *)(dm + 1) + (i * 2);
+ 
+ 		/* Skip disabled device */
+ 		if ((*d & 0x80) == 0)
+diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
+index 07a7f97..29f3d75 100644
+--- a/drivers/base/cpu.c
++++ b/drivers/base/cpu.c
+@@ -141,7 +141,7 @@ int __devinit register_cpu(struct cpu *c
+ 	return error;
+ }
+ 
+-struct sys_device *get_cpu_sysdev(int cpu)
++struct sys_device *get_cpu_sysdev(unsigned cpu)
+ {
+ 	if (cpu < NR_CPUS)
+ 		return cpu_sys_devices[cpu];
+diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
+index e97e911..4723182 100644
+--- a/drivers/base/firmware_class.c
++++ b/drivers/base/firmware_class.c
+@@ -211,18 +211,20 @@ static int
+ fw_realloc_buffer(struct firmware_priv *fw_priv, int min_size)
+ {
+ 	u8 *new_data;
++	int new_size = fw_priv->alloc_size;
+ 
+ 	if (min_size <= fw_priv->alloc_size)
+ 		return 0;
+ 
+-	new_data = vmalloc(fw_priv->alloc_size + PAGE_SIZE);
++	new_size = ALIGN(min_size, PAGE_SIZE);
++	new_data = vmalloc(new_size);
+ 	if (!new_data) {
+ 		printk(KERN_ERR "%s: unable to alloc buffer\n", __FUNCTION__);
+ 		/* Make sure that we don't keep incomplete data */
+ 		fw_load_abort(fw_priv);
+ 		return -ENOMEM;
+ 	}
+-	fw_priv->alloc_size += PAGE_SIZE;
++	fw_priv->alloc_size = new_size;
+ 	if (fw_priv->fw->data) {
+ 		memcpy(new_data, fw_priv->fw->data, fw_priv->fw->size);
+ 		vfree(fw_priv->fw->data);
+diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
+index 0d65394..c149d57 100644
+--- a/drivers/block/cciss.c
++++ b/drivers/block/cciss.c
+@@ -3269,8 +3269,8 @@ clean2:
+ 	unregister_blkdev(hba[i]->major, hba[i]->devname);
+ clean1:
+ 	release_io_mem(hba[i]);
+-	free_hba(i);
+ 	hba[i]->busy_initializing = 0;
++	free_hba(i);
+ 	return(-1);
+ }
+ 
+diff --git a/drivers/md/dm.c b/drivers/md/dm.c
+index 745ca1f..d559569 100644
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -533,30 +533,35 @@ static void __clone_and_map(struct clone
+ 
+ 	} else {
+ 		/*
+-		 * Create two copy bios to deal with io that has
+-		 * been split across a target.
++		 * Handle a bvec that must be split between two or more targets.
+ 		 */
+ 		struct bio_vec *bv = bio->bi_io_vec + ci->idx;
++		sector_t remaining = to_sector(bv->bv_len);
++		unsigned int offset = 0;
+ 
+-		clone = split_bvec(bio, ci->sector, ci->idx,
+-				   bv->bv_offset, max);
+-		__map_bio(ti, clone, tio);
+-
+-		ci->sector += max;
+-		ci->sector_count -= max;
+-		ti = dm_table_find_target(ci->map, ci->sector);
+-
+-		len = to_sector(bv->bv_len) - max;
+-		clone = split_bvec(bio, ci->sector, ci->idx,
+-				   bv->bv_offset + to_bytes(max), len);
+-		tio = alloc_tio(ci->md);
+-		tio->io = ci->io;
+-		tio->ti = ti;
+-		memset(&tio->info, 0, sizeof(tio->info));
+-		__map_bio(ti, clone, tio);
++		do {
++			if (offset) {
++				ti = dm_table_find_target(ci->map, ci->sector);
++				max = max_io_len(ci->md, ci->sector, ti);
++
++				tio = alloc_tio(ci->md);
++				tio->io = ci->io;
++				tio->ti = ti;
++				memset(&tio->info, 0, sizeof(tio->info));
++			}
++
++			len = min(remaining, max);
++
++			clone = split_bvec(bio, ci->sector, ci->idx,
++					   bv->bv_offset + offset, len);
++
++			__map_bio(ti, clone, tio);
++
++			ci->sector += len;
++			ci->sector_count -= len;
++			offset += to_bytes(len);
++		} while (remaining -= len);
+ 
+-		ci->sector += len;
+-		ci->sector_count -= len;
+ 		ci->idx++;
+ 	}
+ }
+diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
+index d82c8a3..ef42a26 100644
+--- a/drivers/media/video/Kconfig
++++ b/drivers/media/video/Kconfig
+@@ -349,6 +349,7 @@ config VIDEO_AUDIO_DECODER
+ config VIDEO_DECODER
+ 	tristate "Add support for additional video chipsets"
+ 	depends on VIDEO_DEV && I2C && EXPERIMENTAL
++	select FW_LOADER
+ 	---help---
+ 	  Say Y here to compile drivers for SAA7115, SAA7127 and CX25840
+ 	  video decoders.
+diff --git a/drivers/media/video/tuner-types.c b/drivers/media/video/tuner-types.c
+index 6fe7817..5f3d46d 100644
+--- a/drivers/media/video/tuner-types.c
++++ b/drivers/media/video/tuner-types.c
+@@ -1087,8 +1087,8 @@ static struct tuner_params tuner_tnf_533
+ /* ------------ TUNER_SAMSUNG_TCPN_2121P30A - Samsung NTSC ------------ */
+ 
+ static struct tuner_range tuner_samsung_tcpn_2121p30a_ntsc_ranges[] = {
+-	{ 16 * 175.75 /*MHz*/, 0x01, },
+-	{ 16 * 410.25 /*MHz*/, 0x02, },
++	{ 16 * 130.00 /*MHz*/, 0x01, },
++	{ 16 * 364.50 /*MHz*/, 0x02, },
+ 	{ 16 * 999.99        , 0x08, },
+ };
+ 
+diff --git a/drivers/scsi/sata_mv.c b/drivers/scsi/sata_mv.c
+index 2770005..b00af08 100644
+--- a/drivers/scsi/sata_mv.c
++++ b/drivers/scsi/sata_mv.c
+@@ -1102,6 +1102,7 @@ static u8 mv_get_crpb_status(struct ata_
+ 	void __iomem *port_mmio = mv_ap_base(ap);
+ 	struct mv_port_priv *pp = ap->private_data;
+ 	u32 out_ptr;
++	u8 ata_status;
+ 
+ 	out_ptr = readl(port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
+ 
+@@ -1109,6 +1110,8 @@ static u8 mv_get_crpb_status(struct ata_
+ 	assert(((out_ptr >> EDMA_RSP_Q_PTR_SHIFT) & MV_MAX_Q_DEPTH_MASK) ==
+ 	       pp->rsp_consumer);
+ 
++	ata_status = pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT;
++
+ 	/* increment our consumer index... */
+ 	pp->rsp_consumer = mv_inc_q_index(&pp->rsp_consumer);
+ 
+@@ -1123,7 +1126,7 @@ static u8 mv_get_crpb_status(struct ata_
+ 	writelfl(out_ptr, port_mmio + EDMA_RSP_Q_OUT_PTR_OFS);
+ 
+ 	/* Return ATA status register for completed CRPB */
+-	return (pp->crpb[pp->rsp_consumer].flags >> CRPB_FLAG_STATUS_SHIFT);
++	return ata_status;
+ }
+ 
+ /**
+@@ -1192,7 +1195,6 @@ static void mv_host_intr(struct ata_host
+ 	u32 hc_irq_cause;
+ 	int shift, port, port0, hard_port, handled;
+ 	unsigned int err_mask;
+-	u8 ata_status = 0;
+ 
+ 	if (hc == 0) {
+ 		port0 = 0;
+@@ -1210,6 +1212,7 @@ static void mv_host_intr(struct ata_host
+ 		hc,relevant,hc_irq_cause);
+ 
+ 	for (port = port0; port < port0 + MV_PORTS_PER_HC; port++) {
++		u8 ata_status = 0;
+ 		ap = host_set->ports[port];
+ 		hard_port = port & MV_PORT_MASK;	/* range 0-3 */
+ 		handled = 0;	/* ensure ata_status is set if handled++ */
+diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
+index d8467c0..788297e 100644
+--- a/drivers/video/i810/i810_main.c
++++ b/drivers/video/i810/i810_main.c
+@@ -1508,7 +1508,7 @@ static int i810fb_cursor(struct fb_info 
+ 		int size = ((cursor->image.width + 7) >> 3) *
+ 			cursor->image.height;
+ 		int i;
+-		u8 *data = kmalloc(64 * 8, GFP_KERNEL);
++		u8 *data = kmalloc(64 * 8, GFP_ATOMIC);
+ 
+ 		if (data == NULL)
+ 			return -ENOMEM;
+diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
+index 3ad8455..651a9e1 100644
+--- a/fs/9p/vfs_inode.c
++++ b/fs/9p/vfs_inode.c
+@@ -614,6 +614,7 @@ static struct dentry *v9fs_vfs_lookup(st
+ 
+ 	sb = dir->i_sb;
+ 	v9ses = v9fs_inode2v9ses(dir);
++	dentry->d_op = &v9fs_dentry_operations;
+ 	dirfid = v9fs_fid_lookup(dentry->d_parent);
+ 
+ 	if (!dirfid) {
+@@ -681,8 +682,6 @@ static struct dentry *v9fs_vfs_lookup(st
+ 		goto FreeFcall;
+ 
+ 	fid->qid = fcall->params.rstat.stat.qid;
+-
+-	dentry->d_op = &v9fs_dentry_operations;
+ 	v9fs_stat2inode(&fcall->params.rstat.stat, inode, inode->i_sb);
+ 
+ 	d_add(dentry, inode);
+diff --git a/fs/proc/proc_misc.c b/fs/proc/proc_misc.c
+index 1d24fea..826c131 100644
+--- a/fs/proc/proc_misc.c
++++ b/fs/proc/proc_misc.c
+@@ -312,7 +312,7 @@ static void *devinfo_next(struct seq_fil
+ 		case BLK_HDR:
+ 			info->state = BLK_LIST;
+ 			(*pos)++;
+-			break;
++			/*fallthrough*/
+ 		case BLK_LIST:
+ 			if (get_blkdev_info(info->blkdev,&idummy,&ndummy)) {
+ 				/*
+diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
+index 49bd219..cfd290d 100644
+--- a/fs/sysfs/dir.c
++++ b/fs/sysfs/dir.c
+@@ -302,6 +302,7 @@ void sysfs_remove_dir(struct kobject * k
+ 	 * Drop reference from dget() on entrance.
+ 	 */
+ 	dput(dentry);
++	kobj->dentry = NULL;
+ }
+ 
+ int sysfs_rename_dir(struct kobject * kobj, const char *new_name)
+diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c
+index 689f7bc..6beee6f 100644
+--- a/fs/sysfs/inode.c
++++ b/fs/sysfs/inode.c
+@@ -227,12 +227,16 @@ void sysfs_drop_dentry(struct sysfs_dire
+ void sysfs_hash_and_remove(struct dentry * dir, const char * name)
+ {
+ 	struct sysfs_dirent * sd;
+-	struct sysfs_dirent * parent_sd = dir->d_fsdata;
++	struct sysfs_dirent * parent_sd;
++
++	if (!dir)
++		return;
+ 
+ 	if (dir->d_inode == NULL)
+ 		/* no inode means this hasn't been made visible yet */
+ 		return;
+ 
++	parent_sd = dir->d_fsdata;
+ 	mutex_lock(&dir->d_inode->i_mutex);
+ 	list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
+ 		if (!sd->s_element)
+diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c
+index e38d633..e5ce6e7 100644
+--- a/fs/sysfs/symlink.c
++++ b/fs/sysfs/symlink.c
+@@ -66,6 +66,7 @@ static int sysfs_add_link(struct dentry 
+ 	if (!error)
+ 		return 0;
+ 
++	kobject_put(target);
+ 	kfree(sl->link_name);
+ exit2:
+ 	kfree(sl);
+diff --git a/fs/xfs/linux-2.6/xfs_aops.c b/fs/xfs/linux-2.6/xfs_aops.c
+index 74d8be8..a980736 100644
+--- a/fs/xfs/linux-2.6/xfs_aops.c
++++ b/fs/xfs/linux-2.6/xfs_aops.c
+@@ -616,7 +616,7 @@ xfs_is_delayed_page(
+ 				acceptable = (type == IOMAP_UNWRITTEN);
+ 			else if (buffer_delay(bh))
+ 				acceptable = (type == IOMAP_DELAY);
+-			else if (buffer_mapped(bh))
++			else if (buffer_dirty(bh) && buffer_mapped(bh))
+ 				acceptable = (type == 0);
+ 			else
+ 				break;
+diff --git a/include/linux/cpu.h b/include/linux/cpu.h
+index 0ed1d48..d612b89 100644
+--- a/include/linux/cpu.h
++++ b/include/linux/cpu.h
+@@ -32,7 +32,7 @@ struct cpu {
+ };
+ 
+ extern int register_cpu(struct cpu *, int, struct node *);
+-extern struct sys_device *get_cpu_sysdev(int cpu);
++extern struct sys_device *get_cpu_sysdev(unsigned cpu);
+ #ifdef CONFIG_HOTPLUG_CPU
+ extern void unregister_cpu(struct cpu *, struct node *);
+ #endif
+diff --git a/include/linux/raid/raid1.h b/include/linux/raid/raid1.h
+index 9d5494a..3009c81 100644
+--- a/include/linux/raid/raid1.h
++++ b/include/linux/raid/raid1.h
+@@ -130,6 +130,6 @@ struct r1bio_s {
+  * with failure when last write completes (and all failed).
+  * Record that bi_end_io was called with this flag...
+  */
+-#define	R1BIO_Returned 4
++#define	R1BIO_Returned 6
+ 
+ #endif
+diff --git a/include/linux/rtc.h b/include/linux/rtc.h
+index 0b2ba67..b739ac1 100644
+--- a/include/linux/rtc.h
++++ b/include/linux/rtc.h
+@@ -11,8 +11,6 @@
+ #ifndef _LINUX_RTC_H_
+ #define _LINUX_RTC_H_
+ 
+-#include <linux/interrupt.h>
+-
+ /*
+  * The struct used to pass data via the following ioctl. Similar to the
+  * struct tm in <time.h>, but it needs to be here so that the kernel 
+@@ -95,6 +93,8 @@ struct rtc_pll_info {
+ 
+ #ifdef __KERNEL__
+ 
++#include <linux/interrupt.h>
++
+ typedef struct rtc_task {
+ 	void (*func)(void *private_data);
+ 	void *private_data;
+diff --git a/kernel/sched.c b/kernel/sched.c
+index 4d46e90..4e7efac 100644
+--- a/kernel/sched.c
++++ b/kernel/sched.c
+@@ -237,6 +237,7 @@ struct runqueue {
+ 
+ 	task_t *migration_thread;
+ 	struct list_head migration_queue;
++	int cpu;
+ #endif
+ 
+ #ifdef CONFIG_SCHEDSTATS
+@@ -1660,6 +1661,9 @@ unsigned long nr_iowait(void)
+ /*
+  * double_rq_lock - safely lock two runqueues
+  *
++ * We must take them in cpu order to match code in
++ * dependent_sleeper and wake_dependent_sleeper.
++ *
+  * Note this does not disable interrupts like task_rq_lock,
+  * you need to do so manually before calling.
+  */
+@@ -1671,7 +1675,7 @@ static void double_rq_lock(runqueue_t *r
+ 		spin_lock(&rq1->lock);
+ 		__acquire(rq2->lock);	/* Fake it out ;) */
+ 	} else {
+-		if (rq1 < rq2) {
++		if (rq1->cpu < rq2->cpu) {
+ 			spin_lock(&rq1->lock);
+ 			spin_lock(&rq2->lock);
+ 		} else {
+@@ -1707,7 +1711,7 @@ static void double_lock_balance(runqueue
+ 	__acquires(this_rq->lock)
+ {
+ 	if (unlikely(!spin_trylock(&busiest->lock))) {
+-		if (busiest < this_rq) {
++		if (busiest->cpu < this_rq->cpu) {
+ 			spin_unlock(&this_rq->lock);
+ 			spin_lock(&busiest->lock);
+ 			spin_lock(&this_rq->lock);
+@@ -6035,6 +6039,7 @@ void __init sched_init(void)
+ 		rq->push_cpu = 0;
+ 		rq->migration_thread = NULL;
+ 		INIT_LIST_HEAD(&rq->migration_queue);
++		rq->cpu = i;
+ #endif
+ 		atomic_set(&rq->nr_iowait, 0);
+ 
+diff --git a/net/core/sock.c b/net/core/sock.c
+index 6e00811..5621198 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -404,8 +404,9 @@ set_rcvbuf:
+ 			if (!valbool) {
+ 				sk->sk_bound_dev_if = 0;
+ 			} else {
+-				if (optlen > IFNAMSIZ) 
+-					optlen = IFNAMSIZ; 
++				if (optlen > IFNAMSIZ - 1)
++					optlen = IFNAMSIZ - 1;
++				memset(devname, 0, sizeof(devname));
+ 				if (copy_from_user(devname, optval, optlen)) {
+ 					ret = -EFAULT;
+ 					break;
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 8ee4d01..f75ff1d 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1249,11 +1249,7 @@ int ip_push_pending_frames(struct sock *
+ 	iph->tos = inet->tos;
+ 	iph->tot_len = htons(skb->len);
+ 	iph->frag_off = df;
+-	if (!df) {
+-		__ip_select_ident(iph, &rt->u.dst, 0);
+-	} else {
+-		iph->id = htons(inet->id++);
+-	}
++	ip_select_ident(iph, &rt->u.dst, sk);
+ 	iph->ttl = ttl;
+ 	iph->protocol = sk->sk_protocol;
+ 	iph->saddr = rt->rt_src;
diff --git a/debian/patches/mips-sb1-duart-tts.patch b/debian/patches/mips-sb1-duart-tts.patch
new file mode 100644
index 000000000..a724d50e8
--- /dev/null
+++ b/debian/patches/mips-sb1-duart-tts.patch
@@ -0,0 +1,20 @@
+Patch: change the name of the sb1250 DUART from duart to ttyS
+Needed for debian-installer
+Status: the sb1250_duart.c driver needs a completely re-write...
+
+diff --git a/drivers/char/sb1250_duart.c b/drivers/char/sb1250_duart.c
+index 7819acc..57a227c 100644
+--- a/drivers/char/sb1250_duart.c
++++ b/drivers/char/sb1250_duart.c
+@@ -762,8 +762,8 @@ static int __init sb1250_duart_init(void
+ 		return -ENOMEM;
+ 
+ 	sb1250_duart_driver->owner = THIS_MODULE;
+-	sb1250_duart_driver->name = "duart";
+-	sb1250_duart_driver->devfs_name = "duart/";
++	sb1250_duart_driver->name = "ttyS";
++	sb1250_duart_driver->devfs_name = "tts/";
+ 	sb1250_duart_driver->major = TTY_MAJOR;
+ 	sb1250_duart_driver->minor_start = SB1250_DUART_MINOR_BASE;
+ 	sb1250_duart_driver->type            = TTY_DRIVER_TYPE_SERIAL;
+
diff --git a/debian/patches/mips-sb1-duart.patch b/debian/patches/mips-sb1-duart.patch
index 20932678f..00cba6f0e 100644
--- a/debian/patches/mips-sb1-duart.patch
+++ b/debian/patches/mips-sb1-duart.patch
@@ -812,8 +812,8 @@ diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
 +		return -ENOMEM;
 +
 +	sb1250_duart_driver->owner = THIS_MODULE;
-+	sb1250_duart_driver->name = "ttyS";
-+	sb1250_duart_driver->devfs_name = "tts/";
++	sb1250_duart_driver->name = "duart";
++	sb1250_duart_driver->devfs_name = "duart/";
 +	sb1250_duart_driver->major = TTY_MAJOR;
 +	sb1250_duart_driver->minor_start = SB1250_DUART_MINOR_BASE;
 +	sb1250_duart_driver->type            = TTY_DRIVER_TYPE_SERIAL;
diff --git a/debian/patches/series/4 b/debian/patches/series/4
new file mode 100644
index 000000000..dc52e44c7
--- /dev/null
+++ b/debian/patches/series/4
@@ -0,0 +1,2 @@
++ 2.6.16.1
++ mips-sb1-duart-tts.patch
diff --git a/debian/patches/vserver-vs2.0.2-rc13.patch b/debian/patches/vserver-vs2.0.2-rc13.patch
index 464766587..bcfa24ae4 100644
--- a/debian/patches/vserver-vs2.0.2-rc13.patch
+++ b/debian/patches/vserver-vs2.0.2-rc13.patch
@@ -13019,9 +13019,9 @@ index 4d46e90..545c80b 100644
  
  /*
   * Convert user-nice values [ -20 ... 0 ... 19 ]
-@@ -238,6 +241,10 @@ struct runqueue {
- 	task_t *migration_thread;
+@@ -238,6 +241,10 @@
  	struct list_head migration_queue;
+ 	int cpu;
  #endif
 +#ifdef CONFIG_VSERVER_HARDCPU
 +	struct list_head hold_queue;
diff --git a/debian/rules.real b/debian/rules.real
index 43d621828..3da553de2 100644
--- a/debian/rules.real
+++ b/debian/rules.real
@@ -66,6 +66,7 @@ endif
 #
 # Targets
 #
+binary-arch-arch: install-headers-all install-headers-$(ARCH)
 binary-arch-subarch: install-header-$(ARCH)-$(SUBARCH)
 binary-arch-flavour: install-image-$(ARCH)-$(SUBARCH)-$(FLAVOUR)-$(TYPE) install-header-$(ARCH)-$(SUBARCH)-$(FLAVOUR)
 
@@ -196,6 +197,13 @@ install-dummy:
 	dh_clean -d -k
 	$(MAKE) -f debian/rules.real install-base
 
+install-headers-$(ARCH): PACKAGE_NAMES = linux-headers-$(UPSTREAMVERSION)$(ABINAME)-all linux-headers-$(UPSTREAMVERSION)$(ABINAME)-all-$(ARCH)
+install-headers-$(ARCH): DH_OPTIONS = $(foreach p, $(PACKAGE_NAMES), -p$(p))
+install-headers-$(ARCH):
+	dh_testdir
+	dh_testroot
+	$(MAKE) -f debian/rules.real install-base GENCONTROL_ARGS='-Vkernel:Arch=$(ARCH)'
+
 install-header-$(ARCH)-$(SUBARCH): PACKAGE_NAME = linux-headers-$(UPSTREAMVERSION)$(ABINAME)$(LOCALVERSION_HEADERS)
 install-header-$(ARCH)-$(SUBARCH): DH_OPTIONS = -p$(PACKAGE_NAME)
 install-header-$(ARCH)-$(SUBARCH): BASE_DIR = /usr/src/$(PACKAGE_NAME)
@@ -303,9 +311,9 @@ install-headers-all:
 	dh_testdir
 	dh_testroot
 	chmod a+x debian/modules/gencontrol.py
-	dh_install $(DH_OPTIONS) debian/arch debian/lib debian/modules '/usr/src/linux-headers-$(VERSION)'
-	dh_python $(DH_OPTIONS) -V 2.4 /usr/src/linux-headers-$(VERSION)/lib/python
-	$(MAKE) -f debian/rules.real install-base DH_OPTIONS='$(DH_OPTIONS)' GENCONTROL_ARGS='$(GENCONTROL_ARGS) -Vkernel:Provides=linux-headers-$(UPSTREAMVERSION)$(ABINAME)-$(ARCH)'
+	dh_install debian/arch debian/lib debian/modules '/usr/src/linux-headers-$(VERSION)'
+	dh_python -V 2.4 /usr/src/linux-headers-$(VERSION)/lib/python
+	$(MAKE) -f debian/rules.real install-base
 
 install-image-$(ARCH)-$(SUBARCH)-$(FLAVOUR)-$(TYPE): REAL_VERSION = $(UPSTREAMVERSION)$(ABINAME)$(LOCALVERSION)
 install-image-$(ARCH)-$(SUBARCH)-$(FLAVOUR)-$(TYPE): PACKAGE_NAME = linux-image-$(REAL_VERSION)
diff --git a/debian/templates/control.headers.arch.in b/debian/templates/control.headers.arch.in
index a9061fca9..b2ccee9d4 100644
--- a/debian/templates/control.headers.arch.in
+++ b/debian/templates/control.headers.arch.in
@@ -1,9 +1,29 @@
 Package: linux-headers-@version@
 Section: devel
 Priority: optional
-Provides: linux-headers-@upstreamversion@@abiname@-all, linux-headers-@major@-all, ${kernel:Provides}
-Depends: ${kernel:Depends}
+Depends: python2.4-minimal
 Description: All header files for Linux kernel @version@
  This package depends against all architecture-specific kernel header files
  for Linux kernel version @upstreamversion@, generally used for building out-of-tree
  kernel modules.
+
+Package: linux-headers-@upstreamversion@@abiname@-all
+Section: devel
+Priority: optional
+Provides: linux-headers-@major@-all, linux-headers-@version@-all
+Depends: linux-headers-@upstreamversion@@abiname@-all-${kernel:Arch} (= ${Source-Version})
+Description: All header files for Linux kernel @version@
+ This package depends against all architecture-specific kernel header files
+ for Linux kernel version @upstreamversion@, generally used for building out-of-tree
+ kernel modules.
+
+Package: linux-headers-@upstreamversion@@abiname@-all-@arch@
+Section: devel
+Priority: optional
+Provides: linux-headers-@major@-all-@arch@, linux-headers-@version@-all-@arch@
+Depends: linux-headers-@version@ (= ${Source-Version})
+Description: All header files for Linux kernel @version@
+ This package depends against all architecture-specific kernel header files
+ for Linux kernel version @upstreamversion@, generally used for building out-of-tree
+ kernel modules.
+