Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-2.6.27-r3/0117-2.6.27.18-all-fixes.patch

    Contents of /trunk/kernel26-alx/patches-2.6.27-r3/0117-2.6.27.18-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1176 - (show annotations) (download)
    Thu Oct 14 15:11:06 2010 UTC (13 years, 7 months ago) by niro
    File size: 59641 byte(s) 
    -2.6.27-alx-r3: new magellan 0.5.2 kernel
    1 diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
    2 index 3e80aa3..a6a4310 100644
    3 --- a/arch/powerpc/kernel/signal_32.c
    4 +++ b/arch/powerpc/kernel/signal_32.c
    5 @@ -410,7 +410,7 @@ inline unsigned long copy_fpr_from_user(struct task_struct *task,
    6 * altivec/spe instructions at some point.
    7 */
    8 static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
    9 - int sigret)
    10 + int sigret, int ctx_has_vsx_region)
    11 {
    12 unsigned long msr = regs->msr;
    13
    14 @@ -451,7 +451,7 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
    15 * the saved MSR value to indicate that frame->mc_vregs
    16 * contains valid data
    17 */
    18 - if (current->thread.used_vsr) {
    19 + if (current->thread.used_vsr && ctx_has_vsx_region) {
    20 __giveup_vsx(current);
    21 if (copy_vsx_to_user(&frame->mc_vsregs, current))
    22 return 1;
    23 @@ -858,11 +858,11 @@ int handle_rt_signal32(unsigned long sig, struct k_sigaction *ka,
    24 frame = &rt_sf->uc.uc_mcontext;
    25 addr = frame;
    26 if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
    27 - if (save_user_regs(regs, frame, 0))
    28 + if (save_user_regs(regs, frame, 0, 1))
    29 goto badframe;
    30 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
    31 } else {
    32 - if (save_user_regs(regs, frame, __NR_rt_sigreturn))
    33 + if (save_user_regs(regs, frame, __NR_rt_sigreturn, 1))
    34 goto badframe;
    35 regs->link = (unsigned long) frame->tramp;
    36 }
    37 @@ -936,12 +936,13 @@ long sys_swapcontext(struct ucontext __user *old_ctx,
    38 int ctx_size, int r6, int r7, int r8, struct pt_regs *regs)
    39 {
    40 unsigned char tmp;
    41 + int ctx_has_vsx_region = 0;
    42
    43 #ifdef CONFIG_PPC64
    44 unsigned long new_msr = 0;
    45
    46 if (new_ctx &&
    47 - __get_user(new_msr, &new_ctx->uc_mcontext.mc_gregs[PT_MSR]))
    48 + get_user(new_msr, &new_ctx->uc_mcontext.mc_gregs[PT_MSR]))
    49 return -EFAULT;
    50 /*
    51 * Check that the context is not smaller than the original
    52 @@ -956,16 +957,9 @@ long sys_swapcontext(struct ucontext __user *old_ctx,
    53 if ((ctx_size < sizeof(struct ucontext)) &&
    54 (new_msr & MSR_VSX))
    55 return -EINVAL;
    56 -#ifdef CONFIG_VSX
    57 - /*
    58 - * If userspace doesn't provide enough room for VSX data,
    59 - * but current thread has used VSX, we don't have anywhere
    60 - * to store the full context back into.
    61 - */
    62 - if ((ctx_size < sizeof(struct ucontext)) &&
    63 - (current->thread.used_vsr && old_ctx))
    64 - return -EINVAL;
    65 -#endif
    66 + /* Does the context have enough room to store VSX data? */
    67 + if (ctx_size >= sizeof(struct ucontext))
    68 + ctx_has_vsx_region = 1;
    69 #else
    70 /* Context size is for future use. Right now, we only make sure
    71 * we are passed something we understand
    72 @@ -985,17 +979,17 @@ long sys_swapcontext(struct ucontext __user *old_ctx,
    73 */
    74 mctx = (struct mcontext __user *)
    75 ((unsigned long) &old_ctx->uc_mcontext & ~0xfUL);
    76 - if (!access_ok(VERIFY_WRITE, old_ctx, sizeof(*old_ctx))
    77 - || save_user_regs(regs, mctx, 0)
    78 + if (!access_ok(VERIFY_WRITE, old_ctx, ctx_size)
    79 + || save_user_regs(regs, mctx, 0, ctx_has_vsx_region)
    80 || put_sigset_t(&old_ctx->uc_sigmask, &current->blocked)
    81 || __put_user(to_user_ptr(mctx), &old_ctx->uc_regs))
    82 return -EFAULT;
    83 }
    84 if (new_ctx == NULL)
    85 return 0;
    86 - if (!access_ok(VERIFY_READ, new_ctx, sizeof(*new_ctx))
    87 + if (!access_ok(VERIFY_READ, new_ctx, ctx_size)
    88 || __get_user(tmp, (u8 __user *) new_ctx)
    89 - || __get_user(tmp, (u8 __user *) (new_ctx + 1) - 1))
    90 + || __get_user(tmp, (u8 __user *) new_ctx + ctx_size - 1))
    91 return -EFAULT;
    92
    93 /*
    94 @@ -1196,11 +1190,11 @@ int handle_signal32(unsigned long sig, struct k_sigaction *ka,
    95 goto badframe;
    96
    97 if (vdso32_sigtramp && current->mm->context.vdso_base) {
    98 - if (save_user_regs(regs, &frame->mctx, 0))
    99 + if (save_user_regs(regs, &frame->mctx, 0, 1))
    100 goto badframe;
    101 regs->link = current->mm->context.vdso_base + vdso32_sigtramp;
    102 } else {
    103 - if (save_user_regs(regs, &frame->mctx, __NR_sigreturn))
    104 + if (save_user_regs(regs, &frame->mctx, __NR_sigreturn, 1))
    105 goto badframe;
    106 regs->link = (unsigned long) frame->mctx.tramp;
    107 }
    108 diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
    109 index 65ad925..e4acdbd 100644
    110 --- a/arch/powerpc/kernel/signal_64.c
    111 +++ b/arch/powerpc/kernel/signal_64.c
    112 @@ -74,7 +74,8 @@ static const char fmt64[] = KERN_INFO \
    113 */
    114
    115 static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
    116 - int signr, sigset_t *set, unsigned long handler)
    117 + int signr, sigset_t *set, unsigned long handler,
    118 + int ctx_has_vsx_region)
    119 {
    120 /* When CONFIG_ALTIVEC is set, we _always_ setup v_regs even if the
    121 * process never used altivec yet (MSR_VEC is zero in pt_regs of
    122 @@ -121,7 +122,7 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
    123 * then out to userspace. Update v_regs to point after the
    124 * VMX data.
    125 */
    126 - if (current->thread.used_vsr) {
    127 + if (current->thread.used_vsr && ctx_has_vsx_region) {
    128 __giveup_vsx(current);
    129 v_regs += ELF_NVRREG;
    130 err |= copy_vsx_to_user(v_regs, current);
    131 @@ -284,9 +285,10 @@ int sys_swapcontext(struct ucontext __user *old_ctx,
    132 unsigned char tmp;
    133 sigset_t set;
    134 unsigned long new_msr = 0;
    135 + int ctx_has_vsx_region = 0;
    136
    137 if (new_ctx &&
    138 - __get_user(new_msr, &new_ctx->uc_mcontext.gp_regs[PT_MSR]))
    139 + get_user(new_msr, &new_ctx->uc_mcontext.gp_regs[PT_MSR]))
    140 return -EFAULT;
    141 /*
    142 * Check that the context is not smaller than the original
    143 @@ -301,28 +303,23 @@ int sys_swapcontext(struct ucontext __user *old_ctx,
    144 if ((ctx_size < sizeof(struct ucontext)) &&
    145 (new_msr & MSR_VSX))
    146 return -EINVAL;
    147 -#ifdef CONFIG_VSX
    148 - /*
    149 - * If userspace doesn't provide enough room for VSX data,
    150 - * but current thread has used VSX, we don't have anywhere
    151 - * to store the full context back into.
    152 - */
    153 - if ((ctx_size < sizeof(struct ucontext)) &&
    154 - (current->thread.used_vsr && old_ctx))
    155 - return -EINVAL;
    156 -#endif
    157 + /* Does the context have enough room to store VSX data? */
    158 + if (ctx_size >= sizeof(struct ucontext))
    159 + ctx_has_vsx_region = 1;
    160 +
    161 if (old_ctx != NULL) {
    162 - if (!access_ok(VERIFY_WRITE, old_ctx, sizeof(*old_ctx))
    163 - || setup_sigcontext(&old_ctx->uc_mcontext, regs, 0, NULL, 0)
    164 + if (!access_ok(VERIFY_WRITE, old_ctx, ctx_size)
    165 + || setup_sigcontext(&old_ctx->uc_mcontext, regs, 0, NULL, 0,
    166 + ctx_has_vsx_region)
    167 || __copy_to_user(&old_ctx->uc_sigmask,
    168 &current->blocked, sizeof(sigset_t)))
    169 return -EFAULT;
    170 }
    171 if (new_ctx == NULL)
    172 return 0;
    173 - if (!access_ok(VERIFY_READ, new_ctx, sizeof(*new_ctx))
    174 + if (!access_ok(VERIFY_READ, new_ctx, ctx_size)
    175 || __get_user(tmp, (u8 __user *) new_ctx)
    176 - || __get_user(tmp, (u8 __user *) (new_ctx + 1) - 1))
    177 + || __get_user(tmp, (u8 __user *) new_ctx + ctx_size - 1))
    178 return -EFAULT;
    179
    180 /*
    181 @@ -425,7 +422,7 @@ int handle_rt_signal64(int signr, struct k_sigaction *ka, siginfo_t *info,
    182 &frame->uc.uc_stack.ss_flags);
    183 err |= __put_user(current->sas_ss_size, &frame->uc.uc_stack.ss_size);
    184 err |= setup_sigcontext(&frame->uc.uc_mcontext, regs, signr, NULL,
    185 - (unsigned long)ka->sa.sa_handler);
    186 + (unsigned long)ka->sa.sa_handler, 1);
    187 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
    188 if (err)
    189 goto badframe;
    190 diff --git a/arch/powerpc/mm/fsl_booke_mmu.c b/arch/powerpc/mm/fsl_booke_mmu.c
    191 index ce10e2b..131d729 100644
    192 --- a/arch/powerpc/mm/fsl_booke_mmu.c
    193 +++ b/arch/powerpc/mm/fsl_booke_mmu.c
    194 @@ -80,7 +80,7 @@ extern unsigned int tlbcam_index;
    195 /*
    196 * Return PA for this VA if it is mapped by a CAM, or 0
    197 */
    198 -unsigned long v_mapped_by_tlbcam(unsigned long va)
    199 +phys_addr_t v_mapped_by_tlbcam(unsigned long va)
    200 {
    201 int b;
    202 for (b = 0; b < tlbcam_index; ++b)
    203 @@ -92,7 +92,7 @@ unsigned long v_mapped_by_tlbcam(unsigned long va)
    204 /*
    205 * Return VA for a given PA or 0 if not mapped
    206 */
    207 -unsigned long p_mapped_by_tlbcam(unsigned long pa)
    208 +unsigned long p_mapped_by_tlbcam(phys_addr_t pa)
    209 {
    210 int b;
    211 for (b = 0; b < tlbcam_index; ++b)
    212 diff --git a/arch/powerpc/mm/pgtable_32.c b/arch/powerpc/mm/pgtable_32.c
    213 index 2001abd..05922b2 100644
    214 --- a/arch/powerpc/mm/pgtable_32.c
    215 +++ b/arch/powerpc/mm/pgtable_32.c
    216 @@ -65,8 +65,8 @@ void setbat(int index, unsigned long virt, phys_addr_t phys,
    217
    218 #ifdef HAVE_TLBCAM
    219 extern unsigned int tlbcam_index;
    220 -extern unsigned long v_mapped_by_tlbcam(unsigned long va);
    221 -extern unsigned long p_mapped_by_tlbcam(unsigned long pa);
    222 +extern phys_addr_t v_mapped_by_tlbcam(unsigned long va);
    223 +extern unsigned long p_mapped_by_tlbcam(phys_addr_t pa);
    224 #else /* !HAVE_TLBCAM */
    225 #define v_mapped_by_tlbcam(x) (0UL)
    226 #define p_mapped_by_tlbcam(x) (0UL)
    227 diff --git a/arch/sparc64/Kconfig b/arch/sparc64/Kconfig
    228 index 36b4b7a..b376667 100644
    229 --- a/arch/sparc64/Kconfig
    230 +++ b/arch/sparc64/Kconfig
    231 @@ -15,6 +15,7 @@ config SPARC64
    232 select HAVE_FTRACE
    233 select HAVE_IDE
    234 select HAVE_LMB
    235 + select HAVE_SYSCALL_WRAPPERS
    236 select HAVE_ARCH_KGDB
    237 select USE_GENERIC_SMP_HELPERS if SMP
    238 select HAVE_ARCH_TRACEHOOK
    239 diff --git a/arch/sparc64/kernel/sys_sparc.c b/arch/sparc64/kernel/sys_sparc.c
    240 index 39749e3..73b287e 100644
    241 --- a/arch/sparc64/kernel/sys_sparc.c
    242 +++ b/arch/sparc64/kernel/sys_sparc.c
    243 @@ -397,7 +397,7 @@ void arch_pick_mmap_layout(struct mm_struct *mm)
    244 }
    245 }
    246
    247 -asmlinkage unsigned long sparc_brk(unsigned long brk)
    248 +SYSCALL_DEFINE1(sparc_brk, unsigned long, brk)
    249 {
    250 /* People could try to be nasty and use ta 0x6d in 32bit programs */
    251 if (test_thread_flag(TIF_32BIT) && brk >= STACK_TOP32)
    252 @@ -413,7 +413,7 @@ asmlinkage unsigned long sparc_brk(unsigned long brk)
    253 * sys_pipe() is the normal C calling standard for creating
    254 * a pipe. It's not the way unix traditionally does this, though.
    255 */
    256 -asmlinkage long sparc_pipe(struct pt_regs *regs)
    257 +SYSCALL_DEFINE1(sparc_pipe_real, struct pt_regs *, regs)
    258 {
    259 int fd[2];
    260 int error;
    261 @@ -433,8 +433,8 @@ out:
    262 * This is really horribly ugly.
    263 */
    264
    265 -asmlinkage long sys_ipc(unsigned int call, int first, unsigned long second,
    266 - unsigned long third, void __user *ptr, long fifth)
    267 +SYSCALL_DEFINE6(ipc, unsigned int, call, int, first, unsigned long, second,
    268 + unsigned long, third, void __user *, ptr, long, fifth)
    269 {
    270 long err;
    271
    272 @@ -517,7 +517,7 @@ out:
    273 return err;
    274 }
    275
    276 -asmlinkage long sparc64_newuname(struct new_utsname __user *name)
    277 +SYSCALL_DEFINE1(sparc64_newuname, struct new_utsname __user *, name)
    278 {
    279 int ret = sys_newuname(name);
    280
    281 @@ -528,7 +528,7 @@ asmlinkage long sparc64_newuname(struct new_utsname __user *name)
    282 return ret;
    283 }
    284
    285 -asmlinkage long sparc64_personality(unsigned long personality)
    286 +SYSCALL_DEFINE1(sparc64_personality, unsigned long, personality)
    287 {
    288 int ret;
    289
    290 @@ -562,9 +562,9 @@ int sparc_mmap_check(unsigned long addr, unsigned long len)
    291 }
    292
    293 /* Linux version of mmap */
    294 -asmlinkage unsigned long sys_mmap(unsigned long addr, unsigned long len,
    295 - unsigned long prot, unsigned long flags, unsigned long fd,
    296 - unsigned long off)
    297 +SYSCALL_DEFINE6(mmap, unsigned long, addr, unsigned long, len,
    298 + unsigned long, prot, unsigned long, flags, unsigned long, fd,
    299 + unsigned long, off)
    300 {
    301 struct file * file = NULL;
    302 unsigned long retval = -EBADF;
    303 @@ -587,7 +587,7 @@ out:
    304 return retval;
    305 }
    306
    307 -asmlinkage long sys64_munmap(unsigned long addr, size_t len)
    308 +SYSCALL_DEFINE2(64_munmap, unsigned long, addr, size_t, len)
    309 {
    310 long ret;
    311
    312 @@ -604,9 +604,9 @@ extern unsigned long do_mremap(unsigned long addr,
    313 unsigned long old_len, unsigned long new_len,
    314 unsigned long flags, unsigned long new_addr);
    315
    316 -asmlinkage unsigned long sys64_mremap(unsigned long addr,
    317 - unsigned long old_len, unsigned long new_len,
    318 - unsigned long flags, unsigned long new_addr)
    319 +SYSCALL_DEFINE5(64_mremap, unsigned long, addr, unsigned long, old_len,
    320 + unsigned long, new_len, unsigned long, flags,
    321 + unsigned long, new_addr)
    322 {
    323 unsigned long ret = -EINVAL;
    324
    325 @@ -669,7 +669,7 @@ asmlinkage void sparc_breakpoint(struct pt_regs *regs)
    326
    327 extern void check_pending(int signum);
    328
    329 -asmlinkage long sys_getdomainname(char __user *name, int len)
    330 +SYSCALL_DEFINE2(getdomainname, char __user *, name, int, len)
    331 {
    332 int nlen, err;
    333
    334 @@ -692,11 +692,10 @@ out:
    335 return err;
    336 }
    337
    338 -asmlinkage long sys_utrap_install(utrap_entry_t type,
    339 - utrap_handler_t new_p,
    340 - utrap_handler_t new_d,
    341 - utrap_handler_t __user *old_p,
    342 - utrap_handler_t __user *old_d)
    343 +SYSCALL_DEFINE5(utrap_install, utrap_entry_t, type,
    344 + utrap_handler_t, new_p, utrap_handler_t, new_d,
    345 + utrap_handler_t __user *, old_p,
    346 + utrap_handler_t __user *, old_d)
    347 {
    348 if (type < UT_INSTRUCTION_EXCEPTION || type > UT_TRAP_INSTRUCTION_31)
    349 return -EINVAL;
    350 @@ -762,11 +761,9 @@ asmlinkage long sparc_memory_ordering(unsigned long model,
    351 return 0;
    352 }
    353
    354 -asmlinkage long sys_rt_sigaction(int sig,
    355 - const struct sigaction __user *act,
    356 - struct sigaction __user *oact,
    357 - void __user *restorer,
    358 - size_t sigsetsize)
    359 +SYSCALL_DEFINE5(rt_sigaction, int, sig, const struct sigaction __user *, act,
    360 + struct sigaction __user *, oact, void __user *, restorer,
    361 + size_t, sigsetsize)
    362 {
    363 struct k_sigaction new_ka, old_ka;
    364 int ret;
    365 @@ -806,7 +803,8 @@ asmlinkage void update_perfctrs(void)
    366 reset_pic();
    367 }
    368
    369 -asmlinkage long sys_perfctr(int opcode, unsigned long arg0, unsigned long arg1, unsigned long arg2)
    370 +SYSCALL_DEFINE4(perfctr, int, opcode, unsigned long, arg0,
    371 + unsigned long, arg1, unsigned long, arg2)
    372 {
    373 int err = 0;
    374
    375 diff --git a/arch/sparc64/kernel/syscalls.S b/arch/sparc64/kernel/syscalls.S
    376 index cd2d333..5a0b52e 100644
    377 --- a/arch/sparc64/kernel/syscalls.S
    378 +++ b/arch/sparc64/kernel/syscalls.S
    379 @@ -21,7 +21,7 @@ execve_merge:
    380
    381 .align 32
    382 sys_sparc_pipe:
    383 - ba,pt %xcc, sparc_pipe
    384 + ba,pt %xcc, sys_sparc_pipe_real
    385 add %sp, PTREGS_OFF, %o0
    386 sys_nis_syscall:
    387 ba,pt %xcc, c_sys_nis_syscall
    388 diff --git a/arch/sparc64/kernel/systbls.S b/arch/sparc64/kernel/systbls.S
    389 index 26b39de..8fafe0b 100644
    390 --- a/arch/sparc64/kernel/systbls.S
    391 +++ b/arch/sparc64/kernel/systbls.S
    392 @@ -21,7 +21,7 @@ sys_call_table32:
    393 /*0*/ .word sys_restart_syscall, sys32_exit, sys_fork, sys_read, sys_write
    394 /*5*/ .word sys32_open, sys_close, sys32_wait4, sys32_creat, sys_link
    395 /*10*/ .word sys_unlink, sunos_execv, sys_chdir, sys_chown16, sys32_mknod
    396 -/*15*/ .word sys_chmod, sys_lchown16, sparc_brk, sys32_perfctr, sys32_lseek
    397 +/*15*/ .word sys_chmod, sys_lchown16, sys_sparc_brk, sys32_perfctr, sys32_lseek
    398 /*20*/ .word sys_getpid, sys_capget, sys_capset, sys_setuid16, sys_getuid16
    399 /*25*/ .word sys32_vmsplice, compat_sys_ptrace, sys_alarm, sys32_sigaltstack, sys32_pause
    400 /*30*/ .word compat_sys_utime, sys_lchown, sys_fchown, sys32_access, sys32_nice
    401 @@ -55,8 +55,8 @@ sys_call_table32:
    402 /*170*/ .word sys32_lsetxattr, sys32_fsetxattr, sys_getxattr, sys_lgetxattr, compat_sys_getdents
    403 .word sys_setsid, sys_fchdir, sys32_fgetxattr, sys_listxattr, sys_llistxattr
    404 /*180*/ .word sys32_flistxattr, sys_removexattr, sys_lremovexattr, compat_sys_sigpending, sys_ni_syscall
    405 - .word sys32_setpgid, sys32_fremovexattr, sys32_tkill, sys32_exit_group, sparc64_newuname
    406 -/*190*/ .word sys32_init_module, sparc64_personality, sys_remap_file_pages, sys32_epoll_create, sys32_epoll_ctl
    407 + .word sys32_setpgid, sys32_fremovexattr, sys32_tkill, sys32_exit_group, sys_sparc64_newuname
    408 +/*190*/ .word sys32_init_module, sys_sparc64_personality, sys_remap_file_pages, sys32_epoll_create, sys32_epoll_ctl
    409 .word sys32_epoll_wait, sys32_ioprio_set, sys_getppid, sys32_sigaction, sys_sgetmask
    410 /*200*/ .word sys32_ssetmask, sys_sigsuspend, compat_sys_newlstat, sys_uselib, compat_sys_old_readdir
    411 .word sys32_readahead, sys32_socketcall, sys32_syslog, sys32_lookup_dcookie, sys32_fadvise64
    412 @@ -95,7 +95,7 @@ sys_call_table:
    413 /*0*/ .word sys_restart_syscall, sparc_exit, sys_fork, sys_read, sys_write
    414 /*5*/ .word sys_open, sys_close, sys_wait4, sys_creat, sys_link
    415 /*10*/ .word sys_unlink, sys_nis_syscall, sys_chdir, sys_chown, sys_mknod
    416 -/*15*/ .word sys_chmod, sys_lchown, sparc_brk, sys_perfctr, sys_lseek
    417 +/*15*/ .word sys_chmod, sys_lchown, sys_sparc_brk, sys_perfctr, sys_lseek
    418 /*20*/ .word sys_getpid, sys_capget, sys_capset, sys_setuid, sys_getuid
    419 /*25*/ .word sys_vmsplice, sys_ptrace, sys_alarm, sys_sigaltstack, sys_nis_syscall
    420 /*30*/ .word sys_utime, sys_nis_syscall, sys_nis_syscall, sys_access, sys_nice
    421 @@ -106,7 +106,7 @@ sys_call_table:
    422 .word sys_reboot, sys_nis_syscall, sys_symlink, sys_readlink, sys_execve
    423 /*60*/ .word sys_umask, sys_chroot, sys_newfstat, sys_fstat64, sys_getpagesize
    424 .word sys_msync, sys_vfork, sys_pread64, sys_pwrite64, sys_nis_syscall
    425 -/*70*/ .word sys_nis_syscall, sys_mmap, sys_nis_syscall, sys64_munmap, sys_mprotect
    426 +/*70*/ .word sys_nis_syscall, sys_mmap, sys_nis_syscall, sys_64_munmap, sys_mprotect
    427 .word sys_madvise, sys_vhangup, sys_nis_syscall, sys_mincore, sys_getgroups
    428 /*80*/ .word sys_setgroups, sys_getpgrp, sys_nis_syscall, sys_setitimer, sys_nis_syscall
    429 .word sys_swapon, sys_getitimer, sys_nis_syscall, sys_sethostname, sys_nis_syscall
    430 @@ -129,8 +129,8 @@ sys_call_table:
    431 /*170*/ .word sys_lsetxattr, sys_fsetxattr, sys_getxattr, sys_lgetxattr, sys_getdents
    432 .word sys_setsid, sys_fchdir, sys_fgetxattr, sys_listxattr, sys_llistxattr
    433 /*180*/ .word sys_flistxattr, sys_removexattr, sys_lremovexattr, sys_nis_syscall, sys_ni_syscall
    434 - .word sys_setpgid, sys_fremovexattr, sys_tkill, sys_exit_group, sparc64_newuname
    435 -/*190*/ .word sys_init_module, sparc64_personality, sys_remap_file_pages, sys_epoll_create, sys_epoll_ctl
    436 + .word sys_setpgid, sys_fremovexattr, sys_tkill, sys_exit_group, sys_sparc64_newuname
    437 +/*190*/ .word sys_init_module, sys_sparc64_personality, sys_remap_file_pages, sys_epoll_create, sys_epoll_ctl
    438 .word sys_epoll_wait, sys_ioprio_set, sys_getppid, sys_nis_syscall, sys_sgetmask
    439 /*200*/ .word sys_ssetmask, sys_nis_syscall, sys_newlstat, sys_uselib, sys_nis_syscall
    440 .word sys_readahead, sys_socketcall, sys_syslog, sys_lookup_dcookie, sys_fadvise64
    441 @@ -142,7 +142,7 @@ sys_call_table:
    442 .word sys_fstatfs64, sys_llseek, sys_mlock, sys_munlock, sys_mlockall
    443 /*240*/ .word sys_munlockall, sys_sched_setparam, sys_sched_getparam, sys_sched_setscheduler, sys_sched_getscheduler
    444 .word sys_sched_yield, sys_sched_get_priority_max, sys_sched_get_priority_min, sys_sched_rr_get_interval, sys_nanosleep
    445 -/*250*/ .word sys64_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
    446 +/*250*/ .word sys_64_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
    447 .word sys_sync_file_range, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
    448 /*260*/ .word sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
    449 .word sys_timer_delete, sys_timer_create, sys_ni_syscall, sys_io_setup, sys_io_destroy
    450 diff --git a/arch/sparc64/kernel/systbls.h b/arch/sparc64/kernel/systbls.h
    451 index bc9f5da..15c2d75 100644
    452 --- a/arch/sparc64/kernel/systbls.h
    453 +++ b/arch/sparc64/kernel/systbls.h
    454 @@ -16,9 +16,6 @@ extern asmlinkage long sys_ipc(unsigned int call, int first,
    455 void __user *ptr, long fifth);
    456 extern asmlinkage long sparc64_newuname(struct new_utsname __user *name);
    457 extern asmlinkage long sparc64_personality(unsigned long personality);
    458 -extern asmlinkage unsigned long sys_mmap(unsigned long addr, unsigned long len,
    459 - unsigned long prot, unsigned long flags,
    460 - unsigned long fd, unsigned long off);
    461 extern asmlinkage long sys64_munmap(unsigned long addr, size_t len);
    462 extern asmlinkage unsigned long sys64_mremap(unsigned long addr,
    463 unsigned long old_len,
    464 diff --git a/arch/x86/kernel/vmi_32.c b/arch/x86/kernel/vmi_32.c
    465 index f370d38..c4e6cc9 100644
    466 --- a/arch/x86/kernel/vmi_32.c
    467 +++ b/arch/x86/kernel/vmi_32.c
    468 @@ -430,6 +430,16 @@ static void vmi_release_pmd(u32 pfn)
    469 }
    470
    471 /*
    472 + * We use the pgd_free hook for releasing the pgd page:
    473 + */
    474 +static void vmi_pgd_free(struct mm_struct *mm, pgd_t *pgd)
    475 +{
    476 + unsigned long pfn = __pa(pgd) >> PAGE_SHIFT;
    477 +
    478 + vmi_ops.release_page(pfn, VMI_PAGE_L2);
    479 +}
    480 +
    481 +/*
    482 * Helper macros for MMU update flags. We can defer updates until a flush
    483 * or page invalidation only if the update is to the current address space
    484 * (otherwise, there is no flush). We must check against init_mm, since
    485 @@ -881,6 +891,7 @@ static inline int __init activate_vmi(void)
    486 if (vmi_ops.release_page) {
    487 pv_mmu_ops.release_pte = vmi_release_pte;
    488 pv_mmu_ops.release_pmd = vmi_release_pmd;
    489 + pv_mmu_ops.pgd_free = vmi_pgd_free;
    490 }
    491
    492 /* Set linear is needed in all cases */
    493 diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
    494 index 4bdaa59..315b071 100644
    495 --- a/arch/x86/pci/fixup.c
    496 +++ b/arch/x86/pci/fixup.c
    497 @@ -496,18 +496,21 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_SIEMENS, 0x0015,
    498 pci_siemens_interrupt_controller);
    499
    500 /*
    501 - * Regular PCI devices have 256 bytes, but AMD Family 10h Opteron ext config
    502 - * have 4096 bytes. Even if the device is capable, that doesn't mean we can
    503 - * access it. Maybe we don't have a way to generate extended config space
    504 - * accesses. So check it
    505 + * Regular PCI devices have 256 bytes, but AMD Family 10h/11h CPUs have
    506 + * 4096 bytes configuration space for each function of their processor
    507 + * configuration space.
    508 */
    509 -static void fam10h_pci_cfg_space_size(struct pci_dev *dev)
    510 +static void amd_cpu_pci_cfg_space_size(struct pci_dev *dev)
    511 {
    512 dev->cfg_size = pci_cfg_space_size_ext(dev);
    513 }
    514 -
    515 -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1200, fam10h_pci_cfg_space_size);
    516 -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1201, fam10h_pci_cfg_space_size);
    517 -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1202, fam10h_pci_cfg_space_size);
    518 -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1203, fam10h_pci_cfg_space_size);
    519 -DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1204, fam10h_pci_cfg_space_size);
    520 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1200, amd_cpu_pci_cfg_space_size);
    521 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1201, amd_cpu_pci_cfg_space_size);
    522 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1202, amd_cpu_pci_cfg_space_size);
    523 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1203, amd_cpu_pci_cfg_space_size);
    524 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1204, amd_cpu_pci_cfg_space_size);
    525 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1300, amd_cpu_pci_cfg_space_size);
    526 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1301, amd_cpu_pci_cfg_space_size);
    527 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1302, amd_cpu_pci_cfg_space_size);
    528 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1303, amd_cpu_pci_cfg_space_size);
    529 +DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, 0x1304, amd_cpu_pci_cfg_space_size);
    530 diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
    531 index 2c4ccec..154e7d6 100644
    532 --- a/drivers/ata/libata-eh.c
    533 +++ b/drivers/ata/libata-eh.c
    534 @@ -2694,12 +2694,13 @@ static int ata_eh_handle_dev_fail(struct ata_device *dev, int err)
    535 /* give it just one more chance */
    536 ehc->tries[dev->devno] = min(ehc->tries[dev->devno], 1);
    537 case -EIO:
    538 - if (ehc->tries[dev->devno] == 1 && dev->pio_mode > XFER_PIO_0) {
    539 + if (ehc->tries[dev->devno] == 1) {
    540 /* This is the last chance, better to slow
    541 * down than lose it.
    542 */
    543 sata_down_spd_limit(dev->link);
    544 - ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
    545 + if (dev->pio_mode > XFER_PIO_0)
    546 + ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
    547 }
    548 }
    549
    550 diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
    551 index 1778e4a..814ffd9 100644
    552 --- a/drivers/block/nbd.c
    553 +++ b/drivers/block/nbd.c
    554 @@ -547,6 +547,15 @@ static void do_nbd_request(struct request_queue * q)
    555
    556 BUG_ON(lo->magic != LO_MAGIC);
    557
    558 + if (unlikely(!lo->sock)) {
    559 + printk(KERN_ERR "%s: Attempted send on closed socket\n",
    560 + lo->disk->disk_name);
    561 + req->errors++;
    562 + nbd_end_request(req);
    563 + spin_lock_irq(q->queue_lock);
    564 + continue;
    565 + }
    566 +
    567 spin_lock_irq(&lo->queue_lock);
    568 list_add_tail(&req->queuelist, &lo->waiting_queue);
    569 spin_unlock_irq(&lo->queue_lock);
    570 diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
    571 index e87956a..1371184 100644
    572 --- a/drivers/hid/usbhid/hid-quirks.c
    573 +++ b/drivers/hid/usbhid/hid-quirks.c
    574 @@ -1130,24 +1130,16 @@ static void usbhid_fixup_button_consumer_descriptor(unsigned char *rdesc, int rs
    575 }
    576
    577 /*
    578 - * Microsoft Wireless Desktop Receiver (Model 1028) has several
    579 + * Microsoft Wireless Desktop Receiver (Model 1028) has
    580 * 'Usage Min/Max' where it ought to have 'Physical Min/Max'
    581 */
    582 static void usbhid_fixup_microsoft_descriptor(unsigned char *rdesc, int rsize)
    583 {
    584 - if (rsize == 571 && rdesc[284] == 0x19
    585 - && rdesc[286] == 0x2a
    586 - && rdesc[304] == 0x19
    587 - && rdesc[306] == 0x29
    588 - && rdesc[352] == 0x1a
    589 - && rdesc[355] == 0x2a
    590 - && rdesc[557] == 0x19
    591 + if (rsize == 571 && rdesc[557] == 0x19
    592 && rdesc[559] == 0x29) {
    593 printk(KERN_INFO "Fixing up Microsoft Wireless Receiver Model 1028 report descriptor\n");
    594 - rdesc[284] = rdesc[304] = rdesc[557] = 0x35;
    595 - rdesc[352] = 0x36;
    596 - rdesc[286] = rdesc[355] = 0x46;
    597 - rdesc[306] = rdesc[559] = 0x45;
    598 + rdesc[557] = 0x35;
    599 + rdesc[559] = 0x45;
    600 }
    601 }
    602
    603 diff --git a/drivers/net/skfp/skfddi.c b/drivers/net/skfp/skfddi.c
    604 index a2b092b..b7d829f 100644
    605 --- a/drivers/net/skfp/skfddi.c
    606 +++ b/drivers/net/skfp/skfddi.c
    607 @@ -998,9 +998,9 @@ static int skfp_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
    608 break;
    609 case SKFP_CLR_STATS: /* Zero out the driver statistics */
    610 if (!capable(CAP_NET_ADMIN)) {
    611 - memset(&lp->MacStat, 0, sizeof(lp->MacStat));
    612 - } else {
    613 status = -EPERM;
    614 + } else {
    615 + memset(&lp->MacStat, 0, sizeof(lp->MacStat));
    616 }
    617 break;
    618 default:
    619 diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
    620 index b4be33a..b68bc39 100644
    621 --- a/drivers/net/sky2.c
    622 +++ b/drivers/net/sky2.c
    623 @@ -1403,9 +1403,6 @@ static int sky2_up(struct net_device *dev)
    624
    625 }
    626
    627 - if (netif_msg_ifup(sky2))
    628 - printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
    629 -
    630 netif_carrier_off(dev);
    631
    632 /* must be power of 2 */
    633 @@ -1484,6 +1481,9 @@ static int sky2_up(struct net_device *dev)
    634 sky2_write32(hw, B0_IMSK, imask);
    635
    636 sky2_set_multicast(dev);
    637 +
    638 + if (netif_msg_ifup(sky2))
    639 + printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
    640 return 0;
    641
    642 err_out:
    643 diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
    644 index 4291458..88f9fd5 100644
    645 --- a/drivers/net/sungem.c
    646 +++ b/drivers/net/sungem.c
    647 @@ -2205,6 +2205,8 @@ static int gem_do_start(struct net_device *dev)
    648
    649 gp->running = 1;
    650
    651 + napi_enable(&gp->napi);
    652 +
    653 if (gp->lstate == link_up) {
    654 netif_carrier_on(gp->dev);
    655 gem_set_link_modes(gp);
    656 @@ -2222,6 +2224,8 @@ static int gem_do_start(struct net_device *dev)
    657 spin_lock_irqsave(&gp->lock, flags);
    658 spin_lock(&gp->tx_lock);
    659
    660 + napi_disable(&gp->napi);
    661 +
    662 gp->running = 0;
    663 gem_reset(gp);
    664 gem_clean_rings(gp);
    665 @@ -2322,8 +2326,6 @@ static int gem_open(struct net_device *dev)
    666 if (!gp->asleep)
    667 rc = gem_do_start(dev);
    668 gp->opened = (rc == 0);
    669 - if (gp->opened)
    670 - napi_enable(&gp->napi);
    671
    672 mutex_unlock(&gp->pm_mutex);
    673
    674 @@ -2460,8 +2462,6 @@ static int gem_resume(struct pci_dev *pdev)
    675
    676 /* Re-attach net device */
    677 netif_device_attach(dev);
    678 -
    679 - napi_enable(&gp->napi);
    680 }
    681
    682 spin_lock_irqsave(&gp->lock, flags);
    683 diff --git a/drivers/net/tun.c b/drivers/net/tun.c
    684 index 6daea0c..f00fcb5 100644
    685 --- a/drivers/net/tun.c
    686 +++ b/drivers/net/tun.c
    687 @@ -157,10 +157,16 @@ static int update_filter(struct tap_filter *filter, void __user *arg)
    688
    689 nexact = n;
    690
    691 - /* The rest is hashed */
    692 + /* Remaining multicast addresses are hashed,
    693 + * unicast will leave the filter disabled. */
    694 memset(filter->mask, 0, sizeof(filter->mask));
    695 - for (; n < uf.count; n++)
    696 + for (; n < uf.count; n++) {
    697 + if (!is_multicast_ether_addr(addr[n].u)) {
    698 + err = 0; /* no filter */
    699 + goto done;
    700 + }
    701 addr_hash_set(filter->mask, addr[n].u);
    702 + }
    703
    704 /* For ALLMULTI just set the mask to all ones.
    705 * This overrides the mask populated above. */
    706 diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
    707 index 0196a0d..ce743ec 100644
    708 --- a/drivers/net/virtio_net.c
    709 +++ b/drivers/net/virtio_net.c
    710 @@ -24,6 +24,7 @@
    711 #include <linux/virtio.h>
    712 #include <linux/virtio_net.h>
    713 #include <linux/scatterlist.h>
    714 +#include <linux/if_vlan.h>
    715
    716 static int napi_weight = 128;
    717 module_param(napi_weight, int, 0444);
    718 @@ -33,7 +34,7 @@ module_param(csum, bool, 0444);
    719 module_param(gso, bool, 0444);
    720
    721 /* FIXME: MTU in config. */
    722 -#define MAX_PACKET_LEN (ETH_HLEN+ETH_DATA_LEN)
    723 +#define MAX_PACKET_LEN (ETH_HLEN + VLAN_HLEN + ETH_DATA_LEN)
    724
    725 struct virtnet_info
    726 {
    727 diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
    728 index 3a90a67..87d020c 100644
    729 --- a/drivers/net/wireless/iwlwifi/iwl-scan.c
    730 +++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
    731 @@ -704,7 +704,7 @@ static void iwl_bg_request_scan(struct work_struct *data)
    732 u16 cmd_len;
    733 enum ieee80211_band band;
    734 u8 n_probes = 2;
    735 - u8 rx_chain = 0x7; /* bitmap: ABC chains */
    736 + u8 rx_chain = priv->hw_params.valid_rx_ant;
    737
    738 conf = ieee80211_get_hw_conf(priv->hw);
    739
    740 diff --git a/drivers/net/wireless/zd1211rw/zd_rf.c b/drivers/net/wireless/zd1211rw/zd_rf.c
    741 index ec41293..ead3073 100644
    742 --- a/drivers/net/wireless/zd1211rw/zd_rf.c
    743 +++ b/drivers/net/wireless/zd1211rw/zd_rf.c
    744 @@ -86,6 +86,7 @@ int zd_rf_init_hw(struct zd_rf *rf, u8 type)
    745 case AL7230B_RF:
    746 r = zd_rf_init_al7230b(rf);
    747 break;
    748 + case MAXIM_NEW_RF:
    749 case UW2453_RF:
    750 r = zd_rf_init_uw2453(rf);
    751 break;
    752 diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
    753 index a3ccd8c..5d740b5 100644
    754 --- a/drivers/net/wireless/zd1211rw/zd_usb.c
    755 +++ b/drivers/net/wireless/zd1211rw/zd_usb.c
    756 @@ -37,6 +37,7 @@
    757 static struct usb_device_id usb_ids[] = {
    758 /* ZD1211 */
    759 { USB_DEVICE(0x0ace, 0x1211), .driver_info = DEVICE_ZD1211 },
    760 + { USB_DEVICE(0x0ace, 0xa211), .driver_info = DEVICE_ZD1211 },
    761 { USB_DEVICE(0x07b8, 0x6001), .driver_info = DEVICE_ZD1211 },
    762 { USB_DEVICE(0x126f, 0xa006), .driver_info = DEVICE_ZD1211 },
    763 { USB_DEVICE(0x6891, 0xa727), .driver_info = DEVICE_ZD1211 },
    764 diff --git a/drivers/parport/parport_serial.c b/drivers/parport/parport_serial.c
    765 index 101ed49..032db81 100644
    766 --- a/drivers/parport/parport_serial.c
    767 +++ b/drivers/parport/parport_serial.c
    768 @@ -64,6 +64,11 @@ struct parport_pc_pci {
    769
    770 static int __devinit netmos_parallel_init(struct pci_dev *dev, struct parport_pc_pci *card, int autoirq, int autodma)
    771 {
    772 + /* the rule described below doesn't hold for this device */
    773 + if (dev->device == PCI_DEVICE_ID_NETMOS_9835 &&
    774 + dev->subsystem_vendor == PCI_VENDOR_ID_IBM &&
    775 + dev->subsystem_device == 0x0299)
    776 + return -ENODEV;
    777 /*
    778 * Netmos uses the subdevice ID to indicate the number of parallel
    779 * and serial ports. The form is 0x00PS, where <P> is the number of
    780 diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
    781 index fb28aca..521a2db 100644
    782 --- a/drivers/w1/slaves/w1_therm.c
    783 +++ b/drivers/w1/slaves/w1_therm.c
    784 @@ -113,7 +113,7 @@ static struct w1_therm_family_converter w1_therm_families[] = {
    785
    786 static inline int w1_DS18B20_convert_temp(u8 rom[9])
    787 {
    788 - s16 t = (rom[1] << 8) | rom[0];
    789 + int t = ((s16)rom[1] << 8) | rom[0];
    790 t = t*1000/16;
    791 return t;
    792 }
    793 diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
    794 index 5235c67..c8f8d59 100644
    795 --- a/fs/compat_ioctl.c
    796 +++ b/fs/compat_ioctl.c
    797 @@ -538,6 +538,7 @@ static int dev_ifsioc(unsigned int fd, unsigned int cmd, unsigned long arg)
    798 * cannot be fixed without breaking all existing apps.
    799 */
    800 case TUNSETIFF:
    801 + case TUNGETIFF:
    802 case SIOCGIFFLAGS:
    803 case SIOCGIFMETRIC:
    804 case SIOCGIFMTU:
    805 @@ -1982,6 +1983,11 @@ COMPATIBLE_IOCTL(TUNSETNOCSUM)
    806 COMPATIBLE_IOCTL(TUNSETDEBUG)
    807 COMPATIBLE_IOCTL(TUNSETPERSIST)
    808 COMPATIBLE_IOCTL(TUNSETOWNER)
    809 +COMPATIBLE_IOCTL(TUNSETLINK)
    810 +COMPATIBLE_IOCTL(TUNSETGROUP)
    811 +COMPATIBLE_IOCTL(TUNGETFEATURES)
    812 +COMPATIBLE_IOCTL(TUNSETOFFLOAD)
    813 +COMPATIBLE_IOCTL(TUNSETTXFILTER)
    814 /* Big V */
    815 COMPATIBLE_IOCTL(VT_SETMODE)
    816 COMPATIBLE_IOCTL(VT_GETMODE)
    817 @@ -2573,6 +2579,7 @@ HANDLE_IOCTL(SIOCGIFPFLAGS, dev_ifsioc)
    818 HANDLE_IOCTL(SIOCGIFTXQLEN, dev_ifsioc)
    819 HANDLE_IOCTL(SIOCSIFTXQLEN, dev_ifsioc)
    820 HANDLE_IOCTL(TUNSETIFF, dev_ifsioc)
    821 +HANDLE_IOCTL(TUNGETIFF, dev_ifsioc)
    822 HANDLE_IOCTL(SIOCETHTOOL, ethtool_ioctl)
    823 HANDLE_IOCTL(SIOCBONDENSLAVE, bond_ioctl)
    824 HANDLE_IOCTL(SIOCBONDRELEASE, bond_ioctl)
    825 diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
    826 index cf0d5c2..dc934da 100644
    827 --- a/fs/lockd/svclock.c
    828 +++ b/fs/lockd/svclock.c
    829 @@ -418,7 +418,7 @@ nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file,
    830 goto out;
    831 case -EAGAIN:
    832 ret = nlm_lck_denied;
    833 - goto out;
    834 + break;
    835 case FILE_LOCK_DEFERRED:
    836 if (wait)
    837 break;
    838 @@ -434,6 +434,10 @@ nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file,
    839 goto out;
    840 }
    841
    842 + ret = nlm_lck_denied;
    843 + if (!wait)
    844 + goto out;
    845 +
    846 ret = nlm_lck_blocked;
    847
    848 /* Append to list of blocked */
    849 diff --git a/include/linux/ata.h b/include/linux/ata.h
    850 index 8a12d71..8297a3c 100644
    851 --- a/include/linux/ata.h
    852 +++ b/include/linux/ata.h
    853 @@ -681,12 +681,17 @@ static inline int ata_id_current_chs_valid(const u16 *id)
    854
    855 static inline int ata_id_is_cfa(const u16 *id)
    856 {
    857 - if (id[ATA_ID_CONFIG] == 0x848A) /* Standard CF */
    858 + if (id[ATA_ID_CONFIG] == 0x848A) /* Traditional CF */
    859 return 1;
    860 - /* Could be CF hiding as standard ATA */
    861 - if (ata_id_major_version(id) >= 3 &&
    862 - id[ATA_ID_COMMAND_SET_1] != 0xFFFF &&
    863 - (id[ATA_ID_COMMAND_SET_1] & (1 << 2)))
    864 + /*
    865 + * CF specs don't require specific value in the word 0 anymore and yet
    866 + * they forbid to report the ATA version in the word 80 and require the
    867 + * CFA feature set support to be indicated in the word 83 in this case.
    868 + * Unfortunately, some cards only follow either of this requirements,
    869 + * and while those that don't indicate CFA feature support need some
    870 + * sort of quirk list, it seems impractical for the ones that do...
    871 + */
    872 + if ((id[ATA_ID_COMMAND_SET_2] & 0xC004) == 0x4004)
    873 return 1;
    874 return 0;
    875 }
    876 diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
    877 index f54aa38..258a17b 100644
    878 --- a/include/linux/syscalls.h
    879 +++ b/include/linux/syscalls.h
    880 @@ -95,13 +95,13 @@ struct old_linux_dirent;
    881 #define __SC_TEST5(t5, a5, ...) __SC_TEST(t5); __SC_TEST4(__VA_ARGS__)
    882 #define __SC_TEST6(t6, a6, ...) __SC_TEST(t6); __SC_TEST5(__VA_ARGS__)
    883
    884 -#define SYSCALL_DEFINE0(name) asmlinkage long sys_##name(void)
    885 -#define SYSCALL_DEFINE1(...) SYSCALL_DEFINEx(1, __VA_ARGS__)
    886 -#define SYSCALL_DEFINE2(...) SYSCALL_DEFINEx(2, __VA_ARGS__)
    887 -#define SYSCALL_DEFINE3(...) SYSCALL_DEFINEx(3, __VA_ARGS__)
    888 -#define SYSCALL_DEFINE4(...) SYSCALL_DEFINEx(4, __VA_ARGS__)
    889 -#define SYSCALL_DEFINE5(...) SYSCALL_DEFINEx(5, __VA_ARGS__)
    890 -#define SYSCALL_DEFINE6(...) SYSCALL_DEFINEx(6, __VA_ARGS__)
    891 +#define SYSCALL_DEFINE0(name) asmlinkage long sys_##name(void)
    892 +#define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__)
    893 +#define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__)
    894 +#define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__)
    895 +#define SYSCALL_DEFINE4(name, ...) SYSCALL_DEFINEx(4, _##name, __VA_ARGS__)
    896 +#define SYSCALL_DEFINE5(name, ...) SYSCALL_DEFINEx(5, _##name, __VA_ARGS__)
    897 +#define SYSCALL_DEFINE6(name, ...) SYSCALL_DEFINEx(6, _##name, __VA_ARGS__)
    898
    899 #ifdef CONFIG_PPC64
    900 #define SYSCALL_ALIAS(alias, name) \
    901 @@ -116,21 +116,21 @@ struct old_linux_dirent;
    902
    903 #define SYSCALL_DEFINE(name) static inline long SYSC_##name
    904 #define SYSCALL_DEFINEx(x, name, ...) \
    905 - asmlinkage long sys_##name(__SC_DECL##x(__VA_ARGS__)); \
    906 - static inline long SYSC_##name(__SC_DECL##x(__VA_ARGS__)); \
    907 - asmlinkage long SyS_##name(__SC_LONG##x(__VA_ARGS__)) \
    908 + asmlinkage long sys##name(__SC_DECL##x(__VA_ARGS__)); \
    909 + static inline long SYSC##name(__SC_DECL##x(__VA_ARGS__)); \
    910 + asmlinkage long SyS##name(__SC_LONG##x(__VA_ARGS__)) \
    911 { \
    912 __SC_TEST##x(__VA_ARGS__); \
    913 - return (long) SYSC_##name(__SC_CAST##x(__VA_ARGS__)); \
    914 + return (long) SYSC##name(__SC_CAST##x(__VA_ARGS__)); \
    915 } \
    916 - SYSCALL_ALIAS(sys_##name, SyS_##name); \
    917 - static inline long SYSC_##name(__SC_DECL##x(__VA_ARGS__))
    918 + SYSCALL_ALIAS(sys##name, SyS##name); \
    919 + static inline long SYSC##name(__SC_DECL##x(__VA_ARGS__))
    920
    921 #else /* CONFIG_HAVE_SYSCALL_WRAPPERS */
    922
    923 #define SYSCALL_DEFINE(name) asmlinkage long sys_##name
    924 #define SYSCALL_DEFINEx(x, name, ...) \
    925 - asmlinkage long sys_##name(__SC_DECL##x(__VA_ARGS__))
    926 + asmlinkage long sys##name(__SC_DECL##x(__VA_ARGS__))
    927
    928 #endif /* CONFIG_HAVE_SYSCALL_WRAPPERS */
    929
    930 diff --git a/include/net/sctp/checksum.h b/include/net/sctp/checksum.h
    931 index b799fb2..2fec3c3 100644
    932 --- a/include/net/sctp/checksum.h
    933 +++ b/include/net/sctp/checksum.h
    934 @@ -79,5 +79,5 @@ static inline __be32 sctp_update_cksum(__u8 *buffer, __u16 length, __be32 crc32)
    935
    936 static inline __be32 sctp_end_cksum(__be32 crc32)
    937 {
    938 - return ~crc32;
    939 + return (__force __be32)~cpu_to_le32((__force u32)crc32);
    940 }
    941 diff --git a/mm/page-writeback.c b/mm/page-writeback.c
    942 index 8875822..5f7cdc2 100644
    943 --- a/mm/page-writeback.c
    944 +++ b/mm/page-writeback.c
    945 @@ -985,13 +985,25 @@ continue_unlock:
    946 }
    947 }
    948
    949 - if (wbc->sync_mode == WB_SYNC_NONE) {
    950 + if (wbc->nr_to_write > 0) {
    951 wbc->nr_to_write--;
    952 - if (wbc->nr_to_write <= 0) {
    953 + if (wbc->nr_to_write == 0 &&
    954 + wbc->sync_mode == WB_SYNC_NONE) {
    955 + /*
    956 + * We stop writing back only if we are
    957 + * not doing integrity sync. In case of
    958 + * integrity sync we have to keep going
    959 + * because someone may be concurrently
    960 + * dirtying pages, and we might have
    961 + * synced a lot of newly appeared dirty
    962 + * pages, but have not synced all of the
    963 + * old dirty pages.
    964 + */
    965 done = 1;
    966 break;
    967 }
    968 }
    969 +
    970 if (wbc->nonblocking && bdi_write_congested(bdi)) {
    971 wbc->encountered_congestion = 1;
    972 done = 1;
    973 @@ -1001,7 +1013,7 @@ continue_unlock:
    974 pagevec_release(&pvec);
    975 cond_resched();
    976 }
    977 - if (!cycled) {
    978 + if (!cycled && !done) {
    979 /*
    980 * range_cyclic:
    981 * We hit the last page and there is more work to be done: wrap
    982 diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
    983 index 96434d7..0abd0ef 100644
    984 --- a/net/bluetooth/hidp/core.c
    985 +++ b/net/bluetooth/hidp/core.c
    986 @@ -684,6 +684,10 @@ static const struct {
    987 } hidp_blacklist[] = {
    988 /* Apple wireless Mighty Mouse */
    989 { 0x05ac, 0x030c, HID_QUIRK_MIGHTYMOUSE | HID_QUIRK_INVERT_HWHEEL },
    990 + /* Apple Wireless Keyboard */
    991 + { 0x05ac, 0x022c, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN },
    992 + { 0x05ac, 0x022d, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN | HID_QUIRK_APPLE_ISO_KEYBOARD },
    993 + { 0x05ac, 0x022e, HID_QUIRK_APPLE_NUMLOCK_EMULATION | HID_QUIRK_APPLE_HAS_FN },
    994
    995 { } /* Terminating entry */
    996 };
    997 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
    998 index ca1ccdf..53425fa 100644
    999 --- a/net/core/skbuff.c
    1000 +++ b/net/core/skbuff.c
    1001 @@ -73,17 +73,13 @@ static struct kmem_cache *skbuff_fclone_cache __read_mostly;
    1002 static void sock_pipe_buf_release(struct pipe_inode_info *pipe,
    1003 struct pipe_buffer *buf)
    1004 {
    1005 - struct sk_buff *skb = (struct sk_buff *) buf->private;
    1006 -
    1007 - kfree_skb(skb);
    1008 + put_page(buf->page);
    1009 }
    1010
    1011 static void sock_pipe_buf_get(struct pipe_inode_info *pipe,
    1012 struct pipe_buffer *buf)
    1013 {
    1014 - struct sk_buff *skb = (struct sk_buff *) buf->private;
    1015 -
    1016 - skb_get(skb);
    1017 + get_page(buf->page);
    1018 }
    1019
    1020 static int sock_pipe_buf_steal(struct pipe_inode_info *pipe,
    1021 @@ -1262,9 +1258,19 @@ fault:
    1022 */
    1023 static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
    1024 {
    1025 - struct sk_buff *skb = (struct sk_buff *) spd->partial[i].private;
    1026 + put_page(spd->pages[i]);
    1027 +}
    1028
    1029 - kfree_skb(skb);
    1030 +static inline struct page *linear_to_page(struct page *page, unsigned int len,
    1031 + unsigned int offset)
    1032 +{
    1033 + struct page *p = alloc_pages(GFP_KERNEL, 0);
    1034 +
    1035 + if (!p)
    1036 + return NULL;
    1037 + memcpy(page_address(p) + offset, page_address(page) + offset, len);
    1038 +
    1039 + return p;
    1040 }
    1041
    1042 /*
    1043 @@ -1272,16 +1278,23 @@ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
    1044 */
    1045 static inline int spd_fill_page(struct splice_pipe_desc *spd, struct page *page,
    1046 unsigned int len, unsigned int offset,
    1047 - struct sk_buff *skb)
    1048 + struct sk_buff *skb, int linear)
    1049 {
    1050 if (unlikely(spd->nr_pages == PIPE_BUFFERS))
    1051 return 1;
    1052
    1053 + if (linear) {
    1054 + page = linear_to_page(page, len, offset);
    1055 + if (!page)
    1056 + return 1;
    1057 + } else
    1058 + get_page(page);
    1059 +
    1060 spd->pages[spd->nr_pages] = page;
    1061 spd->partial[spd->nr_pages].len = len;
    1062 spd->partial[spd->nr_pages].offset = offset;
    1063 - spd->partial[spd->nr_pages].private = (unsigned long) skb_get(skb);
    1064 spd->nr_pages++;
    1065 +
    1066 return 0;
    1067 }
    1068
    1069 @@ -1297,7 +1310,7 @@ static inline void __segment_seek(struct page **page, unsigned int *poff,
    1070 static inline int __splice_segment(struct page *page, unsigned int poff,
    1071 unsigned int plen, unsigned int *off,
    1072 unsigned int *len, struct sk_buff *skb,
    1073 - struct splice_pipe_desc *spd)
    1074 + struct splice_pipe_desc *spd, int linear)
    1075 {
    1076 if (!*len)
    1077 return 1;
    1078 @@ -1320,7 +1333,7 @@ static inline int __splice_segment(struct page *page, unsigned int poff,
    1079 /* the linear region may spread across several pages */
    1080 flen = min_t(unsigned int, flen, PAGE_SIZE - poff);
    1081
    1082 - if (spd_fill_page(spd, page, flen, poff, skb))
    1083 + if (spd_fill_page(spd, page, flen, poff, skb, linear))
    1084 return 1;
    1085
    1086 __segment_seek(&page, &poff, &plen, flen);
    1087 @@ -1347,7 +1360,7 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
    1088 if (__splice_segment(virt_to_page(skb->data),
    1089 (unsigned long) skb->data & (PAGE_SIZE - 1),
    1090 skb_headlen(skb),
    1091 - offset, len, skb, spd))
    1092 + offset, len, skb, spd, 1))
    1093 return 1;
    1094
    1095 /*
    1096 @@ -1357,7 +1370,7 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
    1097 const skb_frag_t *f = &skb_shinfo(skb)->frags[seg];
    1098
    1099 if (__splice_segment(f->page, f->page_offset, f->size,
    1100 - offset, len, skb, spd))
    1101 + offset, len, skb, spd, 0))
    1102 return 1;
    1103 }
    1104
    1105 @@ -1370,7 +1383,7 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
    1106 * the frag list, if such a thing exists. We'd probably need to recurse to
    1107 * handle that cleanly.
    1108 */
    1109 -int skb_splice_bits(struct sk_buff *__skb, unsigned int offset,
    1110 +int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
    1111 struct pipe_inode_info *pipe, unsigned int tlen,
    1112 unsigned int flags)
    1113 {
    1114 @@ -1383,16 +1396,6 @@ int skb_splice_bits(struct sk_buff *__skb, unsigned int offset,
    1115 .ops = &sock_pipe_buf_ops,
    1116 .spd_release = sock_spd_release,
    1117 };
    1118 - struct sk_buff *skb;
    1119 -
    1120 - /*
    1121 - * I'd love to avoid the clone here, but tcp_read_sock()
    1122 - * ignores reference counts and unconditonally kills the sk_buff
    1123 - * on return from the actor.
    1124 - */
    1125 - skb = skb_clone(__skb, GFP_KERNEL);
    1126 - if (unlikely(!skb))
    1127 - return -ENOMEM;
    1128
    1129 /*
    1130 * __skb_splice_bits() only fails if the output has no room left,
    1131 @@ -1416,15 +1419,9 @@ int skb_splice_bits(struct sk_buff *__skb, unsigned int offset,
    1132 }
    1133
    1134 done:
    1135 - /*
    1136 - * drop our reference to the clone, the pipe consumption will
    1137 - * drop the rest.
    1138 - */
    1139 - kfree_skb(skb);
    1140 -
    1141 if (spd.nr_pages) {
    1142 + struct sock *sk = skb->sk;
    1143 int ret;
    1144 - struct sock *sk = __skb->sk;
    1145
    1146 /*
    1147 * Drop the socket lock, otherwise we have reverse
    1148 @@ -2001,10 +1998,10 @@ unsigned int skb_seq_read(unsigned int consumed, const u8 **data,
    1149 return 0;
    1150
    1151 next_skb:
    1152 - block_limit = skb_headlen(st->cur_skb);
    1153 + block_limit = skb_headlen(st->cur_skb) + st->stepped_offset;
    1154
    1155 if (abs_offset < block_limit) {
    1156 - *data = st->cur_skb->data + abs_offset;
    1157 + *data = st->cur_skb->data + (abs_offset - st->stepped_offset);
    1158 return block_limit - abs_offset;
    1159 }
    1160
    1161 @@ -2039,13 +2036,14 @@ next_skb:
    1162 st->frag_data = NULL;
    1163 }
    1164
    1165 - if (st->cur_skb->next) {
    1166 - st->cur_skb = st->cur_skb->next;
    1167 + if (st->root_skb == st->cur_skb &&
    1168 + skb_shinfo(st->root_skb)->frag_list) {
    1169 + st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
    1170 st->frag_idx = 0;
    1171 goto next_skb;
    1172 - } else if (st->root_skb == st->cur_skb &&
    1173 - skb_shinfo(st->root_skb)->frag_list) {
    1174 - st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
    1175 + } else if (st->cur_skb->next) {
    1176 + st->cur_skb = st->cur_skb->next;
    1177 + st->frag_idx = 0;
    1178 goto next_skb;
    1179 }
    1180
    1181 diff --git a/net/core/sock.c b/net/core/sock.c
    1182 index 91f8bbc..b1b2f22 100644
    1183 --- a/net/core/sock.c
    1184 +++ b/net/core/sock.c
    1185 @@ -695,6 +695,8 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
    1186 if (len < 0)
    1187 return -EINVAL;
    1188
    1189 + v.val = 0;
    1190 +
    1191 switch(optname) {
    1192 case SO_DEBUG:
    1193 v.val = sock_flag(sk, SOCK_DBG);
    1194 diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
    1195 index 42065ff..ff75000 100644
    1196 --- a/net/ipv4/ipconfig.c
    1197 +++ b/net/ipv4/ipconfig.c
    1198 @@ -1272,6 +1272,9 @@ __be32 __init root_nfs_parse_addr(char *name)
    1199 static int __init ip_auto_config(void)
    1200 {
    1201 __be32 addr;
    1202 +#ifdef IPCONFIG_DYNAMIC
    1203 + int retries = CONF_OPEN_RETRIES;
    1204 +#endif
    1205
    1206 #ifdef CONFIG_PROC_FS
    1207 proc_net_fops_create(&init_net, "pnp", S_IRUGO, &pnp_seq_fops);
    1208 @@ -1308,9 +1311,6 @@ static int __init ip_auto_config(void)
    1209 #endif
    1210 ic_first_dev->next) {
    1211 #ifdef IPCONFIG_DYNAMIC
    1212 -
    1213 - int retries = CONF_OPEN_RETRIES;
    1214 -
    1215 if (ic_dynamic() < 0) {
    1216 ic_close_devs();
    1217
    1218 diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
    1219 index f57d576..9440ba6 100644
    1220 --- a/net/ipv4/tcp.c
    1221 +++ b/net/ipv4/tcp.c
    1222 @@ -518,8 +518,13 @@ static int tcp_splice_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb,
    1223 unsigned int offset, size_t len)
    1224 {
    1225 struct tcp_splice_state *tss = rd_desc->arg.data;
    1226 + int ret;
    1227
    1228 - return skb_splice_bits(skb, offset, tss->pipe, tss->len, tss->flags);
    1229 + ret = skb_splice_bits(skb, offset, tss->pipe, min(rd_desc->count, len),
    1230 + tss->flags);
    1231 + if (ret > 0)
    1232 + rd_desc->count -= ret;
    1233 + return ret;
    1234 }
    1235
    1236 static int __tcp_splice_read(struct sock *sk, struct tcp_splice_state *tss)
    1237 @@ -527,6 +532,7 @@ static int __tcp_splice_read(struct sock *sk, struct tcp_splice_state *tss)
    1238 /* Store TCP splice context information in read_descriptor_t. */
    1239 read_descriptor_t rd_desc = {
    1240 .arg.data = tss,
    1241 + .count = tss->len,
    1242 };
    1243
    1244 return tcp_read_sock(sk, &rd_desc, tcp_splice_data_recv);
    1245 @@ -611,11 +617,13 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos,
    1246 tss.len -= ret;
    1247 spliced += ret;
    1248
    1249 + if (!timeo)
    1250 + break;
    1251 release_sock(sk);
    1252 lock_sock(sk);
    1253
    1254 if (sk->sk_err || sk->sk_state == TCP_CLOSE ||
    1255 - (sk->sk_shutdown & RCV_SHUTDOWN) || !timeo ||
    1256 + (sk->sk_shutdown & RCV_SHUTDOWN) ||
    1257 signal_pending(current))
    1258 break;
    1259 }
    1260 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    1261 index 915e6b7..a9b62ee 100644
    1262 --- a/net/ipv4/udp.c
    1263 +++ b/net/ipv4/udp.c
    1264 @@ -959,9 +959,11 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
    1265
    1266 if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
    1267 /* Note that an ENOMEM error is charged twice */
    1268 - if (rc == -ENOMEM)
    1269 + if (rc == -ENOMEM) {
    1270 UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
    1271 is_udplite);
    1272 + atomic_inc(&sk->sk_drops);
    1273 + }
    1274 goto drop;
    1275 }
    1276
    1277 @@ -1172,7 +1174,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
    1278 int proto)
    1279 {
    1280 struct sock *sk;
    1281 - struct udphdr *uh = udp_hdr(skb);
    1282 + struct udphdr *uh;
    1283 unsigned short ulen;
    1284 struct rtable *rt = (struct rtable*)skb->dst;
    1285 __be32 saddr = ip_hdr(skb)->saddr;
    1286 @@ -1185,6 +1187,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
    1287 if (!pskb_may_pull(skb, sizeof(struct udphdr)))
    1288 goto drop; /* No space for header. */
    1289
    1290 + uh = udp_hdr(skb);
    1291 ulen = ntohs(uh->len);
    1292 if (ulen > skb->len)
    1293 goto short_packet;
    1294 diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
    1295 index 37a4e77..489a7fd 100644
    1296 --- a/net/ipv6/ip6_flowlabel.c
    1297 +++ b/net/ipv6/ip6_flowlabel.c
    1298 @@ -323,17 +323,21 @@ static struct ip6_flowlabel *
    1299 fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
    1300 int optlen, int *err_p)
    1301 {
    1302 - struct ip6_flowlabel *fl;
    1303 + struct ip6_flowlabel *fl = NULL;
    1304 int olen;
    1305 int addr_type;
    1306 int err;
    1307
    1308 + olen = optlen - CMSG_ALIGN(sizeof(*freq));
    1309 + err = -EINVAL;
    1310 + if (olen > 64 * 1024)
    1311 + goto done;
    1312 +
    1313 err = -ENOMEM;
    1314 fl = kzalloc(sizeof(*fl), GFP_KERNEL);
    1315 if (fl == NULL)
    1316 goto done;
    1317
    1318 - olen = optlen - CMSG_ALIGN(sizeof(*freq));
    1319 if (olen > 0) {
    1320 struct msghdr msg;
    1321 struct flowi flowi;
    1322 diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    1323 index 3df2c44..a423200 100644
    1324 --- a/net/ipv6/ip6_output.c
    1325 +++ b/net/ipv6/ip6_output.c
    1326 @@ -1091,6 +1091,18 @@ static inline int ip6_ufo_append_data(struct sock *sk,
    1327 return err;
    1328 }
    1329
    1330 +static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
    1331 + gfp_t gfp)
    1332 +{
    1333 + return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
    1334 +}
    1335 +
    1336 +static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
    1337 + gfp_t gfp)
    1338 +{
    1339 + return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
    1340 +}
    1341 +
    1342 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
    1343 int offset, int len, int odd, struct sk_buff *skb),
    1344 void *from, int length, int transhdrlen,
    1345 @@ -1116,17 +1128,37 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
    1346 * setup for corking
    1347 */
    1348 if (opt) {
    1349 - if (np->cork.opt == NULL) {
    1350 - np->cork.opt = kmalloc(opt->tot_len,
    1351 - sk->sk_allocation);
    1352 - if (unlikely(np->cork.opt == NULL))
    1353 - return -ENOBUFS;
    1354 - } else if (np->cork.opt->tot_len < opt->tot_len) {
    1355 - printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
    1356 + if (WARN_ON(np->cork.opt))
    1357 return -EINVAL;
    1358 - }
    1359 - memcpy(np->cork.opt, opt, opt->tot_len);
    1360 - inet->cork.flags |= IPCORK_OPT;
    1361 +
    1362 + np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
    1363 + if (unlikely(np->cork.opt == NULL))
    1364 + return -ENOBUFS;
    1365 +
    1366 + np->cork.opt->tot_len = opt->tot_len;
    1367 + np->cork.opt->opt_flen = opt->opt_flen;
    1368 + np->cork.opt->opt_nflen = opt->opt_nflen;
    1369 +
    1370 + np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
    1371 + sk->sk_allocation);
    1372 + if (opt->dst0opt && !np->cork.opt->dst0opt)
    1373 + return -ENOBUFS;
    1374 +
    1375 + np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
    1376 + sk->sk_allocation);
    1377 + if (opt->dst1opt && !np->cork.opt->dst1opt)
    1378 + return -ENOBUFS;
    1379 +
    1380 + np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
    1381 + sk->sk_allocation);
    1382 + if (opt->hopopt && !np->cork.opt->hopopt)
    1383 + return -ENOBUFS;
    1384 +
    1385 + np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
    1386 + sk->sk_allocation);
    1387 + if (opt->srcrt && !np->cork.opt->srcrt)
    1388 + return -ENOBUFS;
    1389 +
    1390 /* need source address above miyazawa*/
    1391 }
    1392 dst_hold(&rt->u.dst);
    1393 @@ -1153,8 +1185,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
    1394 } else {
    1395 rt = (struct rt6_info *)inet->cork.dst;
    1396 fl = &inet->cork.fl;
    1397 - if (inet->cork.flags & IPCORK_OPT)
    1398 - opt = np->cork.opt;
    1399 + opt = np->cork.opt;
    1400 transhdrlen = 0;
    1401 exthdrlen = 0;
    1402 mtu = inet->cork.fragsize;
    1403 @@ -1393,9 +1424,15 @@ error:
    1404
    1405 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
    1406 {
    1407 - inet->cork.flags &= ~IPCORK_OPT;
    1408 - kfree(np->cork.opt);
    1409 - np->cork.opt = NULL;
    1410 + if (np->cork.opt) {
    1411 + kfree(np->cork.opt->dst0opt);
    1412 + kfree(np->cork.opt->dst1opt);
    1413 + kfree(np->cork.opt->hopopt);
    1414 + kfree(np->cork.opt->srcrt);
    1415 + kfree(np->cork.opt);
    1416 + np->cork.opt = NULL;
    1417 + }
    1418 +
    1419 if (inet->cork.dst) {
    1420 dst_release(inet->cork.dst);
    1421 inet->cork.dst = NULL;
    1422 diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
    1423 index 14d47d8..0610123 100644
    1424 --- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
    1425 +++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
    1426 @@ -49,8 +49,8 @@ static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
    1427 static const u_int8_t invmap[] = {
    1428 [ICMPV6_ECHO_REQUEST - 128] = ICMPV6_ECHO_REPLY + 1,
    1429 [ICMPV6_ECHO_REPLY - 128] = ICMPV6_ECHO_REQUEST + 1,
    1430 - [ICMPV6_NI_QUERY - 128] = ICMPV6_NI_QUERY + 1,
    1431 - [ICMPV6_NI_REPLY - 128] = ICMPV6_NI_REPLY +1
    1432 + [ICMPV6_NI_QUERY - 128] = ICMPV6_NI_REPLY + 1,
    1433 + [ICMPV6_NI_REPLY - 128] = ICMPV6_NI_QUERY +1
    1434 };
    1435
    1436 static bool icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
    1437 diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
    1438 index 79a0627..27bd353 100644
    1439 --- a/net/mac80211/debugfs_sta.c
    1440 +++ b/net/mac80211/debugfs_sta.c
    1441 @@ -200,7 +200,7 @@ static ssize_t sta_agg_status_write(struct file *file,
    1442 /* toggle Rx aggregation command */
    1443 tid_num = tid_num - 100;
    1444 if (tid_static_rx[tid_num] == 1) {
    1445 - strcpy(state, "off ");
    1446 + strcpy(state, "off");
    1447 ieee80211_sta_stop_rx_ba_session(dev, da, tid_num, 0,
    1448 WLAN_REASON_QSTA_REQUIRE_SETUP);
    1449 sta->ampdu_mlme.tid_state_rx[tid_num] |=
    1450 diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
    1451 index e6e4681..aa7aec0 100644
    1452 --- a/net/netfilter/xt_sctp.c
    1453 +++ b/net/netfilter/xt_sctp.c
    1454 @@ -105,7 +105,7 @@ match_packet(const struct sk_buff *skb,
    1455
    1456 switch (chunk_match_type) {
    1457 case SCTP_CHUNK_MATCH_ALL:
    1458 - return SCTP_CHUNKMAP_IS_CLEAR(info->chunkmap);
    1459 + return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy);
    1460 case SCTP_CHUNK_MATCH_ANY:
    1461 return false;
    1462 case SCTP_CHUNK_MATCH_ONLY:
    1463 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
    1464 index c718e7e..4b50878 100644
    1465 --- a/net/packet/af_packet.c
    1466 +++ b/net/packet/af_packet.c
    1467 @@ -77,6 +77,7 @@
    1468 #include <linux/poll.h>
    1469 #include <linux/module.h>
    1470 #include <linux/init.h>
    1471 +#include <linux/mutex.h>
    1472
    1473 #ifdef CONFIG_INET
    1474 #include <net/inet_common.h>
    1475 @@ -175,6 +176,7 @@ struct packet_sock {
    1476 #endif
    1477 struct packet_type prot_hook;
    1478 spinlock_t bind_lock;
    1479 + struct mutex pg_vec_lock;
    1480 unsigned int running:1, /* prot_hook is attached*/
    1481 auxdata:1,
    1482 origdev:1;
    1483 @@ -220,13 +222,13 @@ static void *packet_lookup_frame(struct packet_sock *po, unsigned int position,
    1484 h.raw = po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size);
    1485 switch (po->tp_version) {
    1486 case TPACKET_V1:
    1487 - if (status != h.h1->tp_status ? TP_STATUS_USER :
    1488 - TP_STATUS_KERNEL)
    1489 + if (status != (h.h1->tp_status ? TP_STATUS_USER :
    1490 + TP_STATUS_KERNEL))
    1491 return NULL;
    1492 break;
    1493 case TPACKET_V2:
    1494 - if (status != h.h2->tp_status ? TP_STATUS_USER :
    1495 - TP_STATUS_KERNEL)
    1496 + if (status != (h.h2->tp_status ? TP_STATUS_USER :
    1497 + TP_STATUS_KERNEL))
    1498 return NULL;
    1499 break;
    1500 }
    1501 @@ -1068,6 +1070,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol)
    1502 */
    1503
    1504 spin_lock_init(&po->bind_lock);
    1505 + mutex_init(&po->pg_vec_lock);
    1506 po->prot_hook.func = packet_rcv;
    1507
    1508 if (sock->type == SOCK_PACKET)
    1509 @@ -1863,6 +1866,7 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing
    1510 synchronize_net();
    1511
    1512 err = -EBUSY;
    1513 + mutex_lock(&po->pg_vec_lock);
    1514 if (closing || atomic_read(&po->mapped) == 0) {
    1515 err = 0;
    1516 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
    1517 @@ -1884,6 +1888,7 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing
    1518 if (atomic_read(&po->mapped))
    1519 printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
    1520 }
    1521 + mutex_unlock(&po->pg_vec_lock);
    1522
    1523 spin_lock(&po->bind_lock);
    1524 if (was_running && !po->running) {
    1525 @@ -1916,7 +1921,7 @@ static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_st
    1526
    1527 size = vma->vm_end - vma->vm_start;
    1528
    1529 - lock_sock(sk);
    1530 + mutex_lock(&po->pg_vec_lock);
    1531 if (po->pg_vec == NULL)
    1532 goto out;
    1533 if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
    1534 @@ -1939,7 +1944,7 @@ static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_st
    1535 err = 0;
    1536
    1537 out:
    1538 - release_sock(sk);
    1539 + mutex_unlock(&po->pg_vec_lock);
    1540 return err;
    1541 }
    1542 #endif
    1543 diff --git a/net/sctp/output.c b/net/sctp/output.c
    1544 index 225c712..e4746fd 100644
    1545 --- a/net/sctp/output.c
    1546 +++ b/net/sctp/output.c
    1547 @@ -324,14 +324,16 @@ append:
    1548 switch (chunk->chunk_hdr->type) {
    1549 case SCTP_CID_DATA:
    1550 retval = sctp_packet_append_data(packet, chunk);
    1551 + if (SCTP_XMIT_OK != retval)
    1552 + goto finish;
    1553 /* Disallow SACK bundling after DATA. */
    1554 packet->has_sack = 1;
    1555 /* Disallow AUTH bundling after DATA */
    1556 packet->has_auth = 1;
    1557 /* Let it be knows that packet has DATA in it */
    1558 packet->has_data = 1;
    1559 - if (SCTP_XMIT_OK != retval)
    1560 - goto finish;
    1561 + /* timestamp the chunk for rtx purposes */
    1562 + chunk->sent_at = jiffies;
    1563 break;
    1564 case SCTP_CID_COOKIE_ECHO:
    1565 packet->has_cookie_echo = 1;
    1566 @@ -470,7 +472,6 @@ int sctp_packet_transmit(struct sctp_packet *packet)
    1567 } else
    1568 chunk->resent = 1;
    1569
    1570 - chunk->sent_at = jiffies;
    1571 has_data = 1;
    1572 }
    1573
    1574 diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
    1575 index 4328ad5..fe11686 100644
    1576 --- a/net/sctp/outqueue.c
    1577 +++ b/net/sctp/outqueue.c
    1578 @@ -929,7 +929,6 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
    1579 }
    1580
    1581 /* Finally, transmit new packets. */
    1582 - start_timer = 0;
    1583 while ((chunk = sctp_outq_dequeue_data(q)) != NULL) {
    1584 /* RFC 2960 6.5 Every DATA chunk MUST carry a valid
    1585 * stream identifier.
    1586 @@ -1028,7 +1027,7 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
    1587 list_add_tail(&chunk->transmitted_list,
    1588 &transport->transmitted);
    1589
    1590 - sctp_transport_reset_timers(transport, start_timer-1);
    1591 + sctp_transport_reset_timers(transport, 0);
    1592
    1593 q->empty = 0;
    1594
    1595 diff --git a/scripts/kernel-doc b/scripts/kernel-doc
    1596 index 44ee94d..0865a89 100755
    1597 --- a/scripts/kernel-doc
    1598 +++ b/scripts/kernel-doc
    1599 @@ -1758,6 +1758,40 @@ sub reset_state {
    1600 $state = 0;
    1601 }
    1602
    1603 +sub syscall_munge() {
    1604 + my $void = 0;
    1605 +
    1606 + $prototype =~ s@[\r\n\t]+@ @gos; # strip newlines/CR's/tabs
    1607 +## if ($prototype =~ m/SYSCALL_DEFINE0\s*\(\s*(a-zA-Z0-9_)*\s*\)/) {
    1608 + if ($prototype =~ m/SYSCALL_DEFINE0/) {
    1609 + $void = 1;
    1610 +## $prototype = "long sys_$1(void)";
    1611 + }
    1612 +
    1613 + $prototype =~ s/SYSCALL_DEFINE.*\(/long sys_/; # fix return type & func name
    1614 + if ($prototype =~ m/long (sys_.*?),/) {
    1615 + $prototype =~ s/,/\(/;
    1616 + } elsif ($void) {
    1617 + $prototype =~ s/\)/\(void\)/;
    1618 + }
    1619 +
    1620 + # now delete all of the odd-number commas in $prototype
    1621 + # so that arg types & arg names don't have a comma between them
    1622 + my $count = 0;
    1623 + my $len = length($prototype);
    1624 + if ($void) {
    1625 + $len = 0; # skip the for-loop
    1626 + }
    1627 + for (my $ix = 0; $ix < $len; $ix++) {
    1628 + if (substr($prototype, $ix, 1) eq ',') {
    1629 + $count++;
    1630 + if ($count % 2 == 1) {
    1631 + substr($prototype, $ix, 1) = ' ';
    1632 + }
    1633 + }
    1634 + }
    1635 +}
    1636 +
    1637 sub process_state3_function($$) {
    1638 my $x = shift;
    1639 my $file = shift;
    1640 @@ -1774,7 +1808,10 @@ sub process_state3_function($$) {
    1641 $prototype =~ s@/\*.*?\*/@@gos; # strip comments.
    1642 $prototype =~ s@[\r\n]+@ @gos; # strip newlines/cr's.
    1643 $prototype =~ s@^\s+@@gos; # strip leading spaces
    1644 - dump_function($prototype,$file);
    1645 + if ($prototype =~ /SYSCALL_DEFINE/) {
    1646 + syscall_munge();
    1647 + }
    1648 + dump_function($prototype, $file);
    1649 reset_state();
    1650 }
    1651 }
    1652 diff --git a/sound/drivers/mtpav.c b/sound/drivers/mtpav.c
    1653 index b5e1a71..04d50aa 100644
    1654 --- a/sound/drivers/mtpav.c
    1655 +++ b/sound/drivers/mtpav.c
    1656 @@ -706,7 +706,6 @@ static int __devinit snd_mtpav_probe(struct platform_device *dev)
    1657 mtp_card->card = card;
    1658 mtp_card->irq = -1;
    1659 mtp_card->share_irq = 0;
    1660 - mtp_card->inmidiport = 0xffffffff;
    1661 mtp_card->inmidistate = 0;
    1662 mtp_card->outmidihwport = 0xffffffff;
    1663 init_timer(&mtp_card->timer);
    1664 @@ -715,6 +714,8 @@ static int __devinit snd_mtpav_probe(struct platform_device *dev)
    1665
    1666 card->private_free = snd_mtpav_free;
    1667
    1668 + mtp_card->inmidiport = mtp_card->num_ports + MTPAV_PIDX_BROADCAST;
    1669 +
    1670 err = snd_mtpav_get_ISA(mtp_card);
    1671 if (err < 0)
    1672 goto __error;