Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-2.6.20-r6/0104-2.6.20.4-all-fixes.patch

    Contents of /trunk/kernel26-alx/patches-2.6.20-r6/0104-2.6.20.4-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1175 - (show annotations) (download)
    Thu Oct 14 12:15:46 2010 UTC (13 years, 6 months ago) by niro
    File size: 40400 byte(s) 
    -2.6.20-alx-r6 new magellan 0.5.2 kernel
    1 diff --git a/arch/ia64/kernel/iosapic.c b/arch/ia64/kernel/iosapic.c
    2 index 0fc5fb7..02479e1 100644
    3 --- a/arch/ia64/kernel/iosapic.c
    4 +++ b/arch/ia64/kernel/iosapic.c
    5 @@ -446,7 +446,7 @@ iosapic_end_level_irq (unsigned int irq)
    6 #define iosapic_disable_level_irq mask_irq
    7 #define iosapic_ack_level_irq nop
    8
    9 -struct hw_interrupt_type irq_type_iosapic_level = {
    10 +struct irq_chip irq_type_iosapic_level = {
    11 .name = "IO-SAPIC-level",
    12 .startup = iosapic_startup_level_irq,
    13 .shutdown = iosapic_shutdown_level_irq,
    14 @@ -454,6 +454,8 @@ struct hw_interrupt_type irq_type_iosapic_level = {
    15 .disable = iosapic_disable_level_irq,
    16 .ack = iosapic_ack_level_irq,
    17 .end = iosapic_end_level_irq,
    18 + .mask = mask_irq,
    19 + .unmask = unmask_irq,
    20 .set_affinity = iosapic_set_affinity
    21 };
    22
    23 @@ -493,7 +495,7 @@ iosapic_ack_edge_irq (unsigned int irq)
    24 #define iosapic_disable_edge_irq nop
    25 #define iosapic_end_edge_irq nop
    26
    27 -struct hw_interrupt_type irq_type_iosapic_edge = {
    28 +struct irq_chip irq_type_iosapic_edge = {
    29 .name = "IO-SAPIC-edge",
    30 .startup = iosapic_startup_edge_irq,
    31 .shutdown = iosapic_disable_edge_irq,
    32 @@ -501,6 +503,8 @@ struct hw_interrupt_type irq_type_iosapic_edge = {
    33 .disable = iosapic_disable_edge_irq,
    34 .ack = iosapic_ack_edge_irq,
    35 .end = iosapic_end_edge_irq,
    36 + .mask = mask_irq,
    37 + .unmask = unmask_irq,
    38 .set_affinity = iosapic_set_affinity
    39 };
    40
    41 diff --git a/arch/ia64/sn/kernel/irq.c b/arch/ia64/sn/kernel/irq.c
    42 index 8c5bee0..8d2a1bf 100644
    43 --- a/arch/ia64/sn/kernel/irq.c
    44 +++ b/arch/ia64/sn/kernel/irq.c
    45 @@ -205,7 +205,17 @@ static void sn_set_affinity_irq(unsigned int irq, cpumask_t mask)
    46 (void)sn_retarget_vector(sn_irq_info, nasid, slice);
    47 }
    48
    49 -struct hw_interrupt_type irq_type_sn = {
    50 +static void
    51 +sn_mask_irq(unsigned int irq)
    52 +{
    53 +}
    54 +
    55 +static void
    56 +sn_unmask_irq(unsigned int irq)
    57 +{
    58 +}
    59 +
    60 +struct irq_chip irq_type_sn = {
    61 .name = "SN hub",
    62 .startup = sn_startup_irq,
    63 .shutdown = sn_shutdown_irq,
    64 @@ -213,6 +223,8 @@ struct hw_interrupt_type irq_type_sn = {
    65 .disable = sn_disable_irq,
    66 .ack = sn_ack_irq,
    67 .end = sn_end_irq,
    68 + .mask = sn_mask_irq,
    69 + .unmask = sn_unmask_irq,
    70 .set_affinity = sn_set_affinity_irq
    71 };
    72
    73 diff --git a/arch/sparc64/kernel/ktlb.S b/arch/sparc64/kernel/ktlb.S
    74 index e492db8..d4024ac 100644
    75 --- a/arch/sparc64/kernel/ktlb.S
    76 +++ b/arch/sparc64/kernel/ktlb.S
    77 @@ -138,9 +138,15 @@ kvmap_dtlb_4v:
    78 brgez,pn %g4, kvmap_dtlb_nonlinear
    79 nop
    80
    81 +#ifdef CONFIG_DEBUG_PAGEALLOC
    82 + /* Index through the base page size TSB even for linear
    83 + * mappings when using page allocation debugging.
    84 + */
    85 + KERN_TSB_LOOKUP_TL1(%g4, %g6, %g5, %g1, %g2, %g3, kvmap_dtlb_load)
    86 +#else
    87 /* Correct TAG_TARGET is already in %g6, check 4mb TSB. */
    88 KERN_TSB4M_LOOKUP_TL1(%g6, %g5, %g1, %g2, %g3, kvmap_dtlb_load)
    89 -
    90 +#endif
    91 /* TSB entry address left in %g1, lookup linear PTE.
    92 * Must preserve %g1 and %g6 (TAG).
    93 */
    94 diff --git a/arch/sparc64/kernel/tsb.S b/arch/sparc64/kernel/tsb.S
    95 index eedf94f..10adb2f 100644
    96 --- a/arch/sparc64/kernel/tsb.S
    97 +++ b/arch/sparc64/kernel/tsb.S
    98 @@ -546,6 +546,7 @@ NGtsb_init:
    99 subcc %o1, 0x100, %o1
    100 bne,pt %xcc, 1b
    101 add %o0, 0x100, %o0
    102 + membar #Sync
    103 retl
    104 wr %g2, 0x0, %asi
    105 .size NGtsb_init, .-NGtsb_init
    106 diff --git a/arch/sparc64/lib/NGbzero.S b/arch/sparc64/lib/NGbzero.S
    107 index e86baec..f10e452 100644
    108 --- a/arch/sparc64/lib/NGbzero.S
    109 +++ b/arch/sparc64/lib/NGbzero.S
    110 @@ -88,6 +88,7 @@ NGbzero_loop:
    111 bne,pt %xcc, NGbzero_loop
    112 add %o0, 64, %o0
    113
    114 + membar #Sync
    115 wr %o4, 0x0, %asi
    116 brz,pn %o1, NGbzero_done
    117 NGbzero_medium:
    118 diff --git a/arch/sparc64/lib/NGmemcpy.S b/arch/sparc64/lib/NGmemcpy.S
    119 index 8e522b3..66063a9 100644
    120 --- a/arch/sparc64/lib/NGmemcpy.S
    121 +++ b/arch/sparc64/lib/NGmemcpy.S
    122 @@ -247,6 +247,8 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */
    123 /* fall through */
    124
    125 60:
    126 + membar #Sync
    127 +
    128 /* %o2 contains any final bytes still needed to be copied
    129 * over. If anything is left, we copy it one byte at a time.
    130 */
    131 diff --git a/arch/sparc64/lib/NGpage.S b/arch/sparc64/lib/NGpage.S
    132 index 7d7c3bb..8ce3a0c 100644
    133 --- a/arch/sparc64/lib/NGpage.S
    134 +++ b/arch/sparc64/lib/NGpage.S
    135 @@ -41,6 +41,7 @@ NGcopy_user_page: /* %o0=dest, %o1=src, %o2=vaddr */
    136 subcc %g7, 64, %g7
    137 bne,pt %xcc, 1b
    138 add %o0, 32, %o0
    139 + membar #Sync
    140 retl
    141 nop
    142
    143 @@ -63,6 +64,7 @@ NGclear_user_page: /* %o0=dest, %o1=vaddr */
    144 subcc %g7, 64, %g7
    145 bne,pt %xcc, 1b
    146 add %o0, 32, %o0
    147 + membar #Sync
    148 retl
    149 nop
    150
    151 diff --git a/arch/sparc64/mm/hugetlbpage.c b/arch/sparc64/mm/hugetlbpage.c
    152 index 33fd0b2..00677b5 100644
    153 --- a/arch/sparc64/mm/hugetlbpage.c
    154 +++ b/arch/sparc64/mm/hugetlbpage.c
    155 @@ -248,6 +248,7 @@ void set_huge_pte_at(struct mm_struct *mm, unsigned long addr,
    156 if (!pte_present(*ptep) && pte_present(entry))
    157 mm->context.huge_pte_count++;
    158
    159 + addr &= HPAGE_MASK;
    160 for (i = 0; i < (1 << HUGETLB_PAGE_ORDER); i++) {
    161 set_pte_at(mm, addr, ptep, entry);
    162 ptep++;
    163 @@ -266,6 +267,8 @@ pte_t huge_ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
    164 if (pte_present(entry))
    165 mm->context.huge_pte_count--;
    166
    167 + addr &= HPAGE_MASK;
    168 +
    169 for (i = 0; i < (1 << HUGETLB_PAGE_ORDER); i++) {
    170 pte_clear(mm, addr, ptep);
    171 addr += PAGE_SIZE;
    172 diff --git a/arch/sparc64/mm/init.c b/arch/sparc64/mm/init.c
    173 index 054822a..5391cd5 100644
    174 --- a/arch/sparc64/mm/init.c
    175 +++ b/arch/sparc64/mm/init.c
    176 @@ -59,8 +59,10 @@ unsigned long kern_linear_pte_xor[2] __read_mostly;
    177 */
    178 unsigned long kpte_linear_bitmap[KPTE_BITMAP_BYTES / sizeof(unsigned long)];
    179
    180 +#ifndef CONFIG_DEBUG_PAGEALLOC
    181 /* A special kernel TSB for 4MB and 256MB linear mappings. */
    182 struct tsb swapper_4m_tsb[KERNEL_TSB4M_NENTRIES];
    183 +#endif
    184
    185 #define MAX_BANKS 32
    186
    187 @@ -1301,7 +1303,12 @@ static void __init tsb_phys_patch(void)
    188 }
    189
    190 /* Don't mark as init, we give this to the Hypervisor. */
    191 -static struct hv_tsb_descr ktsb_descr[2];
    192 +#ifndef CONFIG_DEBUG_PAGEALLOC
    193 +#define NUM_KTSB_DESCR 2
    194 +#else
    195 +#define NUM_KTSB_DESCR 1
    196 +#endif
    197 +static struct hv_tsb_descr ktsb_descr[NUM_KTSB_DESCR];
    198 extern struct tsb swapper_tsb[KERNEL_TSB_NENTRIES];
    199
    200 static void __init sun4v_ktsb_init(void)
    201 @@ -1340,6 +1347,7 @@ static void __init sun4v_ktsb_init(void)
    202 ktsb_descr[0].tsb_base = ktsb_pa;
    203 ktsb_descr[0].resv = 0;
    204
    205 +#ifndef CONFIG_DEBUG_PAGEALLOC
    206 /* Second KTSB for 4MB/256MB mappings. */
    207 ktsb_pa = (kern_base +
    208 ((unsigned long)&swapper_4m_tsb[0] - KERNBASE));
    209 @@ -1352,6 +1360,7 @@ static void __init sun4v_ktsb_init(void)
    210 ktsb_descr[1].ctx_idx = 0;
    211 ktsb_descr[1].tsb_base = ktsb_pa;
    212 ktsb_descr[1].resv = 0;
    213 +#endif
    214 }
    215
    216 void __cpuinit sun4v_ktsb_register(void)
    217 @@ -1364,7 +1373,7 @@ void __cpuinit sun4v_ktsb_register(void)
    218 pa = kern_base + ((unsigned long)&ktsb_descr[0] - KERNBASE);
    219
    220 func = HV_FAST_MMU_TSB_CTX0;
    221 - arg0 = 2;
    222 + arg0 = NUM_KTSB_DESCR;
    223 arg1 = pa;
    224 __asm__ __volatile__("ta %6"
    225 : "=&r" (func), "=&r" (arg0), "=&r" (arg1)
    226 @@ -1393,7 +1402,9 @@ void __init paging_init(void)
    227
    228 /* Invalidate both kernel TSBs. */
    229 memset(swapper_tsb, 0x40, sizeof(swapper_tsb));
    230 +#ifndef CONFIG_DEBUG_PAGEALLOC
    231 memset(swapper_4m_tsb, 0x40, sizeof(swapper_4m_tsb));
    232 +#endif
    233
    234 if (tlb_type == hypervisor)
    235 sun4v_pgprot_init();
    236 @@ -1725,8 +1736,13 @@ static void __init sun4u_pgprot_init(void)
    237 pg_iobits = (_PAGE_VALID | _PAGE_PRESENT_4U | __DIRTY_BITS_4U |
    238 __ACCESS_BITS_4U | _PAGE_E_4U);
    239
    240 +#ifdef CONFIG_DEBUG_PAGEALLOC
    241 + kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZBITS_4U) ^
    242 + 0xfffff80000000000;
    243 +#else
    244 kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZ4MB_4U) ^
    245 0xfffff80000000000;
    246 +#endif
    247 kern_linear_pte_xor[0] |= (_PAGE_CP_4U | _PAGE_CV_4U |
    248 _PAGE_P_4U | _PAGE_W_4U);
    249
    250 @@ -1769,13 +1785,23 @@ static void __init sun4v_pgprot_init(void)
    251 _PAGE_E = _PAGE_E_4V;
    252 _PAGE_CACHE = _PAGE_CACHE_4V;
    253
    254 +#ifdef CONFIG_DEBUG_PAGEALLOC
    255 + kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZBITS_4V) ^
    256 + 0xfffff80000000000;
    257 +#else
    258 kern_linear_pte_xor[0] = (_PAGE_VALID | _PAGE_SZ4MB_4V) ^
    259 0xfffff80000000000;
    260 +#endif
    261 kern_linear_pte_xor[0] |= (_PAGE_CP_4V | _PAGE_CV_4V |
    262 _PAGE_P_4V | _PAGE_W_4V);
    263
    264 +#ifdef CONFIG_DEBUG_PAGEALLOC
    265 + kern_linear_pte_xor[1] = (_PAGE_VALID | _PAGE_SZBITS_4V) ^
    266 + 0xfffff80000000000;
    267 +#else
    268 kern_linear_pte_xor[1] = (_PAGE_VALID | _PAGE_SZ256MB_4V) ^
    269 0xfffff80000000000;
    270 +#endif
    271 kern_linear_pte_xor[1] |= (_PAGE_CP_4V | _PAGE_CV_4V |
    272 _PAGE_P_4V | _PAGE_W_4V);
    273
    274 diff --git a/arch/um/include/os.h b/arch/um/include/os.h
    275 index 13a86bd..4e9a13e 100644
    276 --- a/arch/um/include/os.h
    277 +++ b/arch/um/include/os.h
    278 @@ -341,4 +341,6 @@ extern void maybe_sigio_broken(int fd, int read);
    279 extern void sig_handler_common_skas(int sig, void *sc_ptr);
    280 extern void user_signal(int sig, union uml_pt_regs *regs, int pid);
    281
    282 +extern int os_arch_prctl(int pid, int code, unsigned long *addr);
    283 +
    284 #endif
    285 diff --git a/arch/um/os-Linux/sys-x86_64/Makefile b/arch/um/os-Linux/sys-x86_64/Makefile
    286 index f67842a..7955e06 100644
    287 --- a/arch/um/os-Linux/sys-x86_64/Makefile
    288 +++ b/arch/um/os-Linux/sys-x86_64/Makefile
    289 @@ -3,7 +3,7 @@
    290 # Licensed under the GPL
    291 #
    292
    293 -obj-$(CONFIG_MODE_SKAS) = registers.o signal.o
    294 +obj-$(CONFIG_MODE_SKAS) = registers.o prctl.o signal.o
    295
    296 USER_OBJS := $(obj-y)
    297
    298 diff --git a/arch/um/os-Linux/sys-x86_64/prctl.c b/arch/um/os-Linux/sys-x86_64/prctl.c
    299 new file mode 100644
    300 index 0000000..79c278a
    301 --- /dev/null
    302 +++ b/arch/um/os-Linux/sys-x86_64/prctl.c
    303 @@ -0,0 +1,12 @@
    304 +/*
    305 + * Copyright (C) 2007 Jeff Dike (jdike@{addtoit.com,linux.intel.com})
    306 + * Licensed under the GPL
    307 + */
    308 +
    309 +#include <sys/ptrace.h>
    310 +#include <linux/ptrace.h>
    311 +
    312 +int os_arch_prctl(int pid, int code, unsigned long *addr)
    313 +{
    314 + return ptrace(PTRACE_ARCH_PRCTL, pid, (unsigned long) addr, code);
    315 +}
    316 diff --git a/arch/um/sys-x86_64/syscalls.c b/arch/um/sys-x86_64/syscalls.c
    317 index 73ce446..6d5605b 100644
    318 --- a/arch/um/sys-x86_64/syscalls.c
    319 +++ b/arch/um/sys-x86_64/syscalls.c
    320 @@ -16,6 +16,7 @@
    321 #include "asm/prctl.h" /* XXX This should get the constants from libc */
    322 #include "choose-mode.h"
    323 #include "kern.h"
    324 +#include "os.h"
    325
    326 asmlinkage long sys_uname64(struct new_utsname __user * name)
    327 {
    328 @@ -58,40 +59,70 @@ static long arch_prctl_tt(int code, unsigned long addr)
    329
    330 #ifdef CONFIG_MODE_SKAS
    331
    332 -/* XXX: Must also call arch_prctl in the host, beside saving the segment bases! */
    333 -static long arch_prctl_skas(int code, unsigned long addr)
    334 +static long arch_prctl_skas(int code, unsigned long __user *addr)
    335 {
    336 - long ret = 0;
    337 + unsigned long *ptr = addr, tmp;
    338 + long ret;
    339 + int pid = current->mm->context.skas.id.u.pid;
    340 +
    341 + /*
    342 + * With ARCH_SET_FS (and ARCH_SET_GS is treated similarly to
    343 + * be safe), we need to call arch_prctl on the host because
    344 + * setting %fs may result in something else happening (like a
    345 + * GDT being set instead). So, we let the host fiddle the
    346 + * registers and restore them afterwards.
    347 + *
    348 + * So, the saved registers are stored to the process (this
    349 + * needed because a stub may have been the last thing to run),
    350 + * arch_prctl is run on the host, then the registers are read
    351 + * back.
    352 + */
    353 + switch(code){
    354 + case ARCH_SET_FS:
    355 + case ARCH_SET_GS:
    356 + restore_registers(pid, &current->thread.regs.regs);
    357 + break;
    358 + case ARCH_GET_FS:
    359 + case ARCH_GET_GS:
    360 + /*
    361 + * With these two, we read to a local pointer and
    362 + * put_user it to the userspace pointer that we were
    363 + * given. If addr isn't valid (because it hasn't been
    364 + * faulted in or is just bogus), we want put_user to
    365 + * fault it in (or return -EFAULT) instead of having
    366 + * the host return -EFAULT.
    367 + */
    368 + ptr = &tmp;
    369 + }
    370 +
    371 + ret = os_arch_prctl(pid, code, ptr);
    372 + if(ret)
    373 + return ret;
    374
    375 switch(code){
    376 case ARCH_SET_FS:
    377 - current->thread.regs.regs.skas.regs[FS_BASE / sizeof(unsigned long)] = addr;
    378 + current->thread.arch.fs = (unsigned long) ptr;
    379 + save_registers(pid, &current->thread.regs.regs);
    380 break;
    381 case ARCH_SET_GS:
    382 - current->thread.regs.regs.skas.regs[GS_BASE / sizeof(unsigned long)] = addr;
    383 + save_registers(pid, &current->thread.regs.regs);
    384 break;
    385 case ARCH_GET_FS:
    386 - ret = put_user(current->thread.regs.regs.skas.
    387 - regs[FS_BASE / sizeof(unsigned long)],
    388 - (unsigned long __user *)addr);
    389 - break;
    390 + ret = put_user(tmp, addr);
    391 + break;
    392 case ARCH_GET_GS:
    393 - ret = put_user(current->thread.regs.regs.skas.
    394 - regs[GS_BASE / sizeof(unsigned long)],
    395 - (unsigned long __user *)addr);
    396 - break;
    397 - default:
    398 - ret = -EINVAL;
    399 + ret = put_user(tmp, addr);
    400 break;
    401 }
    402
    403 - return(ret);
    404 + return ret;
    405 }
    406 #endif
    407
    408 long sys_arch_prctl(int code, unsigned long addr)
    409 {
    410 - return(CHOOSE_MODE_PROC(arch_prctl_tt, arch_prctl_skas, code, addr));
    411 + return CHOOSE_MODE_PROC(arch_prctl_tt, arch_prctl_skas, code,
    412 + (unsigned long __user *) addr);
    413 }
    414
    415 long sys_clone(unsigned long clone_flags, unsigned long newsp,
    416 @@ -105,5 +136,14 @@ long sys_clone(unsigned long clone_flags, unsigned long newsp,
    417 ret = do_fork(clone_flags, newsp, &current->thread.regs, 0, parent_tid,
    418 child_tid);
    419 current->thread.forking = 0;
    420 - return(ret);
    421 + return ret;
    422 }
    423 +
    424 +void arch_switch_to_skas(struct task_struct *from, struct task_struct *to)
    425 +{
    426 + if((to->thread.arch.fs == 0) || (to->mm == NULL))
    427 + return;
    428 +
    429 + arch_prctl_skas(ARCH_SET_FS, (void __user *) to->thread.arch.fs);
    430 +}
    431 +
    432 diff --git a/arch/um/sys-x86_64/tls.c b/arch/um/sys-x86_64/tls.c
    433 index ce1bf1b..febbc94 100644
    434 --- a/arch/um/sys-x86_64/tls.c
    435 +++ b/arch/um/sys-x86_64/tls.c
    436 @@ -1,14 +1,17 @@
    437 #include "linux/sched.h"
    438
    439 -void debug_arch_force_load_TLS(void)
    440 -{
    441 -}
    442 -
    443 void clear_flushed_tls(struct task_struct *task)
    444 {
    445 }
    446
    447 int arch_copy_tls(struct task_struct *t)
    448 {
    449 + /*
    450 + * If CLONE_SETTLS is set, we need to save the thread id
    451 + * (which is argument 5, child_tid, of clone) so it can be set
    452 + * during context switches.
    453 + */
    454 + t->thread.arch.fs = t->thread.regs.regs.skas.regs[R8 / sizeof(long)];
    455 +
    456 return 0;
    457 }
    458 diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
    459 index debe944..3b12996 100644
    460 --- a/drivers/input/serio/i8042.c
    461 +++ b/drivers/input/serio/i8042.c
    462 @@ -371,7 +371,7 @@ static irqreturn_t i8042_interrupt(int irq, void *dev_id)
    463 if (unlikely(i8042_suppress_kbd_ack))
    464 if (port_no == I8042_KBD_PORT_NO &&
    465 (data == 0xfa || data == 0xfe)) {
    466 - i8042_suppress_kbd_ack = 0;
    467 + i8042_suppress_kbd_ack--;
    468 goto out;
    469 }
    470
    471 @@ -543,6 +543,7 @@ static int __devinit i8042_check_aux(void)
    472 {
    473 int retval = -1;
    474 int irq_registered = 0;
    475 + int aux_loop_broken = 0;
    476 unsigned long flags;
    477 unsigned char param;
    478
    479 @@ -559,7 +560,8 @@ static int __devinit i8042_check_aux(void)
    480 */
    481
    482 param = 0x5a;
    483 - if (i8042_command(&param, I8042_CMD_AUX_LOOP) || param != 0x5a) {
    484 + retval = i8042_command(&param, I8042_CMD_AUX_LOOP);
    485 + if (retval || param != 0x5a) {
    486
    487 /*
    488 * External connection test - filters out AT-soldered PS/2 i8042's
    489 @@ -572,6 +574,13 @@ static int __devinit i8042_check_aux(void)
    490 if (i8042_command(&param, I8042_CMD_AUX_TEST) ||
    491 (param && param != 0xfa && param != 0xff))
    492 return -1;
    493 +
    494 +/*
    495 + * If AUX_LOOP completed without error but returned unexpected data
    496 + * mark it as broken
    497 + */
    498 + if (!retval)
    499 + aux_loop_broken = 1;
    500 }
    501
    502 /*
    503 @@ -595,7 +604,7 @@ static int __devinit i8042_check_aux(void)
    504 * used it for a PCI card or somethig else.
    505 */
    506
    507 - if (i8042_noloop) {
    508 + if (i8042_noloop || aux_loop_broken) {
    509 /*
    510 * Without LOOP command we can't test AUX IRQ delivery. Assume the port
    511 * is working and hope we are right.
    512 @@ -838,13 +847,14 @@ static long i8042_panic_blink(long count)
    513 led ^= 0x01 | 0x04;
    514 while (i8042_read_status() & I8042_STR_IBF)
    515 DELAY;
    516 - i8042_suppress_kbd_ack = 1;
    517 + dbg("%02x -> i8042 (panic blink)", 0xed);
    518 + i8042_suppress_kbd_ack = 2;
    519 i8042_write_data(0xed); /* set leds */
    520 DELAY;
    521 while (i8042_read_status() & I8042_STR_IBF)
    522 DELAY;
    523 DELAY;
    524 - i8042_suppress_kbd_ack = 1;
    525 + dbg("%02x -> i8042 (panic blink)", led);
    526 i8042_write_data(led);
    527 DELAY;
    528 last_blink = count;
    529 diff --git a/drivers/md/linear.c b/drivers/md/linear.c
    530 index c625ddb..d5ecd2d 100644
    531 --- a/drivers/md/linear.c
    532 +++ b/drivers/md/linear.c
    533 @@ -188,7 +188,7 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
    534 for (i=0; i < cnt-1 ; i++) {
    535 sector_t sz = 0;
    536 int j;
    537 - for (j=i; i<cnt-1 && sz < min_spacing ; j++)
    538 + for (j = i; j < cnt - 1 && sz < min_spacing; j++)
    539 sz += conf->disks[j].size;
    540 if (sz >= min_spacing && sz < conf->hash_spacing)
    541 conf->hash_spacing = sz;
    542 diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
    543 index 577babd..1aafa71 100644
    544 --- a/drivers/net/r8169.c
    545 +++ b/drivers/net/r8169.c
    546 @@ -1369,11 +1369,7 @@ static inline void rtl8169_request_timer(struct net_device *dev)
    547 (tp->phy_version >= RTL_GIGA_PHY_VER_H))
    548 return;
    549
    550 - init_timer(timer);
    551 - timer->expires = jiffies + RTL8169_PHY_TIMEOUT;
    552 - timer->data = (unsigned long)(dev);
    553 - timer->function = rtl8169_phy_timer;
    554 - add_timer(timer);
    555 + mod_timer(timer, jiffies + RTL8169_PHY_TIMEOUT);
    556 }
    557
    558 #ifdef CONFIG_NET_POLL_CONTROLLER
    559 @@ -1686,6 +1682,10 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
    560 tp->mmio_addr = ioaddr;
    561 tp->align = rtl_cfg_info[ent->driver_data].align;
    562
    563 + init_timer(&tp->timer);
    564 + tp->timer.data = (unsigned long) dev;
    565 + tp->timer.function = rtl8169_phy_timer;
    566 +
    567 spin_lock_init(&tp->lock);
    568
    569 rc = register_netdev(dev);
    570 diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
    571 index 0e0401d..0252ef9 100644
    572 --- a/drivers/pci/probe.c
    573 +++ b/drivers/pci/probe.c
    574 @@ -639,7 +639,34 @@ static void pci_read_irq(struct pci_dev *dev)
    575 dev->irq = irq;
    576 }
    577
    578 -#define LEGACY_IO_RESOURCE (IORESOURCE_IO | IORESOURCE_PCI_FIXED)
    579 +static void change_legacy_io_resource(struct pci_dev * dev, unsigned index,
    580 + unsigned start, unsigned end)
    581 +{
    582 + unsigned base = start & PCI_BASE_ADDRESS_IO_MASK;
    583 + unsigned len = (end | ~PCI_BASE_ADDRESS_IO_MASK) - base + 1;
    584 +
    585 + /*
    586 + * Some X versions get confused when the BARs reported through
    587 + * /sys or /proc differ from those seen in config space, thus
    588 + * try to update the config space values, too.
    589 + */
    590 + if (!(pci_resource_flags(dev, index) & IORESOURCE_IO))
    591 + printk(KERN_WARNING "%s: cannot adjust BAR%u (not I/O)\n",
    592 + pci_name(dev), index);
    593 + else if (pci_resource_len(dev, index) != len)
    594 + printk(KERN_WARNING "%s: cannot adjust BAR%u (size %04X)\n",
    595 + pci_name(dev), index, (unsigned)pci_resource_len(dev, index));
    596 + else {
    597 + printk(KERN_INFO "%s: trying to change BAR%u from %04X to %04X\n",
    598 + pci_name(dev), index,
    599 + (unsigned)pci_resource_start(dev, index), base);
    600 + pci_write_config_dword(dev, PCI_BASE_ADDRESS_0 + index * 4, base);
    601 + }
    602 + pci_resource_start(dev, index) = start;
    603 + pci_resource_end(dev, index) = end;
    604 + pci_resource_flags(dev, index) =
    605 + IORESOURCE_IO | IORESOURCE_PCI_FIXED | PCI_BASE_ADDRESS_SPACE_IO;
    606 +}
    607
    608 /**
    609 * pci_setup_device - fill in class and map information of a device
    610 @@ -692,20 +719,12 @@ static int pci_setup_device(struct pci_dev * dev)
    611 u8 progif;
    612 pci_read_config_byte(dev, PCI_CLASS_PROG, &progif);
    613 if ((progif & 1) == 0) {
    614 - dev->resource[0].start = 0x1F0;
    615 - dev->resource[0].end = 0x1F7;
    616 - dev->resource[0].flags = LEGACY_IO_RESOURCE;
    617 - dev->resource[1].start = 0x3F6;
    618 - dev->resource[1].end = 0x3F6;
    619 - dev->resource[1].flags = LEGACY_IO_RESOURCE;
    620 + change_legacy_io_resource(dev, 0, 0x1F0, 0x1F7);
    621 + change_legacy_io_resource(dev, 1, 0x3F6, 0x3F6);
    622 }
    623 if ((progif & 4) == 0) {
    624 - dev->resource[2].start = 0x170;
    625 - dev->resource[2].end = 0x177;
    626 - dev->resource[2].flags = LEGACY_IO_RESOURCE;
    627 - dev->resource[3].start = 0x376;
    628 - dev->resource[3].end = 0x376;
    629 - dev->resource[3].flags = LEGACY_IO_RESOURCE;
    630 + change_legacy_io_resource(dev, 2, 0x170, 0x177);
    631 + change_legacy_io_resource(dev, 3, 0x376, 0x376);
    632 }
    633 }
    634 break;
    635 diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
    636 index 4c698a7..df10267 100644
    637 --- a/drivers/scsi/gdth.c
    638 +++ b/drivers/scsi/gdth.c
    639 @@ -3092,6 +3092,7 @@ static int gdth_fill_raw_cmd(int hanum,Scsi_Cmnd *scp,unchar b)
    640 cmdp->u.raw64.direction =
    641 gdth_direction_tab[scp->cmnd[0]]==DOU ? GDTH_DATA_OUT:GDTH_DATA_IN;
    642 memcpy(cmdp->u.raw64.cmd,scp->cmnd,16);
    643 + cmdp->u.raw64.sg_ranz = 0;
    644 } else {
    645 cmdp->u.raw.reserved = 0;
    646 cmdp->u.raw.mdisc_time = 0;
    647 @@ -3108,6 +3109,7 @@ static int gdth_fill_raw_cmd(int hanum,Scsi_Cmnd *scp,unchar b)
    648 cmdp->u.raw.direction =
    649 gdth_direction_tab[scp->cmnd[0]]==DOU ? GDTH_DATA_OUT:GDTH_DATA_IN;
    650 memcpy(cmdp->u.raw.cmd,scp->cmnd,12);
    651 + cmdp->u.raw.sg_ranz = 0;
    652 }
    653
    654 if (scp->use_sg) {
    655 diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
    656 index 488ec79..16e279b 100644
    657 --- a/drivers/scsi/st.c
    658 +++ b/drivers/scsi/st.c
    659 @@ -9,7 +9,7 @@
    660 Steve Hirsch, Andreas Koppenh"ofer, Michael Leodolter, Eyal Lebedinsky,
    661 Michael Schaefer, J"org Weule, and Eric Youngdale.
    662
    663 - Copyright 1992 - 2006 Kai Makisara
    664 + Copyright 1992 - 2007 Kai Makisara
    665 email Kai.Makisara@kolumbus.fi
    666
    667 Some small formal changes - aeb, 950809
    668 @@ -17,7 +17,7 @@
    669 Last modified: 18-JAN-1998 Richard Gooch <rgooch@atnf.csiro.au> Devfs support
    670 */
    671
    672 -static const char *verstr = "20061107";
    673 +static const char *verstr = "20070203";
    674
    675 #include <linux/module.h>
    676
    677 @@ -1168,6 +1168,7 @@ static int st_open(struct inode *inode, struct file *filp)
    678 STps = &(STp->ps[i]);
    679 STps->rw = ST_IDLE;
    680 }
    681 + STp->try_dio_now = STp->try_dio;
    682 STp->recover_count = 0;
    683 DEB( STp->nbr_waits = STp->nbr_finished = 0;
    684 STp->nbr_requests = STp->nbr_dio = STp->nbr_pages = STp->nbr_combinable = 0; )
    685 @@ -1400,9 +1401,9 @@ static int setup_buffering(struct scsi_tape *STp, const char __user *buf,
    686 struct st_buffer *STbp = STp->buffer;
    687
    688 if (is_read)
    689 - i = STp->try_dio && try_rdio;
    690 + i = STp->try_dio_now && try_rdio;
    691 else
    692 - i = STp->try_dio && try_wdio;
    693 + i = STp->try_dio_now && try_wdio;
    694
    695 if (i && ((unsigned long)buf & queue_dma_alignment(
    696 STp->device->request_queue)) == 0) {
    697 @@ -1599,7 +1600,7 @@ st_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
    698 STm->do_async_writes && STps->eof < ST_EOM_OK;
    699
    700 if (STp->block_size != 0 && STm->do_buffer_writes &&
    701 - !(STp->try_dio && try_wdio) && STps->eof < ST_EOM_OK &&
    702 + !(STp->try_dio_now && try_wdio) && STps->eof < ST_EOM_OK &&
    703 STbp->buffer_bytes < STbp->buffer_size) {
    704 STp->dirty = 1;
    705 /* Don't write a buffer that is not full enough. */
    706 @@ -1769,7 +1770,7 @@ static long read_tape(struct scsi_tape *STp, long count,
    707 if (STp->block_size == 0)
    708 blks = bytes = count;
    709 else {
    710 - if (!(STp->try_dio && try_rdio) && STm->do_read_ahead) {
    711 + if (!(STp->try_dio_now && try_rdio) && STm->do_read_ahead) {
    712 blks = (STp->buffer)->buffer_blocks;
    713 bytes = blks * STp->block_size;
    714 } else {
    715 @@ -1948,10 +1949,12 @@ st_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos)
    716 goto out;
    717
    718 STm = &(STp->modes[STp->current_mode]);
    719 - if (!(STm->do_read_ahead) && STp->block_size != 0 &&
    720 - (count % STp->block_size) != 0) {
    721 - retval = (-EINVAL); /* Read must be integral number of blocks */
    722 - goto out;
    723 + if (STp->block_size != 0 && (count % STp->block_size) != 0) {
    724 + if (!STm->do_read_ahead) {
    725 + retval = (-EINVAL); /* Read must be integral number of blocks */
    726 + goto out;
    727 + }
    728 + STp->try_dio_now = 0; /* Direct i/o can't handle split blocks */
    729 }
    730
    731 STps = &(STp->ps[STp->partition]);
    732 diff --git a/drivers/scsi/st.h b/drivers/scsi/st.h
    733 index 05a5cae..50f3deb 100644
    734 --- a/drivers/scsi/st.h
    735 +++ b/drivers/scsi/st.h
    736 @@ -117,7 +117,8 @@ struct scsi_tape {
    737 unsigned char cln_sense_value;
    738 unsigned char cln_sense_mask;
    739 unsigned char use_pf; /* Set Page Format bit in all mode selects? */
    740 - unsigned char try_dio; /* try direct i/o? */
    741 + unsigned char try_dio; /* try direct i/o in general? */
    742 + unsigned char try_dio_now; /* try direct i/o before next close? */
    743 unsigned char c_algo; /* compression algorithm */
    744 unsigned char pos_unknown; /* after reset position unknown */
    745 int tape_type;
    746 diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
    747 index bfe5f30..2d36a8d 100644
    748 --- a/drivers/usb/host/ehci-hub.c
    749 +++ b/drivers/usb/host/ehci-hub.c
    750 @@ -134,6 +134,10 @@ static int ehci_bus_resume (struct usb_hcd *hcd)
    751 /* restore CMD_RUN, framelist size, and irq threshold */
    752 writel (ehci->command, &ehci->regs->command);
    753
    754 + /* Some controller/firmware combinations need a delay during which
    755 + * they set up the port statuses. See Bugzilla #8190. */
    756 + mdelay(8);
    757 +
    758 /* manually resume the ports we suspended during bus_suspend() */
    759 i = HCS_N_PORTS (ehci->hcs_params);
    760 while (i--) {
    761 diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
    762 index d834982..5a83e8d 100644
    763 --- a/fs/nfs/inode.c
    764 +++ b/fs/nfs/inode.c
    765 @@ -422,7 +422,8 @@ int nfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat)
    766 int err;
    767
    768 /* Flush out writes to the server in order to update c/mtime */
    769 - nfs_sync_mapping_range(inode->i_mapping, 0, 0, FLUSH_NOCOMMIT);
    770 + if (S_ISREG(inode->i_mode))
    771 + nfs_sync_mapping_range(inode->i_mapping, 0, 0, FLUSH_NOCOMMIT);
    772
    773 /*
    774 * We may force a getattr if the user cares about atime.
    775 diff --git a/include/asm-sparc64/tsb.h b/include/asm-sparc64/tsb.h
    776 index e82612c..ab55ffc 100644
    777 --- a/include/asm-sparc64/tsb.h
    778 +++ b/include/asm-sparc64/tsb.h
    779 @@ -264,6 +264,7 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
    780 be,a,pt %xcc, OK_LABEL; \
    781 mov REG4, REG1;
    782
    783 +#ifndef CONFIG_DEBUG_PAGEALLOC
    784 /* This version uses a trick, the TAG is already (VADDR >> 22) so
    785 * we can make use of that for the index computation.
    786 */
    787 @@ -277,5 +278,6 @@ extern struct tsb_phys_patch_entry __tsb_phys_patch, __tsb_phys_patch_end;
    788 cmp REG3, TAG; \
    789 be,a,pt %xcc, OK_LABEL; \
    790 mov REG4, REG1;
    791 +#endif
    792
    793 #endif /* !(_SPARC64_TSB_H) */
    794 diff --git a/include/asm-um/processor-x86_64.h b/include/asm-um/processor-x86_64.h
    795 index 10609af..578ca04 100644
    796 --- a/include/asm-um/processor-x86_64.h
    797 +++ b/include/asm-um/processor-x86_64.h
    798 @@ -13,6 +13,7 @@
    799 struct arch_thread {
    800 unsigned long debugregs[8];
    801 int debugregs_seq;
    802 + unsigned long fs;
    803 struct faultinfo faultinfo;
    804 };
    805
    806 @@ -25,8 +26,9 @@ extern inline void rep_nop(void)
    807 #define cpu_relax() rep_nop()
    808
    809 #define INIT_ARCH_THREAD { .debugregs = { [ 0 ... 7 ] = 0 }, \
    810 - .debugregs_seq = 0, \
    811 - .faultinfo = { 0, 0, 0 } }
    812 + .debugregs_seq = 0, \
    813 + .fs = 0, \
    814 + .faultinfo = { 0, 0, 0 } }
    815
    816 static inline void arch_flush_thread(struct arch_thread *thread)
    817 {
    818 diff --git a/include/asm-um/ptrace-x86_64.h b/include/asm-um/ptrace-x86_64.h
    819 index 03b4af4..a927450 100644
    820 --- a/include/asm-um/ptrace-x86_64.h
    821 +++ b/include/asm-um/ptrace-x86_64.h
    822 @@ -81,9 +81,7 @@ static inline void arch_switch_to_tt(struct task_struct *from,
    823 {
    824 }
    825
    826 -static inline void arch_switch_to_skas(struct task_struct *from,
    827 - struct task_struct *to)
    828 -{
    829 -}
    830 +extern void arch_switch_to_skas(struct task_struct *from,
    831 + struct task_struct *to);
    832
    833 #endif
    834 diff --git a/include/linux/ktime.h b/include/linux/ktime.h
    835 index 611f17f..83ae2e7 100644
    836 --- a/include/linux/ktime.h
    837 +++ b/include/linux/ktime.h
    838 @@ -57,7 +57,11 @@ typedef union {
    839 } ktime_t;
    840
    841 #define KTIME_MAX ((s64)~((u64)1 << 63))
    842 -#define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC)
    843 +#if (BITS_PER_LONG == 64)
    844 +# define KTIME_SEC_MAX (KTIME_MAX / NSEC_PER_SEC)
    845 +#else
    846 +# define KTIME_SEC_MAX LONG_MAX
    847 +#endif
    848
    849 /*
    850 * ktime_t definitions when using the 64-bit scalar representation:
    851 diff --git a/kernel/auditsc.c b/kernel/auditsc.c
    852 index 2988975..470f845 100644
    853 --- a/kernel/auditsc.c
    854 +++ b/kernel/auditsc.c
    855 @@ -734,28 +734,26 @@ static inline void audit_free_context(struct audit_context *context)
    856 void audit_log_task_context(struct audit_buffer *ab)
    857 {
    858 char *ctx = NULL;
    859 - ssize_t len = 0;
    860 + unsigned len;
    861 + int error;
    862 + u32 sid;
    863 +
    864 + selinux_get_task_sid(current, &sid);
    865 + if (!sid)
    866 + return;
    867
    868 - len = security_getprocattr(current, "current", NULL, 0);
    869 - if (len < 0) {
    870 - if (len != -EINVAL)
    871 + error = selinux_sid_to_string(sid, &ctx, &len);
    872 + if (error) {
    873 + if (error != -EINVAL)
    874 goto error_path;
    875 return;
    876 }
    877
    878 - ctx = kmalloc(len, GFP_KERNEL);
    879 - if (!ctx)
    880 - goto error_path;
    881 -
    882 - len = security_getprocattr(current, "current", ctx, len);
    883 - if (len < 0 )
    884 - goto error_path;
    885 -
    886 audit_log_format(ab, " subj=%s", ctx);
    887 + kfree(ctx);
    888 return;
    889
    890 error_path:
    891 - kfree(ctx);
    892 audit_panic("error in audit_log_task_context");
    893 return;
    894 }
    895 diff --git a/kernel/fork.c b/kernel/fork.c
    896 index d57118d..cc374fb 100644
    897 --- a/kernel/fork.c
    898 +++ b/kernel/fork.c
    899 @@ -933,8 +933,8 @@ asmlinkage long sys_set_tid_address(int __user *tidptr)
    900
    901 static inline void rt_mutex_init_task(struct task_struct *p)
    902 {
    903 -#ifdef CONFIG_RT_MUTEXES
    904 spin_lock_init(&p->pi_lock);
    905 +#ifdef CONFIG_RT_MUTEXES
    906 plist_head_init(&p->pi_waiters, &p->pi_lock);
    907 p->pi_blocked_on = NULL;
    908 #endif
    909 diff --git a/kernel/futex.c b/kernel/futex.c
    910 index 5a737de..1df411e 100644
    911 --- a/kernel/futex.c
    912 +++ b/kernel/futex.c
    913 @@ -565,6 +565,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
    914 if (!pi_state)
    915 return -EINVAL;
    916
    917 + spin_lock(&pi_state->pi_mutex.wait_lock);
    918 new_owner = rt_mutex_next_owner(&pi_state->pi_mutex);
    919
    920 /*
    921 @@ -604,6 +605,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
    922 pi_state->owner = new_owner;
    923 spin_unlock_irq(&new_owner->pi_lock);
    924
    925 + spin_unlock(&pi_state->pi_mutex.wait_lock);
    926 rt_mutex_unlock(&pi_state->pi_mutex);
    927
    928 return 0;
    929 diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
    930 index d0ba190..8596409 100644
    931 --- a/kernel/hrtimer.c
    932 +++ b/kernel/hrtimer.c
    933 @@ -332,6 +332,12 @@ hrtimer_forward(struct hrtimer *timer, ktime_t now, ktime_t interval)
    934 orun++;
    935 }
    936 timer->expires = ktime_add(timer->expires, interval);
    937 + /*
    938 + * Make sure, that the result did not wrap with a very large
    939 + * interval.
    940 + */
    941 + if (timer->expires.tv64 < 0)
    942 + timer->expires = ktime_set(KTIME_SEC_MAX, 0);
    943
    944 return orun;
    945 }
    946 diff --git a/mm/filemap.c b/mm/filemap.c
    947 index 8332c77..ab57e6c 100644
    948 --- a/mm/filemap.c
    949 +++ b/mm/filemap.c
    950 @@ -2393,7 +2393,8 @@ generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
    951 struct file *file = iocb->ki_filp;
    952 struct address_space *mapping = file->f_mapping;
    953 ssize_t retval;
    954 - size_t write_len = 0;
    955 + size_t write_len;
    956 + pgoff_t end = 0; /* silence gcc */
    957
    958 /*
    959 * If it's a write, unmap all mmappings of the file up-front. This
    960 @@ -2402,23 +2403,46 @@ generic_file_direct_IO(int rw, struct kiocb *iocb, const struct iovec *iov,
    961 */
    962 if (rw == WRITE) {
    963 write_len = iov_length(iov, nr_segs);
    964 + end = (offset + write_len - 1) >> PAGE_CACHE_SHIFT;
    965 if (mapping_mapped(mapping))
    966 unmap_mapping_range(mapping, offset, write_len, 0);
    967 }
    968
    969 retval = filemap_write_and_wait(mapping);
    970 - if (retval == 0) {
    971 - retval = mapping->a_ops->direct_IO(rw, iocb, iov,
    972 - offset, nr_segs);
    973 - if (rw == WRITE && mapping->nrpages) {
    974 - pgoff_t end = (offset + write_len - 1)
    975 - >> PAGE_CACHE_SHIFT;
    976 - int err = invalidate_inode_pages2_range(mapping,
    977 + if (retval)
    978 + goto out;
    979 +
    980 + /*
    981 + * After a write we want buffered reads to be sure to go to disk to get
    982 + * the new data. We invalidate clean cached page from the region we're
    983 + * about to write. We do this *before* the write so that we can return
    984 + * -EIO without clobbering -EIOCBQUEUED from ->direct_IO().
    985 + */
    986 + if (rw == WRITE && mapping->nrpages) {
    987 + retval = invalidate_inode_pages2_range(mapping,
    988 offset >> PAGE_CACHE_SHIFT, end);
    989 - if (err)
    990 - retval = err;
    991 - }
    992 + if (retval)
    993 + goto out;
    994 }
    995 +
    996 + retval = mapping->a_ops->direct_IO(rw, iocb, iov, offset, nr_segs);
    997 + if (retval)
    998 + goto out;
    999 +
    1000 + /*
    1001 + * Finally, try again to invalidate clean pages which might have been
    1002 + * faulted in by get_user_pages() if the source of the write was an
    1003 + * mmap()ed region of the file we're writing. That's a pretty crazy
    1004 + * thing to do, so we don't support it 100%. If this invalidation
    1005 + * fails and we have -EIOCBQUEUED we ignore the failure.
    1006 + */
    1007 + if (rw == WRITE && mapping->nrpages) {
    1008 + int err = invalidate_inode_pages2_range(mapping,
    1009 + offset >> PAGE_CACHE_SHIFT, end);
    1010 + if (err && retval >= 0)
    1011 + retval = err;
    1012 + }
    1013 +out:
    1014 return retval;
    1015 }
    1016
    1017 diff --git a/mm/madvise.c b/mm/madvise.c
    1018 index 4e19615..77916e9 100644
    1019 --- a/mm/madvise.c
    1020 +++ b/mm/madvise.c
    1021 @@ -155,11 +155,14 @@ static long madvise_dontneed(struct vm_area_struct * vma,
    1022 * Other filesystems return -ENOSYS.
    1023 */
    1024 static long madvise_remove(struct vm_area_struct *vma,
    1025 + struct vm_area_struct **prev,
    1026 unsigned long start, unsigned long end)
    1027 {
    1028 struct address_space *mapping;
    1029 loff_t offset, endoff;
    1030
    1031 + *prev = vma;
    1032 +
    1033 if (vma->vm_flags & (VM_LOCKED|VM_NONLINEAR|VM_HUGETLB))
    1034 return -EINVAL;
    1035
    1036 @@ -199,7 +202,7 @@ madvise_vma(struct vm_area_struct *vma, struct vm_area_struct **prev,
    1037 error = madvise_behavior(vma, prev, start, end, behavior);
    1038 break;
    1039 case MADV_REMOVE:
    1040 - error = madvise_remove(vma, start, end);
    1041 + error = madvise_remove(vma, prev, start, end);
    1042 break;
    1043
    1044 case MADV_WILLNEED:
    1045 diff --git a/mm/oom_kill.c b/mm/oom_kill.c
    1046 index b278b8d..2f39169 100644
    1047 --- a/mm/oom_kill.c
    1048 +++ b/mm/oom_kill.c
    1049 @@ -320,7 +320,7 @@ static int oom_kill_task(struct task_struct *p)
    1050 * Don't kill the process if any threads are set to OOM_DISABLE
    1051 */
    1052 do_each_thread(g, q) {
    1053 - if (q->mm == mm && p->oomkilladj == OOM_DISABLE)
    1054 + if (q->mm == mm && q->oomkilladj == OOM_DISABLE)
    1055 return 1;
    1056 } while_each_thread(g, q);
    1057
    1058 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
    1059 index de7801d..5299083 100644
    1060 --- a/net/core/skbuff.c
    1061 +++ b/net/core/skbuff.c
    1062 @@ -464,6 +464,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
    1063 memcpy(n->cb, skb->cb, sizeof(skb->cb));
    1064 C(len);
    1065 C(data_len);
    1066 + C(mac_len);
    1067 C(csum);
    1068 C(local_df);
    1069 n->cloned = 1;
    1070 diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
    1071 index 60aafb4..c976dd7 100644
    1072 --- a/net/ipv4/cipso_ipv4.c
    1073 +++ b/net/ipv4/cipso_ipv4.c
    1074 @@ -732,11 +732,12 @@ static int cipso_v4_map_lvl_hton(const struct cipso_v4_doi *doi_def,
    1075 *net_lvl = host_lvl;
    1076 return 0;
    1077 case CIPSO_V4_MAP_STD:
    1078 - if (host_lvl < doi_def->map.std->lvl.local_size) {
    1079 + if (host_lvl < doi_def->map.std->lvl.local_size &&
    1080 + doi_def->map.std->lvl.local[host_lvl] < CIPSO_V4_INV_LVL) {
    1081 *net_lvl = doi_def->map.std->lvl.local[host_lvl];
    1082 return 0;
    1083 }
    1084 - break;
    1085 + return -EPERM;
    1086 }
    1087
    1088 return -EINVAL;
    1089 @@ -771,7 +772,7 @@ static int cipso_v4_map_lvl_ntoh(const struct cipso_v4_doi *doi_def,
    1090 *host_lvl = doi_def->map.std->lvl.cipso[net_lvl];
    1091 return 0;
    1092 }
    1093 - break;
    1094 + return -EPERM;
    1095 }
    1096
    1097 return -EINVAL;
    1098 diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
    1099 index 480ace9..728ba5f 100644
    1100 --- a/net/ipv4/devinet.c
    1101 +++ b/net/ipv4/devinet.c
    1102 @@ -503,8 +503,10 @@ static struct in_ifaddr *rtm_to_ifaddr(struct nlmsghdr *nlh)
    1103 goto errout;
    1104
    1105 ifm = nlmsg_data(nlh);
    1106 - if (ifm->ifa_prefixlen > 32 || tb[IFA_LOCAL] == NULL)
    1107 + if (ifm->ifa_prefixlen > 32 || tb[IFA_LOCAL] == NULL) {
    1108 + err = -EINVAL;
    1109 goto errout;
    1110 + }
    1111
    1112 dev = __dev_get_by_index(ifm->ifa_index);
    1113 if (dev == NULL) {
    1114 diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
    1115 index 1e589b9..a742ea3 100644
    1116 --- a/net/ipv4/fib_trie.c
    1117 +++ b/net/ipv4/fib_trie.c
    1118 @@ -1528,7 +1528,6 @@ static int trie_leaf_remove(struct trie *t, t_key key)
    1119 t->revision++;
    1120 t->size--;
    1121
    1122 - preempt_disable();
    1123 tp = NODE_PARENT(n);
    1124 tnode_free((struct tnode *) n);
    1125
    1126 @@ -1538,7 +1537,6 @@ static int trie_leaf_remove(struct trie *t, t_key key)
    1127 rcu_assign_pointer(t->trie, trie_rebalance(t, tp));
    1128 } else
    1129 rcu_assign_pointer(t->trie, NULL);
    1130 - preempt_enable();
    1131
    1132 return 1;
    1133 }
    1134 diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
    1135 index 23db88e..b20726f 100644
    1136 --- a/net/ipv6/ipv6_sockglue.c
    1137 +++ b/net/ipv6/ipv6_sockglue.c
    1138 @@ -414,7 +414,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
    1139 }
    1140
    1141 /* routing header option needs extra check */
    1142 - if (optname == IPV6_RTHDR && opt->srcrt) {
    1143 + if (optname == IPV6_RTHDR && opt && opt->srcrt) {
    1144 struct ipv6_rt_hdr *rthdr = opt->srcrt;
    1145 switch (rthdr->type) {
    1146 case IPV6_SRCRT_TYPE_0:
    1147 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
    1148 index c25e930..a2d41ba 100644
    1149 --- a/net/ipv6/tcp_ipv6.c
    1150 +++ b/net/ipv6/tcp_ipv6.c
    1151 @@ -1453,6 +1453,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
    1152 First: no IPv4 options.
    1153 */
    1154 newinet->opt = NULL;
    1155 + newnp->ipv6_fl_list = NULL;
    1156
    1157 /* Clone RX bits */
    1158 newnp->rxopt.all = np->rxopt.all;
    1159 diff --git a/net/irda/irttp.c b/net/irda/irttp.c
    1160 index 03504f3..4703107 100644
    1161 --- a/net/irda/irttp.c
    1162 +++ b/net/irda/irttp.c
    1163 @@ -1455,6 +1455,7 @@ struct tsap_cb *irttp_dup(struct tsap_cb *orig, void *instance)
    1164
    1165 /* Not everything should be copied */
    1166 new->notify.instance = instance;
    1167 + spin_lock_init(&new->lock);
    1168 init_timer(&new->todo_timer);
    1169
    1170 skb_queue_head_init(&new->rx_queue);
    1171 diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
    1172 index 690b173..f7eafd8 100644
    1173 --- a/net/netfilter/nfnetlink_log.c
    1174 +++ b/net/netfilter/nfnetlink_log.c
    1175 @@ -218,10 +218,8 @@ _instance_destroy2(struct nfulnl_instance *inst, int lock)
    1176 spin_lock_bh(&inst->lock);
    1177 if (inst->skb) {
    1178 /* timer "holds" one reference (we have one more) */
    1179 - if (timer_pending(&inst->timer)) {
    1180 - del_timer(&inst->timer);
    1181 + if (del_timer(&inst->timer))
    1182 instance_put(inst);
    1183 - }
    1184 if (inst->qlen)
    1185 __nfulnl_send(inst);
    1186 if (inst->skb) {
    1187 @@ -695,10 +693,8 @@ nfulnl_log_packet(unsigned int pf,
    1188 UDEBUG("flushing old skb\n");
    1189
    1190 /* timer "holds" one reference (we have another one) */
    1191 - if (timer_pending(&inst->timer)) {
    1192 - del_timer(&inst->timer);
    1193 + if (del_timer(&inst->timer))
    1194 instance_put(inst);
    1195 - }
    1196 __nfulnl_send(inst);
    1197
    1198 if (!(inst->skb = nfulnl_alloc_skb(nlbufsiz, size))) {
    1199 diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
    1200 index fdb08d9..f0f2c1a 100644
    1201 --- a/net/xfrm/xfrm_state.c
    1202 +++ b/net/xfrm/xfrm_state.c
    1203 @@ -707,7 +707,8 @@ static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 re
    1204 x->props.mode != mode ||
    1205 x->props.family != family ||
    1206 x->km.state != XFRM_STATE_ACQ ||
    1207 - x->id.spi != 0)
    1208 + x->id.spi != 0 ||
    1209 + x->id.proto != proto)
    1210 continue;
    1211
    1212 switch (family) {
    1213 @@ -804,7 +805,8 @@ int xfrm_state_add(struct xfrm_state *x)
    1214
    1215 if (use_spi && x->km.seq) {
    1216 x1 = __xfrm_find_acq_byseq(x->km.seq);
    1217 - if (x1 && xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family)) {
    1218 + if (x1 && ((x1->id.proto != x->id.proto) ||
    1219 + xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
    1220 xfrm_state_put(x1);
    1221 x1 = NULL;
    1222 }
    1223 diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
    1224 index 77f8ec7..ba2c754 100644
    1225 --- a/sound/pci/hda/hda_intel.c
    1226 +++ b/sound/pci/hda/hda_intel.c
    1227 @@ -199,7 +199,6 @@ enum { SDI0, SDI1, SDI2, SDI3, SDO0, SDO1, SDO2, SDO3 };
    1228
    1229 /* STATESTS int mask: SD2,SD1,SD0 */
    1230 #define STATESTS_INT_MASK 0x07
    1231 -#define AZX_MAX_CODECS 3
    1232
    1233 /* SD_CTL bits */
    1234 #define SD_CTL_STREAM_RESET 0x01 /* stream reset bit */
    1235 @@ -966,6 +965,16 @@ static int azx_setup_controller(struct azx *chip, struct azx_dev *azx_dev)
    1236 * Codec initialization
    1237 */
    1238
    1239 +static unsigned int azx_max_codecs[] __devinitdata = {
    1240 + [AZX_DRIVER_ICH] = 3,
    1241 + [AZX_DRIVER_ATI] = 4,
    1242 + [AZX_DRIVER_ATIHDMI] = 4,
    1243 + [AZX_DRIVER_VIA] = 3, /* FIXME: correct? */
    1244 + [AZX_DRIVER_SIS] = 3, /* FIXME: correct? */
    1245 + [AZX_DRIVER_ULI] = 3, /* FIXME: correct? */
    1246 + [AZX_DRIVER_NVIDIA] = 3, /* FIXME: correct? */
    1247 +};
    1248 +
    1249 static int __devinit azx_codec_create(struct azx *chip, const char *model)
    1250 {
    1251 struct hda_bus_template bus_temp;
    1252 @@ -982,7 +991,7 @@ static int __devinit azx_codec_create(struct azx *chip, const char *model)
    1253 return err;
    1254
    1255 codecs = 0;
    1256 - for (c = 0; c < AZX_MAX_CODECS; c++) {
    1257 + for (c = 0; c < azx_max_codecs[chip->driver_type]; c++) {
    1258 if ((chip->codec_mask & (1 << c)) & probe_mask) {
    1259 err = snd_hda_codec_new(chip->bus, c, NULL);
    1260 if (err < 0)