Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-2.6.20-r6/0104-2.6.20.4-all-fixes.patch

    Annotation of /trunk/kernel26-alx/patches-2.6.20-r6/0104-2.6.20.4-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1175 - (hide annotations) (download)
    Thu Oct 14 12:15:46 2010 UTC (13 years, 7 months ago) by niro
    File size: 40400 byte(s) 
    -2.6.20-alx-r6 new magellan 0.5.2 kernel
    1 niro 1175 diff --git a/arch/ia64/kernel/iosapic.c b/arch/ia64/kernel/iosapic.c
    2     index 0fc5fb7..02479e1 100644
    3     --- a/arch/ia64/kernel/iosapic.c
    4     +++ b/arch/ia64/kernel/iosapic.c
    5     @@ -446,7 +446,7 @@ iosapic_end_level_irq (unsigned int irq)
    6     #define iosapic_disable_level_irq mask_irq
    7     #define iosapic_ack_level_irq nop
    8    
    9     -struct hw_interrupt_type irq_type_iosapic_level = {
    10     +struct irq_chip irq_type_iosapic_level = {
    11     .name = "IO-SAPIC-level",
    12     .startup = iosapic_startup_level_irq,
    13     .shutdown = iosapic_shutdown_level_irq,
    14     @@ -454,6 +454,8 @@ struct hw_interrupt_type irq_type_iosapic_level = {
    15     .disable = iosapic_disable_level_irq,
    16     .ack = iosapic_ack_level_irq,
    17     .end = iosapic_end_level_irq,
    18     + .mask = mask_irq,
    19     + .unmask = unmask_irq,
    20     .set_affinity = iosapic_set_affinity
    21     };
    22    
    23     @@ -493,7 +495,7 @@ iosapic_ack_edge_irq (unsigned int irq)
    24     #define iosapic_disable_edge_irq nop
    25     #define iosapic_end_edge_irq nop
    26    
    27     -struct hw_interrupt_type irq_type_iosapic_edge = {
    28     +struct irq_chip irq_type_iosapic_edge = {
    29     .name = "IO-SAPIC-edge",
    30     .startup = iosapic_startup_edge_irq,
    31     .shutdown = iosapic_disable_edge_irq,
    32     @@ -501,6 +503,8 @@ struct hw_interrupt_type irq_type_iosapic_edge = {
    33     .disable = iosapic_disable_edge_irq,
    34     .ack = iosapic_ack_edge_irq,
    35     .end = iosapic_end_edge_irq,
    36     + .mask = mask_irq,
    37     + .unmask = unmask_irq,
    38     .set_affinity = iosapic_set_affinity
    39     };
    40    
    41     diff --git a/arch/ia64/sn/kernel/irq.c b/arch/ia64/sn/kernel/irq.c
    42     index 8c5bee0..8d2a1bf 100644
    43     --- a/arch/ia64/sn/kernel/irq.c
    44     +++ b/arch/ia64/sn/kernel/irq.c
    45     @@ -205,7 +205,17 @@ static void sn_set_affinity_irq(unsigned int irq, cpumask_t mask)
    46     (void)sn_retarget_vector(sn_irq_info, nasid, slice);
    47     }
    48    
    49     -struct hw_interrupt_type irq_type_sn = {
    50     +static void
    51     +sn_mask_irq(unsigned int irq)
    52     +{
    53     +}
    54     +
    55     +static void
    56     +sn_unmask_irq(unsigned int irq)
    57     +{
    58     +}
    59     +
    60     +struct irq_chip irq_type_sn = {
    61     .name = "SN hub",
    62     .startup = sn_startup_irq,
    63     .shutdown = sn_shutdown_irq,
    64     @@ -213,6 +223,8 @@ struct hw_interrupt_type irq_type_sn = {
    65     .disable = sn_disable_irq,
    66     .ack = sn_ack_irq,
    67     .end = sn_end_irq,
    68     + .mask = sn_mask_irq,
    69     + .unmask = sn_unmask_irq,
    70     .set_affinity = sn_set_affinity_irq
    71     };
    72    
    73     diff --git a/arch/sparc64/kernel/ktlb.S b/arch/sparc64/kernel/ktlb.S
    74     index e492db8..d4024ac 100644
    75     --- a/arch/sparc64/kernel/ktlb.S
    76     +++ b/arch/sparc64/kernel/ktlb.S
    77     @@ -138,9 +138,15 @@ kvmap_dtlb_4v:
    78     brgez,pn %g4, kvmap_dtlb_nonlinear
    79     nop
    80    
    81     +#ifdef CONFIG_DEBUG_PAGEALLOC
    82     + /* Index through the base page size TSB even for linear
    83     + * mappings when using page allocation debugging.
    84     + */
    85     + KERN_TSB_LOOKUP_TL1(%g4, %g6, %g5, %g1, %g2, %g3, kvmap_dtlb_load)
    86     +#else
    87     /* Correct TAG_TARGET is already in %g6, check 4mb TSB. */
    88     KERN_TSB4M_LOOKUP_TL1(%g6, %g5, %g1, %g2, %g3, kvmap_dtlb_load)
    89     -
    90     +#endif
    91     /* TSB entry address left in %g1, lookup linear PTE.
    92     * Must preserve %g1 and %g6 (TAG).
    93     */
    94     diff --git a/arch/sparc64/kernel/tsb.S b/arch/sparc64/kernel/tsb.S
    95     index eedf94f..10adb2f 100644
    96     --- a/arch/sparc64/kernel/tsb.S
    97     +++ b/arch/sparc64/kernel/tsb.S
    98     @@ -546,6 +546,7 @@ NGtsb_init:
    99     subcc %o1, 0x100, %o1
    100     bne,pt %xcc, 1b
    101     add %o0, 0x100, %o0
    102     + membar #Sync
    103     retl
    104     wr %g2, 0x0, %asi
    105     .size NGtsb_init, .-NGtsb_init
    106     diff --git a/arch/sparc64/lib/NGbzero.S b/arch/sparc64/lib/NGbzero.S
    107     index e86baec..f10e452 100644
    108     --- a/arch/sparc64/lib/NGbzero.S
    109     +++ b/arch/sparc64/lib/NGbzero.S
    110     @@ -88,6 +88,7 @@ NGbzero_loop:
    111     bne,pt %xcc, NGbzero_loop
    112     add %o0, 64, %o0
    113    
    114     + membar #Sync
    115     wr %o4, 0x0, %asi
    116     brz,pn %o1, NGbzero_done
    117     NGbzero_medium:
    118     diff --git a/arch/sparc64/lib/NGmemcpy.S b/arch/sparc64/lib/NGmemcpy.S
    119     index 8e522b3..66063a9 100644
    120     --- a/arch/sparc64/lib/NGmemcpy.S
    121     +++ b/arch/sparc64/lib/NGmemcpy.S
    122     @@ -247,6 +247,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
    123     /* fall through */
    124    
    125     60:
    126     + membar #Sync
    127     +
    128     /* %o2 contains any final bytes still needed to be copied
    129     * over. If anything is left, we copy it one byte at a time.
    130     */
    131     diff --git a/arch/sparc64/lib/NGpage.S b/arch/sparc64/lib/NGpage.S
    132     index 7d7c3bb..8ce3a0c 100644
    133     --- a/arch/sparc64/lib/NGpage.S
    134     +++ b/arch/sparc64/lib/NGpage.S
    135     @@ -41,6 +41,7 @@ NGcopy_user_page: /* %o0=dest, %o1=src, %o2=vaddr */
    136     subcc %g7, 64, %g7
    137     bne,pt %xcc, 1b
    138     add %o0, 32, %o0
    139     + membar #Sync
    140     retl
    141     nop
    142    
    143     @@ -63,6 +64,7 @@ NGclear_user_page: /* %o0=dest, %o1=vaddr */
    144     subcc %g7, 64, %g7
    145     bne,pt %xcc, 1b
    146     add %o0, 32, %o0
    147     + membar #Sync
    148     retl
    149     nop
    150    
    151     diff --git a/arch/sparc64/mm/hugetlbpage.c b/arch/sparc64/mm/hugetlbpage.c
    152     index 33fd0b2..00677b5 100644
    153     --- a/arch/sparc64/mm/hugetlbpage.c
    154     +++ b/arch/sparc64/mm/hugetlbpage.c
    155     @@ -248,6 +248,7 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
    156     if (!pte_present(*ptep) && pte_present(entry))
    157     mm->context.huge_pte_count++;
    158    
    159     + addr &= HPAGE_MASK;
    160     for (i = 0; i < (1 << HUGETLB_PAGE_ORDER); i++) {
    161     set_pte_at(mm, addr, ptep, entry);
    162     ptep++;
    163     @@ -266,6 +267,8 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
    164     if (pte_present(entry))
    165     mm->context.huge_pte_count--;
    166    
    167     + addr &= HPAGE_MASK;
    168     +
    169     for (i = 0; i < (1 << HUGETLB_PAGE_ORDER); i++) {
    170     pte_clear(mm, addr, ptep);
    171     addr += PAGE_SIZE;
    172     diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c
    173     index 054822a..5391cd5 100644
    174     --- a/arch/sparc64/mm/init.c
    175     +++ b/arch/sparc64/mm/init.c
    176     @@ -59,8 +59,10 @@ unsigned long kern_linear_pte_xor[2] __read_mostly;
    177     */
    178     unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
    179    
    180     +#ifndef CONFIG_DEBUG_PAGEALLOC
    181     /* A special kernel TSB for 4MB and 256MB linear mappings. */
    182     struct tsb swapper_4m_tsb[KERNEL_TSB4M_NENTRIES];
    183     +#endif
    184    
    185     #define MAX_BANKS 32
    186    
    187     @@ -1301,7 +1303,12 @@ static void __init tsb_phys_patch(void)
    188     }
    189    
    190     /* Don't mark as init, we give this to the Hypervisor. */
    191     -static struct hv_tsb_descr ktsb_descr[2];
    192     +#ifndef CONFIG_DEBUG_PAGEALLOC
    193     +#define NUM_KTSB_DESCR 2
    194     +#else
    195     +#define NUM_KTSB_DESCR 1
    196     +#endif
    197     +static struct hv_tsb_descr ktsb_descr[NUM_KTSB_DESCR];
    198     extern struct tsb swapper_tsb[KERNEL_TSB_NENTRIES];
    199    
    200     static void __init sun4v_ktsb_init(void)
    201     @@ -1340,6 +1347,7 @@ static void __init sun4v_ktsb_init(void)
    202     ktsb_descr[0].tsb_base = ktsb_pa;
    203     ktsb_descr[0].resv = 0;
    204    
    205     +#ifndef CONFIG_DEBUG_PAGEALLOC
    206     /* Second KTSB for 4MB/256MB mappings. */
    207     ktsb_pa = (kern_base +
    208     ((unsigned long)&swapper_4m_tsb[0] - KERNBASE));
    209     @@ -1352,6 +1360,7 @@ static void __init sun4v_ktsb_init(void)
    210     ktsb_descr[1].ctx_idx = 0;
    211     ktsb_descr[1].tsb_base = ktsb_pa;
    212     ktsb_descr[1].resv = 0;
    213     +#endif
    214     }
    215    
    216     void __cpuinit sun4v_ktsb_register(void)
    217     @@ -1364,7 +1373,7 @@ void __cpuinit sun4v_ktsb_register(void)
    218     pa = kern_base + ((unsigned long)&ktsb_descr[0] - KERNBASE);
    219    
    220     func = HV_FAST_MMU_TSB_CTX0;
    221     - arg0 = 2;
    222     + arg0 = NUM_KTSB_DESCR;
    223     arg1 = pa;
    224     __asm__ __volatile__("ta %6"
    225     : "=&r" (func), "=&r" (arg0), "=&r" (arg1)
    226     @@ -1393,7 +1402,9 @@ void __init paging_init(void)
    227    
    228     /* Invalidate both kernel TSBs. */
    229     memset(swapper_tsb, 0x40, sizeof(swapper_tsb));
    230     +#ifndef CONFIG_DEBUG_PAGEALLOC
    231     memset(swapper_4m_tsb, 0x40, sizeof(swapper_4m_tsb));
    232     +#endif
    233    
    234     if (tlb_type == hypervisor)
    235     sun4v_pgprot_init();
    236     @@ -1725,8 +1736,13 @@ static void __init sun4u_pgprot_init(void)
    237     pg_iobits = (_PAGE_VALID | _PAGE_PRESENT_4U | __DIRTY_BITS_4U |
    238     __ACCESS_BITS_4U | _PAGE_E_4U);
    239    
    240     +#ifdef CONFIG_DEBUG_PAGEALLOC
    241     + kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZBITS_4U) ^
    242     + 0xfffff80000000000;
    243     +#else
    244     kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZ4MB_4U) ^
    245     0xfffff80000000000;
    246     +#endif
    247     kern_linear_pte_xor[0] |= (_PAGE_CP_4U | _PAGE_CV_4U |
    248     _PAGE_P_4U | _PAGE_W_4U);
    249    
    250     @@ -1769,13 +1785,23 @@ static void __init sun4v_pgprot_init(void)
    251     _PAGE_E = _PAGE_E_4V;
    252     _PAGE_CACHE = _PAGE_CACHE_4V;
    253    
    254     +#ifdef CONFIG_DEBUG_PAGEALLOC
    255     + kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZBITS_4V) ^
    256     + 0xfffff80000000000;
    257     +#else
    258     kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZ4MB_4V) ^
    259     0xfffff80000000000;
    260     +#endif
    261     kern_linear_pte_xor[0] |= (_PAGE_CP_4V | _PAGE_CV_4V |
    262     _PAGE_P_4V | _PAGE_W_4V);
    263    
    264     +#ifdef CONFIG_DEBUG_PAGEALLOC
    265     + kern_linear_pte_xor[1] = (_PAGE_VALID | _PAGE_SZBITS_4V) ^
    266     + 0xfffff80000000000;
    267     +#else
    268     kern_linear_pte_xor[1] = (_PAGE_VALID | _PAGE_SZ256MB_4V) ^
    269     0xfffff80000000000;
    270     +#endif
    271     kern_linear_pte_xor[1] |= (_PAGE_CP_4V | _PAGE_CV_4V |
    272     _PAGE_P_4V | _PAGE_W_4V);
    273    
    274     diff --git a/arch/um/include/os.h b/arch/um/include/os.h
    275     index 13a86bd..4e9a13e 100644
    276     --- a/arch/um/include/os.h
    277     +++ b/arch/um/include/os.h
    278     @@ -341,4 +341,6 @@ extern void maybe_sigio_broken(int fd, int read);
    279     extern void sig_handler_common_skas(int sig, void *sc_ptr);
    280     extern void user_signal(int sig, union uml_pt_regs *regs, int pid);
    281    
    282     +extern int os_arch_prctl(int pid, int code, unsigned long *addr);
    283     +
    284     #endif
    285     diff --git a/arch/um/os-Linux/sys-x86_64/Makefile b/arch/um/os-Linux/sys-x86_64/Makefile
    286     index f67842a..7955e06 100644
    287     --- a/arch/um/os-Linux/sys-x86_64/Makefile
    288     +++ b/arch/um/os-Linux/sys-x86_64/Makefile
    289     @@ -3,7 +3,7 @@
    290     # Licensed under the GPL
    291     #
    292    
    293     -obj-$(CONFIG_MODE_SKAS) = registers.o signal.o
    294     +obj-$(CONFIG_MODE_SKAS) = registers.o prctl.o signal.o
    295    
    296     USER_OBJS := $(obj-y)
    297    
    298     diff --git a/arch/um/os-Linux/sys-x86_64/prctl.c b/arch/um/os-Linux/sys-x86_64/prctl.c
    299     new file mode 100644
    300     index 0000000..79c278a
    301     --- /dev/null
    302     +++ b/arch/um/os-Linux/sys-x86_64/prctl.c
    303     @@ -0,0 +1,12 @@
    304     +/*
    305     + * Copyright (C) 2007 Jeff Dike (jdike@{addtoit.com,linux.intel.com})
    306     + * Licensed under the GPL
    307     + */
    308     +
    309     +#include <sys/ptrace.h>
    310     +#include <linux/ptrace.h>
    311     +
    312     +int os_arch_prctl(int pid, int code, unsigned long *addr)
    313     +{
    314     + return ptrace(PTRACE_ARCH_PRCTL, pid, (unsigned long) addr, code);
    315     +}
    316     diff --git a/arch/um/sys-x86_64/syscalls.c b/arch/um/sys-x86_64/syscalls.c
    317     index 73ce446..6d5605b 100644
    318     --- a/arch/um/sys-x86_64/syscalls.c
    319     +++ b/arch/um/sys-x86_64/syscalls.c
    320     @@ -16,6 +16,7 @@
    321     #include "asm/prctl.h" /* XXX This should get the constants from libc */
    322     #include "choose-mode.h"
    323     #include "kern.h"
    324     +#include "os.h"
    325    
    326     asmlinkage long sys_uname64(struct new_utsname __user * name)
    327     {
    328     @@ -58,40 +59,70 @@ static long arch_prctl_tt(int code, unsigned long addr)
    329    
    330     #ifdef CONFIG_MODE_SKAS
    331    
    332     -/* XXX: Must also call arch_prctl in the host, beside saving the segment bases! */
    333     -static long arch_prctl_skas(int code, unsigned long addr)
    334     +static long arch_prctl_skas(int code, unsigned long __user *addr)
    335     {
    336     - long ret = 0;
    337     + unsigned long *ptr = addr, tmp;
    338     + long ret;
    339     + int pid = current->mm->context.skas.id.u.pid;
    340     +
    341     + /*
    342     + * With ARCH_SET_FS (and ARCH_SET_GS is treated similarly to
    343     + * be safe), we need to call arch_prctl on the host because
    344     + * setting %fs may result in something else happening (like a
    345     + * GDT being set instead). So, we let the host fiddle the
    346     + * registers and restore them afterwards.
    347     + *
    348     + * So, the saved registers are stored to the process (this
    349     + * needed because a stub may have been the last thing to run),
    350     + * arch_prctl is run on the host, then the registers are read
    351     + * back.
    352     + */
    353     + switch(code){
    354     + case ARCH_SET_FS:
    355     + case ARCH_SET_GS:
    356     + restore_registers(pid, &current->thread.regs.regs);
    357     + break;
    358     + case ARCH_GET_FS:
    359     + case ARCH_GET_GS:
    360     + /*
    361     + * With these two, we read to a local pointer and
    362     + * put_user it to the userspace pointer that we were
    363     + * given. If addr isn't valid (because it hasn't been
    364     + * faulted in or is just bogus), we want put_user to
    365     + * fault it in (or return -EFAULT) instead of having
    366     + * the host return -EFAULT.
    367     + */
    368     + ptr = &tmp;
    369     + }
    370     +
    371     + ret = os_arch_prctl(pid, code, ptr);
    372     + if(ret)
    373     + return ret;
    374    
    375     switch(code){
    376     case ARCH_SET_FS:
    377     - current->thread.regs.regs.skas.regs[FS_BASE / sizeof(unsigned long)] = addr;
    378     + current->thread.arch.fs = (unsigned long) ptr;
    379     + save_registers(pid, &current->thread.regs.regs);
    380     break;
    381     case ARCH_SET_GS:
    382     - current->thread.regs.regs.skas.regs[GS_BASE / sizeof(unsigned long)] = addr;
    383     + save_registers(pid, &current->thread.regs.regs);
    384     break;
    385     case ARCH_GET_FS:
    386     - ret = put_user(current->thread.regs.regs.skas.
    387     - regs[FS_BASE / sizeof(unsigned long)],
    388     - (unsigned long __user *)addr);
    389     - break;
    390     + ret = put_user(tmp, addr);
    391     + break;
    392     case ARCH_GET_GS:
    393     - ret = put_user(current->thread.regs.regs.skas.
    394     - regs[GS_BASE / sizeof(unsigned long)],
    395     - (unsigned long __user *)addr);
    396     - break;
    397     - default:
    398     - ret = -EINVAL;
    399     + ret = put_user(tmp, addr);
    400     break;
    401     }
    402    
    403     - return(ret);
    404     + return ret;
    405     }
    406     #endif
    407    
    408     long sys_arch_prctl(int code, unsigned long addr)
    409     {
    410     - return(CHOOSE_MODE_PROC(arch_prctl_tt, arch_prctl_skas, code, addr));
    411     + return CHOOSE_MODE_PROC(arch_prctl_tt, arch_prctl_skas, code,
    412     + (unsigned long __user *) addr);
    413     }
    414    
    415     long sys_clone(unsigned long clone_flags, unsigned long newsp,
    416     @@ -105,5 +136,14 @@ long sys_clone(unsigned long clone_flags, unsigned long newsp,
    417     ret = do_fork(clone_flags, newsp, &current->thread.regs, 0, parent_tid,
    418     child_tid);
    419     current->thread.forking = 0;
    420     - return(ret);
    421     + return ret;
    422     }
    423     +
    424     +void arch_switch_to_skas(struct task_struct *from, struct task_struct *to)
    425     +{
    426     + if((to->thread.arch.fs == 0) || (to->mm == NULL))
    427     + return;
    428     +
    429     + arch_prctl_skas(ARCH_SET_FS, (void __user *) to->thread.arch.fs);
    430     +}
    431     +
    432     diff --git a/arch/um/sys-x86_64/tls.c b/arch/um/sys-x86_64/tls.c
    433     index ce1bf1b..febbc94 100644
    434     --- a/arch/um/sys-x86_64/tls.c
    435     +++ b/arch/um/sys-x86_64/tls.c
    436     @@ -1,14 +1,17 @@
    437     #include "linux/sched.h"
    438    
    439     -void debug_arch_force_load_TLS(void)
    440     -{
    441     -}
    442     -
    443     void clear_flushed_tls(struct task_struct *task)
    444     {
    445     }
    446    
    447     int arch_copy_tls(struct task_struct *t)
    448     {
    449     + /*
    450     + * If CLONE_SETTLS is set, we need to save the thread id
    451     + * (which is argument 5, child_tid, of clone) so it can be set
    452     + * during context switches.
    453     + */
    454     + t->thread.arch.fs = t->thread.regs.regs.skas.regs[R8 / sizeof(long)];
    455     +
    456     return 0;
    457     }
    458     diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
    459     index debe944..3b12996 100644
    460     --- a/drivers/input/serio/i8042.c
    461     +++ b/drivers/input/serio/i8042.c
    462     @@ -371,7 +371,7 @@ static irqreturn_t i8042_interrupt(int irq, void *dev_id)
    463     if (unlikely(i8042_suppress_kbd_ack))
    464     if (port_no == I8042_KBD_PORT_NO &&
    465     (data == 0xfa || data == 0xfe)) {
    466     - i8042_suppress_kbd_ack = 0;
    467     + i8042_suppress_kbd_ack--;
    468     goto out;
    469     }
    470    
    471     @@ -543,6 +543,7 @@ static int __devinit i8042_check_aux(void)
    472     {
    473     int retval = -1;
    474     int irq_registered = 0;
    475     + int aux_loop_broken = 0;
    476     unsigned long flags;
    477     unsigned char param;
    478    
    479     @@ -559,7 +560,8 @@ static int __devinit i8042_check_aux(void)
    480     */
    481    
    482     param = 0x5a;
    483     - if (i8042_command(&param, I8042_CMD_AUX_LOOP) || param != 0x5a) {
    484     + retval = i8042_command(&param, I8042_CMD_AUX_LOOP);
    485     + if (retval || param != 0x5a) {
    486    
    487     /*
    488     * External connection test - filters out AT-soldered PS/2 i8042's
    489     @@ -572,6 +574,13 @@ static int __devinit i8042_check_aux(void)
    490     if (i8042_command(&param, I8042_CMD_AUX_TEST) ||
    491     (param && param != 0xfa && param != 0xff))
    492     return -1;
    493     +
    494     +/*
    495     + * If AUX_LOOP completed without error but returned unexpected data
    496     + * mark it as broken
    497     + */
    498     + if (!retval)
    499     + aux_loop_broken = 1;
    500     }
    501    
    502     /*
    503     @@ -595,7 +604,7 @@ static int __devinit i8042_check_aux(void)
    504     * used it for a PCI card or somethig else.
    505     */
    506    
    507     - if (i8042_noloop) {
    508     + if (i8042_noloop || aux_loop_broken) {
    509     /*
    510     * Without LOOP command we can't test AUX IRQ delivery. Assume the port
    511     * is working and hope we are right.
    512     @@ -838,13 +847,14 @@ static long i8042_panic_blink(long count)
    513     led ^= 0x01 | 0x04;
    514     while (i8042_read_status() & I8042_STR_IBF)
    515     DELAY;
    516     - i8042_suppress_kbd_ack = 1;
    517     + dbg("%02x -> i8042 (panic blink)", 0xed);
    518     + i8042_suppress_kbd_ack = 2;
    519     i8042_write_data(0xed); /* set leds */
    520     DELAY;
    521     while (i8042_read_status() & I8042_STR_IBF)
    522     DELAY;
    523     DELAY;
    524     - i8042_suppress_kbd_ack = 1;
    525     + dbg("%02x -> i8042 (panic blink)", led);
    526     i8042_write_data(led);
    527     DELAY;
    528     last_blink = count;
    529     diff --git a/drivers/md/linear.c b/drivers/md/linear.c
    530     index c625ddb..d5ecd2d 100644
    531     --- a/drivers/md/linear.c
    532     +++ b/drivers/md/linear.c
    533     @@ -188,7 +188,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
    534     for (i=0; i < cnt-1 ; i++) {
    535     sector_t sz = 0;
    536     int j;
    537     - for (j=i; i<cnt-1 && sz < min_spacing ; j++)
    538     + for (j = i; j < cnt - 1 && sz < min_spacing; j++)
    539     sz += conf->disks[j].size;
    540     if (sz >= min_spacing && sz < conf->hash_spacing)
    541     conf->hash_spacing = sz;
    542     diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
    543     index 577babd..1aafa71 100644
    544     --- a/drivers/net/r8169.c
    545     +++ b/drivers/net/r8169.c
    546     @@ -1369,11 +1369,7 @@ static inline void rtl8169_request_timer(struct net_device *dev)
    547     (tp->phy_version >= RTL_GIGA_PHY_VER_H))
    548     return;
    549    
    550     - init_timer(timer);
    551     - timer->expires = jiffies + RTL8169_PHY_TIMEOUT;
    552     - timer->data = (unsigned long)(dev);
    553     - timer->function = rtl8169_phy_timer;
    554     - add_timer(timer);
    555     + mod_timer(timer, jiffies + RTL8169_PHY_TIMEOUT);
    556     }
    557    
    558     #ifdef CONFIG_NET_POLL_CONTROLLER
    559     @@ -1686,6 +1682,10 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
    560     tp->mmio_addr = ioaddr;
    561     tp->align = rtl_cfg_info[ent->driver_data].align;
    562    
    563     + init_timer(&tp->timer);
    564     + tp->timer.data = (unsigned long) dev;
    565     + tp->timer.function = rtl8169_phy_timer;
    566     +
    567     spin_lock_init(&tp->lock);
    568    
    569     rc = register_netdev(dev);
    570     diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
    571     index 0e0401d..0252ef9 100644
    572     --- a/drivers/pci/probe.c
    573     +++ b/drivers/pci/probe.c
    574     @@ -639,7 +639,34 @@ static void pci_read_irq(struct pci_dev *dev)
    575     dev->irq = irq;
    576     }
    577    
    578     -#define LEGACY_IO_RESOURCE (IORESOURCE_IO | IORESOURCE_PCI_FIXED)
    579     +static void change_legacy_io_resource(struct pci_dev * dev, unsigned index,
    580     + unsigned start, unsigned end)
    581     +{
    582     + unsigned base = start & PCI_BASE_ADDRESS_IO_MASK;
    583     + unsigned len = (end | ~PCI_BASE_ADDRESS_IO_MASK) - base + 1;
    584     +
    585     + /*
    586     + * Some X versions get confused when the BARs reported through
    587     + * /sys or /proc differ from those seen in config space, thus
    588     + * try to update the config space values, too.
    589     + */
    590     + if (!(pci_resource_flags(dev, index) & IORESOURCE_IO))
    591     + printk(KERN_WARNING "%s: cannot adjust BAR%u (not I/O)\n",
    592     + pci_name(dev), index);
    593     + else if (pci_resource_len(dev, index) != len)
    594     + printk(KERN_WARNING "%s: cannot adjust BAR%u (size %04X)\n",
    595     + pci_name(dev), index, (unsigned)pci_resource_len(dev, index));
    596     + else {
    597     + printk(KERN_INFO "%s: trying to change BAR%u from %04X to %04X\n",
    598     + pci_name(dev), index,
    599     + (unsigned)pci_resource_start(dev, index), base);
    600     + pci_write_config_dword(dev, PCI_BASE_ADDRESS_0 + index * 4, base);
    601     + }
    602     + pci_resource_start(dev, index) = start;
    603     + pci_resource_end(dev, index) = end;
    604     + pci_resource_flags(dev, index) =
    605     + IORESOURCE_IO | IORESOURCE_PCI_FIXED | PCI_BASE_ADDRESS_SPACE_IO;
    606     +}
    607    
    608     /**
    609     * pci_setup_device - fill in class and map information of a device
    610     @@ -692,20 +719,12 @@ static int pci_setup_device(struct pci_dev * dev)
    611     u8 progif;
    612     pci_read_config_byte(dev, PCI_CLASS_PROG, &progif);
    613     if ((progif & 1) == 0) {
    614     - dev->resource[0].start = 0x1F0;
    615     - dev->resource[0].end = 0x1F7;
    616     - dev->resource[0].flags = LEGACY_IO_RESOURCE;
    617     - dev->resource[1].start = 0x3F6;
    618     - dev->resource[1].end = 0x3F6;
    619     - dev->resource[1].flags = LEGACY_IO_RESOURCE;
    620     + change_legacy_io_resource(dev, 0, 0x1F0, 0x1F7);
    621     + change_legacy_io_resource(dev, 1, 0x3F6, 0x3F6);
    622     }
    623     if ((progif & 4) == 0) {
    624     - dev->resource[2].start = 0x170;
    625     - dev->resource[2].end = 0x177;
    626     - dev->resource[2].flags = LEGACY_IO_RESOURCE;
    627     - dev->resource[3].start = 0x376;
    628     - dev->resource[3].end = 0x376;
    629     - dev->resource[3].flags = LEGACY_IO_RESOURCE;
    630     + change_legacy_io_resource(dev, 2, 0x170, 0x177);
    631     + change_legacy_io_resource(dev, 3, 0x376, 0x376);
    632     }
    633     }
    634     break;
    635     diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
    636     index 4c698a7..df10267 100644
    637     --- a/drivers/scsi/gdth.c
    638     +++ b/drivers/scsi/gdth.c
    639     @@ -3092,6 +3092,7 @@ static int gdth_fill_raw_cmd(int hanum,Scsi_Cmnd *scp,unchar b)
    640     cmdp->u.raw64.direction =
    641     gdth_direction_tab[scp->cmnd[0]]==DOU ? GDTH_DATA_OUT:GDTH_DATA_IN;
    642     memcpy(cmdp->u.raw64.cmd,scp->cmnd,16);
    643     + cmdp->u.raw64.sg_ranz = 0;
    644     } else {
    645     cmdp->u.raw.reserved = 0;
    646     cmdp->u.raw.mdisc_time = 0;
    647     @@ -3108,6 +3109,7 @@ static int gdth_fill_raw_cmd(int hanum,Scsi_Cmnd *scp,unchar b)
    648     cmdp->u.raw.direction =
    649     gdth_direction_tab[scp->cmnd[0]]==DOU ? GDTH_DATA_OUT:GDTH_DATA_IN;
    650     memcpy(cmdp->u.raw.cmd,scp->cmnd,12);
    651     + cmdp->u.raw.sg_ranz = 0;
    652     }
    653    
    654     if (scp->use_sg) {
    655     diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
    656     index 488ec79..16e279b 100644
    657     --- a/drivers/scsi/st.c
    658     +++ b/drivers/scsi/st.c
    659     @@ -9,7 +9,7 @@
    660     Steve Hirsch, Andreas Koppenh"ofer, Michael Leodolter, Eyal Lebedinsky,
    661     Michael Schaefer, J"org Weule, and Eric Youngdale.
    662    
    663     - Copyright 1992 - 2006 Kai Makisara
    664     + Copyright 1992 - 2007 Kai Makisara
    665     email Kai.Makisara@kolumbus.fi
    666    
    667     Some small formal changes - aeb, 950809
    668     @@ -17,7 +17,7 @@
    669     Last modified: 18-JAN-1998 Richard Gooch <rgooch@atnf.csiro.au> Devfs support
    670     */
    671    
    672     -static const char *verstr = "20061107";
    673     +static const char *verstr = "20070203";
    674    
    675     #include <linux/module.h>
    676    
    677     @@ -1168,6 +1168,7 @@ static int st_open(struct inode *inode, struct file *filp)
    678     STps = &(STp->ps[i]);
    679     STps->rw = ST_IDLE;
    680     }
    681     + STp->try_dio_now = STp->try_dio;
    682     STp->recover_count = 0;
    683     DEB( STp->nbr_waits = STp->nbr_finished = 0;
    684     STp->nbr_requests = STp->nbr_dio = STp->nbr_pages = STp->nbr_combinable = 0; )
    685     @@ -1400,9 +1401,9 @@ static int setup_buffering(struct scsi_tape *STp, const char __user *buf,
    686     struct st_buffer *STbp = STp->buffer;
    687    
    688     if (is_read)
    689     - i = STp->try_dio && try_rdio;
    690     + i = STp->try_dio_now && try_rdio;
    691     else
    692     - i = STp->try_dio && try_wdio;
    693     + i = STp->try_dio_now && try_wdio;
    694    
    695     if (i && ((unsigned long)buf & queue_dma_alignment(
    696     STp->device->request_queue)) == 0) {
    697     @@ -1599,7 +1600,7 @@ st_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
    698     STm->do_async_writes && STps->eof < ST_EOM_OK;
    699    
    700     if (STp->block_size != 0 && STm->do_buffer_writes &&
    701     - !(STp->try_dio && try_wdio) && STps->eof < ST_EOM_OK &&
    702     + !(STp->try_dio_now && try_wdio) && STps->eof < ST_EOM_OK &&
    703     STbp->buffer_bytes < STbp->buffer_size) {
    704     STp->dirty = 1;
    705     /* Don't write a buffer that is not full enough. */
    706     @@ -1769,7 +1770,7 @@ static long read_tape(struct scsi_tape *STp, long count,
    707     if (STp->block_size == 0)
    708     blks = bytes = count;
    709     else {
    710     - if (!(STp->try_dio && try_rdio) && STm->do_read_ahead) {
    711     + if (!(STp->try_dio_now && try_rdio) && STm->do_read_ahead) {
    712     blks = (STp->buffer)->buffer_blocks;
    713     bytes = blks * STp->block_size;
    714     } else {
    715     @@ -1948,10 +1949,12 @@ st_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
    716     goto out;
    717    
    718     STm = &(STp->modes[STp->current_mode]);
    719     - if (!(STm->do_read_ahead) && STp->block_size != 0 &&
    720     - (count % STp->block_size) != 0) {
    721     - retval = (-EINVAL); /* Read must be integral number of blocks */
    722     - goto out;
    723     + if (STp->block_size != 0 && (count % STp->block_size) != 0) {
    724     + if (!STm->do_read_ahead) {
    725     + retval = (-EINVAL); /* Read must be integral number of blocks */
    726     + goto out;
    727     + }
    728     + STp->try_dio_now = 0; /* Direct i/o can't handle split blocks */
    729     }
    730    
    731     STps = &(STp->ps[STp->partition]);
    732     diff --git a/drivers/scsi/st.h b/drivers/scsi/st.h
    733     index 05a5cae..50f3deb 100644
    734     --- a/drivers/scsi/st.h
    735     +++ b/drivers/scsi/st.h
    736     @@ -117,7 +117,8 @@ struct scsi_tape {
    737     unsigned char cln_sense_value;
    738     unsigned char cln_sense_mask;
    739     unsigned char use_pf; /* Set Page Format bit in all mode selects? */
    740     - unsigned char try_dio; /* try direct i/o? */
    741     + unsigned char try_dio; /* try direct i/o in general? */
    742     + unsigned char try_dio_now; /* try direct i/o before next close? */
    743     unsigned char c_algo; /* compression algorithm */
    744     unsigned char pos_unknown; /* after reset position unknown */
    745     int tape_type;
    746     diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
    747     index bfe5f30..2d36a8d 100644
    748     --- a/drivers/usb/host/ehci-hub.c
    749     +++ b/drivers/usb/host/ehci-hub.c
    750     @@ -134,6 +134,10 @@ static int ehci_bus_resume (struct usb_hcd *hcd)
    751     /* restore CMD_RUN, framelist size, and irq threshold */
    752     writel (ehci->command, &ehci->regs->command);
    753    
    754     + /* Some controller/firmware combinations need a delay during which
    755     + * they set up the port statuses. See Bugzilla #8190. */
    756     + mdelay(8);
    757     +
    758     /* manually resume the ports we suspended during bus_suspend() */
    759     i = HCS_N_PORTS (ehci->hcs_params);
    760     while (i--) {
    761     diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
    762     index d834982..5a83e8d 100644
    763     --- a/fs/nfs/inode.c
    764     +++ b/fs/nfs/inode.c
    765     @@ -422,7 +422,8 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
    766     int err;
    767    
    768     /* Flush out writes to the server in order to update c/mtime */
    769     - nfs_sync_mapping_range(inode->i_mapping, 0, 0, FLUSH_NOCOMMIT);
    770     + if (S_ISREG(inode->i_mode))
    771     + nfs_sync_mapping_range(inode->i_mapping, 0, 0, FLUSH_NOCOMMIT);
    772    
    773     /*
    774     * We may force a getattr if the user cares about atime.
    775     diff --git a/include/asm-sparc64/tsb.h b/include/asm-sparc64/tsb.h
    776     index e82612c..ab55ffc 100644
    777     --- a/include/asm-sparc64/tsb.h
    778     +++ b/include/asm-sparc64/tsb.h
    779     @@ -264,6 +264,7 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
    780     be,a,pt %xcc, OK_LABEL; \
    781     mov REG4, REG1;
    782    
    783     +#ifndef CONFIG_DEBUG_PAGEALLOC
    784     /* This version uses a trick, the TAG is already (VADDR >> 22) so
    785     * we can make use of that for the index computation.
    786     */
    787     @@ -277,5 +278,6 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
    788     cmp REG3, TAG; \
    789     be,a,pt %xcc, OK_LABEL; \
    790     mov REG4, REG1;
    791     +#endif
    792    
    793     #endif /* !(_SPARC64_TSB_H) */
    794     diff --git a/include/asm-um/processor-x86_64.h b/include/asm-um/processor-x86_64.h
    795     index 10609af..578ca04 100644
    796     --- a/include/asm-um/processor-x86_64.h
    797     +++ b/include/asm-um/processor-x86_64.h
    798     @@ -13,6 +13,7 @@
    799     struct arch_thread {
    800     unsigned long debugregs[8];
    801     int debugregs_seq;
    802     + unsigned long fs;
    803     struct faultinfo faultinfo;
    804     };
    805    
    806     @@ -25,8 +26,9 @@ extern inline void rep_nop(void)
    807     #define cpu_relax() rep_nop()
    808    
    809     #define INIT_ARCH_THREAD { .debugregs = { [ 0 ... 7 ] = 0 }, \
    810     - .debugregs_seq = 0, \
    811     - .faultinfo = { 0, 0, 0 } }
    812     + .debugregs_seq = 0, \
    813     + .fs = 0, \
    814     + .faultinfo = { 0, 0, 0 } }
    815    
    816     static inline void arch_flush_thread(struct arch_thread *thread)
    817     {
    818     diff --git a/include/asm-um/ptrace-x86_64.h b/include/asm-um/ptrace-x86_64.h
    819     index 03b4af4..a927450 100644
    820     --- a/include/asm-um/ptrace-x86_64.h
    821     +++ b/include/asm-um/ptrace-x86_64.h
    822     @@ -81,9 +81,7 @@ static inline void arch_switch_to_tt(struct task_struct *from,
    823     {
    824     }
    825    
    826     -static inline void arch_switch_to_skas(struct task_struct *from,
    827     - struct task_struct *to)
    828     -{
    829     -}
    830     +extern void arch_switch_to_skas(struct task_struct *from,
    831     + struct task_struct *to);
    832    
    833     #endif
    834     diff --git a/include/linux/ktime.h b/include/linux/ktime.h
    835     index 611f17f..83ae2e7 100644
    836     --- a/include/linux/ktime.h
    837     +++ b/include/linux/ktime.h
    838     @@ -57,7 +57,11 @@ typedef union {
    839     } ktime_t;
    840    
    841     #define KTIME_MAX ((s64)~((u64)1 << 63))
    842     -#define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC)
    843     +#if (BITS_PER_LONG == 64)
    844     +# define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC)
    845     +#else
    846     +# define KTIME_SEC_MAX LONG_MAX
    847     +#endif
    848    
    849     /*
    850     * ktime_t definitions when using the 64-bit scalar representation:
    851     diff --git a/kernel/auditsc.c b/kernel/auditsc.c
    852     index 2988975..470f845 100644
    853     --- a/kernel/auditsc.c
    854     +++ b/kernel/auditsc.c
    855     @@ -734,28 +734,26 @@ static inline void audit_free_context(struct audit_context *context)
    856     void audit_log_task_context(struct audit_buffer *ab)
    857     {
    858     char *ctx = NULL;
    859     - ssize_t len = 0;
    860     + unsigned len;
    861     + int error;
    862     + u32 sid;
    863     +
    864     + selinux_get_task_sid(current, &sid);
    865     + if (!sid)
    866     + return;
    867    
    868     - len = security_getprocattr(current, "current", NULL, 0);
    869     - if (len < 0) {
    870     - if (len != -EINVAL)
    871     + error = selinux_sid_to_string(sid, &ctx, &len);
    872     + if (error) {
    873     + if (error != -EINVAL)
    874     goto error_path;
    875     return;
    876     }
    877    
    878     - ctx = kmalloc(len, GFP_KERNEL);
    879     - if (!ctx)
    880     - goto error_path;
    881     -
    882     - len = security_getprocattr(current, "current", ctx, len);
    883     - if (len < 0 )
    884     - goto error_path;
    885     -
    886     audit_log_format(ab, " subj=%s", ctx);
    887     + kfree(ctx);
    888     return;
    889    
    890     error_path:
    891     - kfree(ctx);
    892     audit_panic("error in audit_log_task_context");
    893     return;
    894     }
    895     diff --git a/kernel/fork.c b/kernel/fork.c
    896     index d57118d..cc374fb 100644
    897     --- a/kernel/fork.c
    898     +++ b/kernel/fork.c
    899     @@ -933,8 +933,8 @@ asmlinkage long sys_set_tid_address(int __user *tidptr)
    900    
    901     static inline void rt_mutex_init_task(struct task_struct *p)
    902     {
    903     -#ifdef CONFIG_RT_MUTEXES
    904     spin_lock_init(&p->pi_lock);
    905     +#ifdef CONFIG_RT_MUTEXES
    906     plist_head_init(&p->pi_waiters, &p->pi_lock);
    907     p->pi_blocked_on = NULL;
    908     #endif
    909     diff --git a/kernel/futex.c b/kernel/futex.c
    910     index 5a737de..1df411e 100644
    911     --- a/kernel/futex.c
    912     +++ b/kernel/futex.c
    913     @@ -565,6 +565,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
    914     if (!pi_state)
    915     return -EINVAL;
    916    
    917     + spin_lock(&pi_state->pi_mutex.wait_lock);
    918     new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
    919    
    920     /*
    921     @@ -604,6 +605,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
    922     pi_state->owner = new_owner;
    923     spin_unlock_irq(&new_owner->pi_lock);
    924    
    925     + spin_unlock(&pi_state->pi_mutex.wait_lock);
    926     rt_mutex_unlock(&pi_state->pi_mutex);
    927    
    928     return 0;
    929     diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
    930     index d0ba190..8596409 100644
    931     --- a/kernel/hrtimer.c
    932     +++ b/kernel/hrtimer.c
    933     @@ -332,6 +332,12 @@ hrtimer_forward(struct hrtimer *timer, ktime_t now, ktime_t interval)
    934     orun++;
    935     }
    936     timer->expires = ktime_add(timer->expires, interval);
    937     + /*
    938     + * Make sure, that the result did not wrap with a very large
    939     + * interval.
    940     + */
    941     + if (timer->expires.tv64 < 0)
    942     + timer->expires = ktime_set(KTIME_SEC_MAX, 0);
    943    
    944     return orun;
    945     }
    946     diff --git a/mm/filemap.c b/mm/filemap.c
    947     index 8332c77..ab57e6c 100644
    948     --- a/mm/filemap.c
    949     +++ b/mm/filemap.c
    950     @@ -2393,7 +2393,8 @@ generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
    951     struct file *file = iocb->ki_filp;
    952     struct address_space *mapping = file->f_mapping;
    953     ssize_t retval;
    954     - size_t write_len = 0;
    955     + size_t write_len;
    956     + pgoff_t end = 0; /* silence gcc */
    957    
    958     /*
    959     * If it's a write, unmap all mmappings of the file up-front. This
    960     @@ -2402,23 +2403,46 @@ generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
    961     */
    962     if (rw == WRITE) {
    963     write_len = iov_length(iov, nr_segs);
    964     + end = (offset + write_len - 1) >> PAGE_CACHE_SHIFT;
    965     if (mapping_mapped(mapping))
    966     unmap_mapping_range(mapping, offset, write_len, 0);
    967     }
    968    
    969     retval = filemap_write_and_wait(mapping);
    970     - if (retval == 0) {
    971     - retval = mapping->a_ops->direct_IO(rw, iocb, iov,
    972     - offset, nr_segs);
    973     - if (rw == WRITE && mapping->nrpages) {
    974     - pgoff_t end = (offset + write_len - 1)
    975     - >> PAGE_CACHE_SHIFT;
    976     - int err = invalidate_inode_pages2_range(mapping,
    977     + if (retval)
    978     + goto out;
    979     +
    980     + /*
    981     + * After a write we want buffered reads to be sure to go to disk to get
    982     + * the new data. We invalidate clean cached page from the region we're
    983     + * about to write. We do this *before* the write so that we can return
    984     + * -EIO without clobbering -EIOCBQUEUED from ->direct_IO().
    985     + */
    986     + if (rw == WRITE && mapping->nrpages) {
    987     + retval = invalidate_inode_pages2_range(mapping,
    988     offset >> PAGE_CACHE_SHIFT, end);
    989     - if (err)
    990     - retval = err;
    991     - }
    992     + if (retval)
    993     + goto out;
    994     }
    995     +
    996     + retval = mapping->a_ops->direct_IO(rw, iocb, iov, offset, nr_segs);
    997     + if (retval)
    998     + goto out;
    999     +
    1000     + /*
    1001     + * Finally, try again to invalidate clean pages which might have been
    1002     + * faulted in by get_user_pages() if the source of the write was an
    1003     + * mmap()ed region of the file we're writing. That's a pretty crazy
    1004     + * thing to do, so we don't support it 100%. If this invalidation
    1005     + * fails and we have -EIOCBQUEUED we ignore the failure.
    1006     + */
    1007     + if (rw == WRITE && mapping->nrpages) {
    1008     + int err = invalidate_inode_pages2_range(mapping,
    1009     + offset >> PAGE_CACHE_SHIFT, end);
    1010     + if (err && retval >= 0)
    1011     + retval = err;
    1012     + }
    1013     +out:
    1014     return retval;
    1015     }
    1016    
    1017     diff --git a/mm/madvise.c b/mm/madvise.c
    1018     index 4e19615..77916e9 100644
    1019     --- a/mm/madvise.c
    1020     +++ b/mm/madvise.c
    1021     @@ -155,11 +155,14 @@ static long madvise_dontneed(struct vm_area_struct * vma,
    1022     * Other filesystems return -ENOSYS.
    1023     */
    1024     static long madvise_remove(struct vm_area_struct *vma,
    1025     + struct vm_area_struct **prev,
    1026     unsigned long start, unsigned long end)
    1027     {
    1028     struct address_space *mapping;
    1029     loff_t offset, endoff;
    1030    
    1031     + *prev = vma;
    1032     +
    1033     if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
    1034     return -EINVAL;
    1035    
    1036     @@ -199,7 +202,7 @@ madvise_vma(struct vm_area_struct *vma, struct vm_area_struct **prev,
    1037     error = madvise_behavior(vma, prev, start, end, behavior);
    1038     break;
    1039     case MADV_REMOVE:
    1040     - error = madvise_remove(vma, start, end);
    1041     + error = madvise_remove(vma, prev, start, end);
    1042     break;
    1043    
    1044     case MADV_WILLNEED:
    1045     diff --git a/mm/oom_kill.c b/mm/oom_kill.c
    1046     index b278b8d..2f39169 100644
    1047     --- a/mm/oom_kill.c
    1048     +++ b/mm/oom_kill.c
    1049     @@ -320,7 +320,7 @@ static int oom_kill_task(struct task_struct *p)
    1050     * Don't kill the process if any threads are set to OOM_DISABLE
    1051     */
    1052     do_each_thread(g, q) {
    1053     - if (q->mm == mm && p->oomkilladj == OOM_DISABLE)
    1054     + if (q->mm == mm && q->oomkilladj == OOM_DISABLE)
    1055     return 1;
    1056     } while_each_thread(g, q);
    1057    
    1058     diff --git a/net/core/skbuff.c b/net/core/skbuff.c
    1059     index de7801d..5299083 100644
    1060     --- a/net/core/skbuff.c
    1061     +++ b/net/core/skbuff.c
    1062     @@ -464,6 +464,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
    1063     memcpy(n->cb, skb->cb, sizeof(skb->cb));
    1064     C(len);
    1065     C(data_len);
    1066     + C(mac_len);
    1067     C(csum);
    1068     C(local_df);
    1069     n->cloned = 1;
    1070     diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
    1071     index 60aafb4..c976dd7 100644
    1072     --- a/net/ipv4/cipso_ipv4.c
    1073     +++ b/net/ipv4/cipso_ipv4.c
    1074     @@ -732,11 +732,12 @@ static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def,
    1075     *net_lvl = host_lvl;
    1076     return 0;
    1077     case CIPSO_V4_MAP_STD:
    1078     - if (host_lvl < doi_def->map.std->lvl.local_size) {
    1079     + if (host_lvl < doi_def->map.std->lvl.local_size &&
    1080     + doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) {
    1081     *net_lvl = doi_def->map.std->lvl.local[host_lvl];
    1082     return 0;
    1083     }
    1084     - break;
    1085     + return -EPERM;
    1086     }
    1087    
    1088     return -EINVAL;
    1089     @@ -771,7 +772,7 @@ static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def,
    1090     *host_lvl = doi_def->map.std->lvl.cipso[net_lvl];
    1091     return 0;
    1092     }
    1093     - break;
    1094     + return -EPERM;
    1095     }
    1096    
    1097     return -EINVAL;
    1098     diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
    1099     index 480ace9..728ba5f 100644
    1100     --- a/net/ipv4/devinet.c
    1101     +++ b/net/ipv4/devinet.c
    1102     @@ -503,8 +503,10 @@ static struct in_ifaddr *rtm_to_ifaddr(struct nlmsghdr *nlh)
    1103     goto errout;
    1104    
    1105     ifm = nlmsg_data(nlh);
    1106     - if (ifm->ifa_prefixlen > 32 || tb[IFA_LOCAL] == NULL)
    1107     + if (ifm->ifa_prefixlen > 32 || tb[IFA_LOCAL] == NULL) {
    1108     + err = -EINVAL;
    1109     goto errout;
    1110     + }
    1111    
    1112     dev = __dev_get_by_index(ifm->ifa_index);
    1113     if (dev == NULL) {
    1114     diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
    1115     index 1e589b9..a742ea3 100644
    1116     --- a/net/ipv4/fib_trie.c
    1117     +++ b/net/ipv4/fib_trie.c
    1118     @@ -1528,7 +1528,6 @@ static int trie_leaf_remove(struct trie *t, t_key key)
    1119     t->revision++;
    1120     t->size--;
    1121    
    1122     - preempt_disable();
    1123     tp = NODE_PARENT(n);
    1124     tnode_free((struct tnode *) n);
    1125    
    1126     @@ -1538,7 +1537,6 @@ static int trie_leaf_remove(struct trie *t, t_key key)
    1127     rcu_assign_pointer(t->trie, trie_rebalance(t, tp));
    1128     } else
    1129     rcu_assign_pointer(t->trie, NULL);
    1130     - preempt_enable();
    1131    
    1132     return 1;
    1133     }
    1134     diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
    1135     index 23db88e..b20726f 100644
    1136     --- a/net/ipv6/ipv6_sockglue.c
    1137     +++ b/net/ipv6/ipv6_sockglue.c
    1138     @@ -414,7 +414,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
    1139     }
    1140    
    1141     /* routing header option needs extra check */
    1142     - if (optname == IPV6_RTHDR && opt->srcrt) {
    1143     + if (optname == IPV6_RTHDR && opt && opt->srcrt) {
    1144     struct ipv6_rt_hdr *rthdr = opt->srcrt;
    1145     switch (rthdr->type) {
    1146     case IPV6_SRCRT_TYPE_0:
    1147     diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
    1148     index c25e930..a2d41ba 100644
    1149     --- a/net/ipv6/tcp_ipv6.c
    1150     +++ b/net/ipv6/tcp_ipv6.c
    1151     @@ -1453,6 +1453,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
    1152     First: no IPv4 options.
    1153     */
    1154     newinet->opt = NULL;
    1155     + newnp->ipv6_fl_list = NULL;
    1156    
    1157     /* Clone RX bits */
    1158     newnp->rxopt.all = np->rxopt.all;
    1159     diff --git a/net/irda/irttp.c b/net/irda/irttp.c
    1160     index 03504f3..4703107 100644
    1161     --- a/net/irda/irttp.c
    1162     +++ b/net/irda/irttp.c
    1163     @@ -1455,6 +1455,7 @@ struct tsap_cb *irttp_dup(struct tsap_cb *orig, void *instance)
    1164    
    1165     /* Not everything should be copied */
    1166     new->notify.instance = instance;
    1167     + spin_lock_init(&new->lock);
    1168     init_timer(&new->todo_timer);
    1169    
    1170     skb_queue_head_init(&new->rx_queue);
    1171     diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
    1172     index 690b173..f7eafd8 100644
    1173     --- a/net/netfilter/nfnetlink_log.c
    1174     +++ b/net/netfilter/nfnetlink_log.c
    1175     @@ -218,10 +218,8 @@ _instance_destroy2(struct nfulnl_instance *inst, int lock)
    1176     spin_lock_bh(&inst->lock);
    1177     if (inst->skb) {
    1178     /* timer "holds" one reference (we have one more) */
    1179     - if (timer_pending(&inst->timer)) {
    1180     - del_timer(&inst->timer);
    1181     + if (del_timer(&inst->timer))
    1182     instance_put(inst);
    1183     - }
    1184     if (inst->qlen)
    1185     __nfulnl_send(inst);
    1186     if (inst->skb) {
    1187     @@ -695,10 +693,8 @@ nfulnl_log_packet(unsigned int pf,
    1188     UDEBUG("flushing old skb\n");
    1189    
    1190     /* timer "holds" one reference (we have another one) */
    1191     - if (timer_pending(&inst->timer)) {
    1192     - del_timer(&inst->timer);
    1193     + if (del_timer(&inst->timer))
    1194     instance_put(inst);
    1195     - }
    1196     __nfulnl_send(inst);
    1197    
    1198     if (!(inst->skb = nfulnl_alloc_skb(nlbufsiz, size))) {
    1199     diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
    1200     index fdb08d9..f0f2c1a 100644
    1201     --- a/net/xfrm/xfrm_state.c
    1202     +++ b/net/xfrm/xfrm_state.c
    1203     @@ -707,7 +707,8 @@ static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 re
    1204     x->props.mode != mode ||
    1205     x->props.family != family ||
    1206     x->km.state != XFRM_STATE_ACQ ||
    1207     - x->id.spi != 0)
    1208     + x->id.spi != 0 ||
    1209     + x->id.proto != proto)
    1210     continue;
    1211    
    1212     switch (family) {
    1213     @@ -804,7 +805,8 @@ int xfrm_state_add(struct xfrm_state *x)
    1214    
    1215     if (use_spi && x->km.seq) {
    1216     x1 = __xfrm_find_acq_byseq(x->km.seq);
    1217     - if (x1 && xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family)) {
    1218     + if (x1 && ((x1->id.proto != x->id.proto) ||
    1219     + xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
    1220     xfrm_state_put(x1);
    1221     x1 = NULL;
    1222     }
    1223     diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
    1224     index 77f8ec7..ba2c754 100644
    1225     --- a/sound/pci/hda/hda_intel.c
    1226     +++ b/sound/pci/hda/hda_intel.c
    1227     @@ -199,7 +199,6 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
    1228    
    1229     /* STATESTS int mask: SD2,SD1,SD0 */
    1230     #define STATESTS_INT_MASK 0x07
    1231     -#define AZX_MAX_CODECS 3
    1232    
    1233     /* SD_CTL bits */
    1234     #define SD_CTL_STREAM_RESET 0x01 /* stream reset bit */
    1235     @@ -966,6 +965,16 @@ static int azx_setup_controller(struct azx *chip, struct azx_dev *azx_dev)
    1236     * Codec initialization
    1237     */
    1238    
    1239     +static unsigned int azx_max_codecs[] __devinitdata = {
    1240     + [AZX_DRIVER_ICH] = 3,
    1241     + [AZX_DRIVER_ATI] = 4,
    1242     + [AZX_DRIVER_ATIHDMI] = 4,
    1243     + [AZX_DRIVER_VIA] = 3, /* FIXME: correct? */
    1244     + [AZX_DRIVER_SIS] = 3, /* FIXME: correct? */
    1245     + [AZX_DRIVER_ULI] = 3, /* FIXME: correct? */
    1246     + [AZX_DRIVER_NVIDIA] = 3, /* FIXME: correct? */
    1247     +};
    1248     +
    1249     static int __devinit azx_codec_create(struct azx *chip, const char *model)
    1250     {
    1251     struct hda_bus_template bus_temp;
    1252     @@ -982,7 +991,7 @@ static int __devinit azx_codec_create(struct azx *chip, const char *model)
    1253     return err;
    1254    
    1255     codecs = 0;
    1256     - for (c = 0; c < AZX_MAX_CODECS; c++) {
    1257     + for (c = 0; c < azx_max_codecs[chip->driver_type]; c++) {
    1258     if ((chip->codec_mask & (1 << c)) & probe_mask) {
    1259     err = snd_hda_codec_new(chip->bus, c, NULL);
    1260     if (err < 0)