Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-2.6.27-r3/0129-2.6.27.30-all-fixes.patch

    Annotation of /trunk/kernel26-alx/patches-2.6.27-r3/0129-2.6.27.30-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 1176 - (hide annotations) (download)
    Thu Oct 14 15:11:06 2010 UTC (13 years, 7 months ago) by niro
    File size: 30177 byte(s) 
    -2.6.27-alx-r3: new magellan 0.5.2 kernel
    1 niro 1176 diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
    2     index 5259d8c..5d8fa67 100644
    3     --- a/arch/parisc/kernel/cache.c
    4     +++ b/arch/parisc/kernel/cache.c
    5     @@ -398,12 +398,13 @@ EXPORT_SYMBOL(flush_kernel_icache_range_asm);
    6    
    7     void clear_user_page_asm(void *page, unsigned long vaddr)
    8     {
    9     + unsigned long flags;
    10     /* This function is implemented in assembly in pacache.S */
    11     extern void __clear_user_page_asm(void *page, unsigned long vaddr);
    12    
    13     - purge_tlb_start();
    14     + purge_tlb_start(flags);
    15     __clear_user_page_asm(page, vaddr);
    16     - purge_tlb_end();
    17     + purge_tlb_end(flags);
    18     }
    19    
    20     #define FLUSH_THRESHOLD 0x80000 /* 0.5MB */
    21     @@ -444,20 +445,24 @@ extern void clear_user_page_asm(void *page, unsigned long vaddr);
    22    
    23     void clear_user_page(void *page, unsigned long vaddr, struct page *pg)
    24     {
    25     + unsigned long flags;
    26     +
    27     purge_kernel_dcache_page((unsigned long)page);
    28     - purge_tlb_start();
    29     + purge_tlb_start(flags);
    30     pdtlb_kernel(page);
    31     - purge_tlb_end();
    32     + purge_tlb_end(flags);
    33     clear_user_page_asm(page, vaddr);
    34     }
    35     EXPORT_SYMBOL(clear_user_page);
    36    
    37     void flush_kernel_dcache_page_addr(void *addr)
    38     {
    39     + unsigned long flags;
    40     +
    41     flush_kernel_dcache_page_asm(addr);
    42     - purge_tlb_start();
    43     + purge_tlb_start(flags);
    44     pdtlb_kernel(addr);
    45     - purge_tlb_end();
    46     + purge_tlb_end(flags);
    47     }
    48     EXPORT_SYMBOL(flush_kernel_dcache_page_addr);
    49    
    50     @@ -490,8 +495,10 @@ void __flush_tlb_range(unsigned long sid, unsigned long start,
    51     if (npages >= 512) /* 2MB of space: arbitrary, should be tuned */
    52     flush_tlb_all();
    53     else {
    54     + unsigned long flags;
    55     +
    56     mtsp(sid, 1);
    57     - purge_tlb_start();
    58     + purge_tlb_start(flags);
    59     if (split_tlb) {
    60     while (npages--) {
    61     pdtlb(start);
    62     @@ -504,7 +511,7 @@ void __flush_tlb_range(unsigned long sid, unsigned long start,
    63     start += PAGE_SIZE;
    64     }
    65     }
    66     - purge_tlb_end();
    67     + purge_tlb_end(flags);
    68     }
    69     }
    70    
    71     diff --git a/arch/parisc/kernel/pci-dma.c b/arch/parisc/kernel/pci-dma.c
    72     index ccd61b9..6cc0be1 100644
    73     --- a/arch/parisc/kernel/pci-dma.c
    74     +++ b/arch/parisc/kernel/pci-dma.c
    75     @@ -90,12 +90,14 @@ static inline int map_pte_uncached(pte_t * pte,
    76     if (end > PMD_SIZE)
    77     end = PMD_SIZE;
    78     do {
    79     + unsigned long flags;
    80     +
    81     if (!pte_none(*pte))
    82     printk(KERN_ERR "map_pte_uncached: page already exists\n");
    83     set_pte(pte, __mk_pte(*paddr_ptr, PAGE_KERNEL_UNC));
    84     - purge_tlb_start();
    85     + purge_tlb_start(flags);
    86     pdtlb_kernel(orig_vaddr);
    87     - purge_tlb_end();
    88     + purge_tlb_end(flags);
    89     vaddr += PAGE_SIZE;
    90     orig_vaddr += PAGE_SIZE;
    91     (*paddr_ptr) += PAGE_SIZE;
    92     @@ -168,11 +170,13 @@ static inline void unmap_uncached_pte(pmd_t * pmd, unsigned long vaddr,
    93     if (end > PMD_SIZE)
    94     end = PMD_SIZE;
    95     do {
    96     + unsigned long flags;
    97     +
    98     pte_t page = *pte;
    99     pte_clear(&init_mm, vaddr, pte);
    100     - purge_tlb_start();
    101     + purge_tlb_start(flags);
    102     pdtlb_kernel(orig_vaddr);
    103     - purge_tlb_end();
    104     + purge_tlb_end(flags);
    105     vaddr += PAGE_SIZE;
    106     orig_vaddr += PAGE_SIZE;
    107     pte++;
    108     diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
    109     index be33a54..eed133e 100644
    110     --- a/arch/x86/kernel/pci-gart_64.c
    111     +++ b/arch/x86/kernel/pci-gart_64.c
    112     @@ -658,8 +658,6 @@ static __init int init_k8_gatt(struct agp_kern_info *info)
    113     memset(gatt, 0, gatt_size);
    114     agp_gatt_table = gatt;
    115    
    116     - enable_gart_translations();
    117     -
    118     error = sysdev_class_register(&gart_sysdev_class);
    119     if (!error)
    120     error = sysdev_register(&device_gart);
    121     @@ -828,6 +826,14 @@ void __init gart_iommu_init(void)
    122     wbinvd();
    123    
    124     /*
    125     + * Now all caches are flushed and we can safely enable
    126     + * GART hardware. Doing it early leaves the possibility
    127     + * of stale cache entries that can lead to GART PTE
    128     + * errors.
    129     + */
    130     + enable_gart_translations();
    131     +
    132     + /*
    133     * Try to workaround a bug (thanks to BenH):
    134     * Set unmapped entries to a scratch page instead of 0.
    135     * Any prefetches that hit unmapped entries won't get an bus abort
    136     diff --git a/block/Kconfig b/block/Kconfig
    137     index 1ab7c15..150e21d 100644
    138     --- a/block/Kconfig
    139     +++ b/block/Kconfig
    140     @@ -67,9 +67,9 @@ config LSF
    141     If unsure, say Y.
    142    
    143     config BLK_DEV_BSG
    144     - bool "Block layer SG support v4 (EXPERIMENTAL)"
    145     - depends on EXPERIMENTAL
    146     - ---help---
    147     + bool "Block layer SG support v4"
    148     + default y
    149     + help
    150     Saying Y here will enable generic SG (SCSI generic) v4 support
    151     for any block device.
    152    
    153     @@ -79,7 +79,10 @@ config BLK_DEV_BSG
    154     protocols (e.g. Task Management Functions and SMP in Serial
    155     Attached SCSI).
    156    
    157     - If unsure, say N.
    158     + This option is required by recent UDEV versions to properly
    159     + access device serial numbers, etc.
    160     +
    161     + If unsure, say Y.
    162    
    163     config BLK_DEV_INTEGRITY
    164     bool "Block layer data integrity support"
    165     diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
    166     index 716370c..e56f805 100644
    167     --- a/drivers/firewire/fw-sbp2.c
    168     +++ b/drivers/firewire/fw-sbp2.c
    169     @@ -188,6 +188,12 @@ struct sbp2_target {
    170     #define SBP2_RETRY_LIMIT 0xf /* 15 retries */
    171     #define SBP2_CYCLE_LIMIT (0xc8 << 12) /* 200 125us cycles */
    172    
    173     +/*
    174     + * There is no transport protocol limit to the CDB length, but we implement
    175     + * a fixed length only. 16 bytes is enough for disks larger than 2 TB.
    176     + */
    177     +#define SBP2_MAX_CDB_SIZE 16
    178     +
    179     /* Unit directory keys */
    180     #define SBP2_CSR_UNIT_CHARACTERISTICS 0x3a
    181     #define SBP2_CSR_FIRMWARE_REVISION 0x3c
    182     @@ -293,7 +299,7 @@ struct sbp2_command_orb {
    183     struct sbp2_pointer next;
    184     struct sbp2_pointer data_descriptor;
    185     __be32 misc;
    186     - u8 command_block[12];
    187     + u8 command_block[SBP2_MAX_CDB_SIZE];
    188     } request;
    189     struct scsi_cmnd *cmd;
    190     scsi_done_fn_t done;
    191     @@ -1159,6 +1165,8 @@ static int sbp2_probe(struct device *dev)
    192     if (fw_device_enable_phys_dma(device) < 0)
    193     goto fail_shost_put;
    194    
    195     + shost->max_cmd_len = SBP2_MAX_CDB_SIZE;
    196     +
    197     if (scsi_add_host(shost, &unit->device) < 0)
    198     goto fail_shost_put;
    199    
    200     diff --git a/drivers/hwmon/smsc47m1.c b/drivers/hwmon/smsc47m1.c
    201     index d1b4985..fa72f5f 100644
    202     --- a/drivers/hwmon/smsc47m1.c
    203     +++ b/drivers/hwmon/smsc47m1.c
    204     @@ -85,6 +85,7 @@ superio_exit(void)
    205     #define SUPERIO_REG_ACT 0x30
    206     #define SUPERIO_REG_BASE 0x60
    207     #define SUPERIO_REG_DEVID 0x20
    208     +#define SUPERIO_REG_DEVREV 0x21
    209    
    210     /* Logical device registers */
    211    
    212     @@ -428,6 +429,9 @@ static int __init smsc47m1_find(unsigned short *addr,
    213     * The LPC47M292 (device id 0x6B) is somewhat compatible, but it
    214     * supports a 3rd fan, and the pin configuration registers are
    215     * unfortunately different.
    216     + * The LPC47M233 has the same device id (0x6B) but is not compatible.
    217     + * We check the high bit of the device revision register to
    218     + * differentiate them.
    219     */
    220     switch (val) {
    221     case 0x51:
    222     @@ -447,6 +451,13 @@ static int __init smsc47m1_find(unsigned short *addr,
    223     sio_data->type = smsc47m1;
    224     break;
    225     case 0x6B:
    226     + if (superio_inb(SUPERIO_REG_DEVREV) & 0x80) {
    227     + pr_debug(DRVNAME ": "
    228     + "Found SMSC LPC47M233, unsupported\n");
    229     + superio_exit();
    230     + return -ENODEV;
    231     + }
    232     +
    233     pr_info(DRVNAME ": Found SMSC LPC47M292\n");
    234     sio_data->type = smsc47m2;
    235     break;
    236     diff --git a/drivers/i2c/chips/tsl2550.c b/drivers/i2c/chips/tsl2550.c
    237     index 1a9cc13..b96f302 100644
    238     --- a/drivers/i2c/chips/tsl2550.c
    239     +++ b/drivers/i2c/chips/tsl2550.c
    240     @@ -27,7 +27,7 @@
    241     #include <linux/delay.h>
    242    
    243     #define TSL2550_DRV_NAME "tsl2550"
    244     -#define DRIVER_VERSION "1.1.1"
    245     +#define DRIVER_VERSION "1.1.2"
    246    
    247     /*
    248     * Defines
    249     @@ -189,13 +189,16 @@ static int tsl2550_calculate_lux(u8 ch0, u8 ch1)
    250     u8 r = 128;
    251    
    252     /* Avoid division by 0 and count 1 cannot be greater than count 0 */
    253     - if (c0 && (c1 <= c0))
    254     - r = c1 * 128 / c0;
    255     + if (c1 <= c0)
    256     + if (c0) {
    257     + r = c1 * 128 / c0;
    258     +
    259     + /* Calculate LUX */
    260     + lux = ((c0 - c1) * ratio_lut[r]) / 256;
    261     + } else
    262     + lux = 0;
    263     else
    264     - return -1;
    265     -
    266     - /* Calculate LUX */
    267     - lux = ((c0 - c1) * ratio_lut[r]) / 256;
    268     + return -EAGAIN;
    269    
    270     /* LUX range check */
    271     return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
    272     diff --git a/drivers/ieee1394/sbp2.c b/drivers/ieee1394/sbp2.c
    273     index 0c0fdbb..e21c2d5 100644
    274     --- a/drivers/ieee1394/sbp2.c
    275     +++ b/drivers/ieee1394/sbp2.c
    276     @@ -874,6 +874,7 @@ static struct sbp2_lu *sbp2_alloc_device(struct unit_directory *ud)
    277     }
    278    
    279     shost->hostdata[0] = (unsigned long)lu;
    280     + shost->max_cmd_len = SBP2_MAX_CDB_SIZE;
    281    
    282     if (!scsi_add_host(shost, &ud->device)) {
    283     lu->shost = shost;
    284     diff --git a/drivers/ieee1394/sbp2.h b/drivers/ieee1394/sbp2.h
    285     index 875428b..e547b16 100644
    286     --- a/drivers/ieee1394/sbp2.h
    287     +++ b/drivers/ieee1394/sbp2.h
    288     @@ -25,6 +25,12 @@
    289     #define SBP2_DEVICE_NAME "sbp2"
    290    
    291     /*
    292     + * There is no transport protocol limit to the CDB length, but we implement
    293     + * a fixed length only. 16 bytes is enough for disks larger than 2 TB.
    294     + */
    295     +#define SBP2_MAX_CDB_SIZE 16
    296     +
    297     +/*
    298     * SBP-2 specific definitions
    299     */
    300    
    301     @@ -51,7 +57,7 @@ struct sbp2_command_orb {
    302     u32 data_descriptor_hi;
    303     u32 data_descriptor_lo;
    304     u32 misc;
    305     - u8 cdb[12];
    306     + u8 cdb[SBP2_MAX_CDB_SIZE];
    307     } __attribute__((packed));
    308    
    309     #define SBP2_LOGIN_REQUEST 0x0
    310     diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
    311     index a726f3b..52174d9 100644
    312     --- a/drivers/misc/Kconfig
    313     +++ b/drivers/misc/Kconfig
    314     @@ -321,6 +321,7 @@ config THINKPAD_ACPI_DOCK
    315     bool "Legacy Docking Station Support"
    316     depends on THINKPAD_ACPI
    317     depends on ACPI_DOCK=n
    318     + depends on BROKEN
    319     default n
    320     ---help---
    321     Allows the thinkpad_acpi driver to handle docking station events.
    322     @@ -334,7 +335,8 @@ config THINKPAD_ACPI_DOCK
    323     config THINKPAD_ACPI_BAY
    324     bool "Legacy Removable Bay Support"
    325     depends on THINKPAD_ACPI
    326     - default y
    327     + depends on BROKEN
    328     + default n
    329     ---help---
    330     Allows the thinkpad_acpi driver to handle removable bays. It will
    331     electrically disable the device in the bay, and also generate
    332     diff --git a/drivers/net/usb/asix.c b/drivers/net/usb/asix.c
    333     index 375a0bd..ec4204a 100644
    334     --- a/drivers/net/usb/asix.c
    335     +++ b/drivers/net/usb/asix.c
    336     @@ -1456,6 +1456,14 @@ static const struct usb_device_id products [] = {
    337     // ASIX 88772a
    338     USB_DEVICE(0x0db0, 0xa877),
    339     .driver_info = (unsigned long) &ax88772_info,
    340     +}, {
    341     + // ABOCOM for pci
    342     + USB_DEVICE(0x14ea, 0xab11),
    343     + .driver_info = (unsigned long) &ax88178_info,
    344     +}, {
    345     + // ASIX 88772a
    346     + USB_DEVICE(0x0db0, 0xa877),
    347     + .driver_info = (unsigned long) &ax88772_info,
    348     },
    349     { }, // END
    350     };
    351     diff --git a/drivers/scsi/libsas/sas_port.c b/drivers/scsi/libsas/sas_port.c
    352     index 139935a..ad02d57 100644
    353     --- a/drivers/scsi/libsas/sas_port.c
    354     +++ b/drivers/scsi/libsas/sas_port.c
    355     @@ -56,7 +56,7 @@ static void sas_form_port(struct asd_sas_phy *phy)
    356     }
    357     }
    358    
    359     - /* find a port */
    360     + /* see if the phy should be part of a wide port */
    361     spin_lock_irqsave(&sas_ha->phy_port_lock, flags);
    362     for (i = 0; i < sas_ha->num_phys; i++) {
    363     port = sas_ha->sas_port[i];
    364     @@ -69,12 +69,23 @@ static void sas_form_port(struct asd_sas_phy *phy)
    365     SAS_DPRINTK("phy%d matched wide port%d\n", phy->id,
    366     port->id);
    367     break;
    368     - } else if (*(u64 *) port->sas_addr == 0 && port->num_phys==0) {
    369     - memcpy(port->sas_addr, phy->sas_addr, SAS_ADDR_SIZE);
    370     - break;
    371     }
    372     spin_unlock(&port->phy_list_lock);
    373     }
    374     + /* The phy does not match any existing port, create a new one */
    375     + if (i == sas_ha->num_phys) {
    376     + for (i = 0; i < sas_ha->num_phys; i++) {
    377     + port = sas_ha->sas_port[i];
    378     + spin_lock(&port->phy_list_lock);
    379     + if (*(u64 *)port->sas_addr == 0
    380     + && port->num_phys == 0) {
    381     + memcpy(port->sas_addr, phy->sas_addr,
    382     + SAS_ADDR_SIZE);
    383     + break;
    384     + }
    385     + spin_unlock(&port->phy_list_lock);
    386     + }
    387     + }
    388    
    389     if (i >= sas_ha->num_phys) {
    390     printk(KERN_NOTICE "%s: couldn't find a free port, bug?\n",
    391     diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
    392     index 1ff88af..33b2935 100644
    393     --- a/drivers/usb/core/devio.c
    394     +++ b/drivers/usb/core/devio.c
    395     @@ -579,7 +579,7 @@ static int usbdev_open(struct inode *inode, struct file *file)
    396     if (!ps)
    397     goto out;
    398    
    399     - ret = -ENOENT;
    400     + ret = -ENODEV;
    401    
    402     /* usbdev device-node */
    403     if (imajor(inode) == USB_DEVICE_MAJOR)
    404     @@ -1305,7 +1305,8 @@ static int get_urb32(struct usbdevfs_urb *kurb,
    405     struct usbdevfs_urb32 __user *uurb)
    406     {
    407     __u32 uptr;
    408     - if (get_user(kurb->type, &uurb->type) ||
    409     + if (!access_ok(VERIFY_READ, uurb, sizeof(*uurb)) ||
    410     + __get_user(kurb->type, &uurb->type) ||
    411     __get_user(kurb->endpoint, &uurb->endpoint) ||
    412     __get_user(kurb->status, &uurb->status) ||
    413     __get_user(kurb->flags, &uurb->flags) ||
    414     @@ -1522,8 +1523,9 @@ static int proc_ioctl_compat(struct dev_state *ps, compat_uptr_t arg)
    415     u32 udata;
    416    
    417     uioc = compat_ptr((long)arg);
    418     - if (get_user(ctrl.ifno, &uioc->ifno) ||
    419     - get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
    420     + if (!access_ok(VERIFY_READ, uioc, sizeof(*uioc)) ||
    421     + __get_user(ctrl.ifno, &uioc->ifno) ||
    422     + __get_user(ctrl.ioctl_code, &uioc->ioctl_code) ||
    423     __get_user(udata, &uioc->data))
    424     return -EFAULT;
    425     ctrl.data = compat_ptr(udata);
    426     diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    427     index 13b34bc..c3089c9 100644
    428     --- a/drivers/usb/serial/ftdi_sio.c
    429     +++ b/drivers/usb/serial/ftdi_sio.c
    430     @@ -663,6 +663,9 @@ static struct usb_device_id id_table_combined [] = {
    431     { USB_DEVICE(ADI_VID, ADI_GNICE_PID),
    432     .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    433     { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
    434     + { USB_DEVICE(BAYER_VID, BAYER_CONTOUR_CABLE_PID) },
    435     + { USB_DEVICE(FTDI_VID, MARVELL_OPENRD_PID),
    436     + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    437     { }, /* Optional parameter entry */
    438     { } /* Terminating entry */
    439     };
    440     diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
    441     index 3425122..c1a6be7 100644
    442     --- a/drivers/usb/serial/ftdi_sio.h
    443     +++ b/drivers/usb/serial/ftdi_sio.h
    444     @@ -897,6 +897,20 @@
    445     #define JETI_SPC1201_PID 0x04b2
    446    
    447     /*
    448     + * Bayer Ascensia Contour blood glucose meter USB-converter cable.
    449     + * http://winglucofacts.com/cables/
    450     + */
    451     +#define BAYER_VID 0x1A79
    452     +#define BAYER_CONTOUR_CABLE_PID 0x6001
    453     +
    454     +/*
    455     + * Marvell OpenRD Base, Client
    456     + * http://www.open-rd.org
    457     + * OpenRD Base, Client use VID 0x0403
    458     + */
    459     +#define MARVELL_OPENRD_PID 0x9e90
    460     +
    461     +/*
    462     * BmRequestType: 1100 0000b
    463     * bRequest: FTDI_E2_READ
    464     * wValue: 0
    465     diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
    466     index 861e308..5d4f9d6 100644
    467     --- a/drivers/usb/storage/transport.c
    468     +++ b/drivers/usb/storage/transport.c
    469     @@ -961,7 +961,7 @@ int usb_stor_Bulk_max_lun(struct us_data *us)
    470     US_BULK_GET_MAX_LUN,
    471     USB_DIR_IN | USB_TYPE_CLASS |
    472     USB_RECIP_INTERFACE,
    473     - 0, us->ifnum, us->iobuf, 1, HZ);
    474     + 0, us->ifnum, us->iobuf, 1, 10*HZ);
    475    
    476     US_DEBUGP("GetMaxLUN command result is %d, data is %d\n",
    477     result, us->iobuf[0]);
    478     diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    479     index 65115a5..17e9626 100644
    480     --- a/drivers/usb/storage/unusual_devs.h
    481     +++ b/drivers/usb/storage/unusual_devs.h
    482     @@ -989,6 +989,13 @@ UNUSUAL_DEV( 0x066f, 0x8000, 0x0001, 0x0001,
    483     US_SC_DEVICE, US_PR_DEVICE, NULL,
    484     US_FL_FIX_CAPACITY ),
    485    
    486     +/* Reported by Rogerio Brito <rbrito@ime.usp.br> */
    487     +UNUSUAL_DEV( 0x067b, 0x2317, 0x0001, 0x001,
    488     + "Prolific Technology, Inc.",
    489     + "Mass Storage Device",
    490     + US_SC_DEVICE, US_PR_DEVICE, NULL,
    491     + US_FL_NOT_LOCKABLE ),
    492     +
    493     /* Reported by Richard -=[]=- <micro_flyer@hotmail.com> */
    494     /* Change to bcdDeviceMin (0x0100 to 0x0001) reported by
    495     * Thomas Bartosik <tbartdev@gmx-topmail.de> */
    496     diff --git a/fs/binfmt_flat.c b/fs/binfmt_flat.c
    497     index dfc0197..25200e6 100644
    498     --- a/fs/binfmt_flat.c
    499     +++ b/fs/binfmt_flat.c
    500     @@ -824,15 +824,22 @@ static int load_flat_shared_library(int id, struct lib_info *libs)
    501     if (IS_ERR(bprm.file))
    502     return res;
    503    
    504     + bprm.cred = prepare_exec_creds();
    505     + res = -ENOMEM;
    506     + if (!bprm.cred)
    507     + goto out;
    508     +
    509     res = prepare_binprm(&bprm);
    510    
    511     if (res <= (unsigned long)-4096)
    512     res = load_flat_file(&bprm, libs, id, NULL);
    513     - if (bprm.file) {
    514     - allow_write_access(bprm.file);
    515     - fput(bprm.file);
    516     - bprm.file = NULL;
    517     - }
    518     +
    519     + abort_creds(bprm.cred);
    520     +
    521     +out:
    522     + allow_write_access(bprm.file);
    523     + fput(bprm.file);
    524     +
    525     return(res);
    526     }
    527    
    528     diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
    529     index 61cb48f..994ca87 100644
    530     --- a/fs/compat_ioctl.c
    531     +++ b/fs/compat_ioctl.c
    532     @@ -1910,6 +1910,7 @@ COMPATIBLE_IOCTL(FIONCLEX)
    533     COMPATIBLE_IOCTL(FIOASYNC)
    534     COMPATIBLE_IOCTL(FIONBIO)
    535     COMPATIBLE_IOCTL(FIONREAD) /* This is also TIOCINQ */
    536     +COMPATIBLE_IOCTL(FS_IOC_FIEMAP)
    537     /* 0x00 */
    538     COMPATIBLE_IOCTL(FIBMAP)
    539     COMPATIBLE_IOCTL(FIGETBSZ)
    540     diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c
    541     index 08f6b04..630feb3 100644
    542     --- a/fs/nfs/direct.c
    543     +++ b/fs/nfs/direct.c
    544     @@ -255,7 +255,7 @@ static void nfs_direct_read_release(void *calldata)
    545    
    546     if (put_dreq(dreq))
    547     nfs_direct_complete(dreq);
    548     - nfs_readdata_release(calldata);
    549     + nfs_readdata_free(data);
    550     }
    551    
    552     static const struct rpc_call_ops nfs_read_direct_ops = {
    553     @@ -311,14 +311,14 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
    554     data->npages, 1, 0, data->pagevec, NULL);
    555     up_read(&current->mm->mmap_sem);
    556     if (result < 0) {
    557     - nfs_readdata_release(data);
    558     + nfs_readdata_free(data);
    559     break;
    560     }
    561     if ((unsigned)result < data->npages) {
    562     bytes = result * PAGE_SIZE;
    563     if (bytes <= pgbase) {
    564     nfs_direct_release_pages(data->pagevec, result);
    565     - nfs_readdata_release(data);
    566     + nfs_readdata_free(data);
    567     break;
    568     }
    569     bytes -= pgbase;
    570     @@ -331,7 +331,7 @@ static ssize_t nfs_direct_read_schedule_segment(struct nfs_direct_req *dreq,
    571     data->inode = inode;
    572     data->cred = msg.rpc_cred;
    573     data->args.fh = NFS_FH(inode);
    574     - data->args.context = get_nfs_open_context(ctx);
    575     + data->args.context = ctx;
    576     data->args.offset = pos;
    577     data->args.pgbase = pgbase;
    578     data->args.pages = data->pagevec;
    579     @@ -438,7 +438,7 @@ static void nfs_direct_free_writedata(struct nfs_direct_req *dreq)
    580     struct nfs_write_data *data = list_entry(dreq->rewrite_list.next, struct nfs_write_data, pages);
    581     list_del(&data->pages);
    582     nfs_direct_release_pages(data->pagevec, data->npages);
    583     - nfs_writedata_release(data);
    584     + nfs_writedata_free(data);
    585     }
    586     }
    587    
    588     @@ -531,7 +531,7 @@ static void nfs_direct_commit_release(void *calldata)
    589    
    590     dprintk("NFS: %5u commit returned %d\n", data->task.tk_pid, status);
    591     nfs_direct_write_complete(dreq, data->inode);
    592     - nfs_commitdata_release(calldata);
    593     + nfs_commit_free(data);
    594     }
    595    
    596     static const struct rpc_call_ops nfs_commit_direct_ops = {
    597     @@ -564,7 +564,7 @@ static void nfs_direct_commit_schedule(struct nfs_direct_req *dreq)
    598     data->args.fh = NFS_FH(data->inode);
    599     data->args.offset = 0;
    600     data->args.count = 0;
    601     - data->args.context = get_nfs_open_context(dreq->ctx);
    602     + data->args.context = dreq->ctx;
    603     data->res.count = 0;
    604     data->res.fattr = &data->fattr;
    605     data->res.verf = &data->verf;
    606     @@ -725,14 +725,14 @@ static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
    607     data->npages, 0, 0, data->pagevec, NULL);
    608     up_read(&current->mm->mmap_sem);
    609     if (result < 0) {
    610     - nfs_writedata_release(data);
    611     + nfs_writedata_free(data);
    612     break;
    613     }
    614     if ((unsigned)result < data->npages) {
    615     bytes = result * PAGE_SIZE;
    616     if (bytes <= pgbase) {
    617     nfs_direct_release_pages(data->pagevec, result);
    618     - nfs_writedata_release(data);
    619     + nfs_writedata_free(data);
    620     break;
    621     }
    622     bytes -= pgbase;
    623     @@ -747,7 +747,7 @@ static ssize_t nfs_direct_write_schedule_segment(struct nfs_direct_req *dreq,
    624     data->inode = inode;
    625     data->cred = msg.rpc_cred;
    626     data->args.fh = NFS_FH(inode);
    627     - data->args.context = get_nfs_open_context(ctx);
    628     + data->args.context = ctx;
    629     data->args.offset = pos;
    630     data->args.pgbase = pgbase;
    631     data->args.pages = data->pagevec;
    632     diff --git a/fs/nfs/read.c b/fs/nfs/read.c
    633     index f856004..ff41222 100644
    634     --- a/fs/nfs/read.c
    635     +++ b/fs/nfs/read.c
    636     @@ -58,17 +58,15 @@ struct nfs_read_data *nfs_readdata_alloc(unsigned int pagecount)
    637     return p;
    638     }
    639    
    640     -static void nfs_readdata_free(struct nfs_read_data *p)
    641     +void nfs_readdata_free(struct nfs_read_data *p)
    642     {
    643     if (p && (p->pagevec != &p->page_array[0]))
    644     kfree(p->pagevec);
    645     mempool_free(p, nfs_rdata_mempool);
    646     }
    647    
    648     -void nfs_readdata_release(void *data)
    649     +static void nfs_readdata_release(struct nfs_read_data *rdata)
    650     {
    651     - struct nfs_read_data *rdata = data;
    652     -
    653     put_nfs_open_context(rdata->args.context);
    654     nfs_readdata_free(rdata);
    655     }
    656     diff --git a/fs/nfs/write.c b/fs/nfs/write.c
    657     index 3229e21..84f4e75 100644
    658     --- a/fs/nfs/write.c
    659     +++ b/fs/nfs/write.c
    660     @@ -84,17 +84,15 @@ struct nfs_write_data *nfs_writedata_alloc(unsigned int pagecount)
    661     return p;
    662     }
    663    
    664     -static void nfs_writedata_free(struct nfs_write_data *p)
    665     +void nfs_writedata_free(struct nfs_write_data *p)
    666     {
    667     if (p && (p->pagevec != &p->page_array[0]))
    668     kfree(p->pagevec);
    669     mempool_free(p, nfs_wdata_mempool);
    670     }
    671    
    672     -void nfs_writedata_release(void *data)
    673     +static void nfs_writedata_release(struct nfs_write_data *wdata)
    674     {
    675     - struct nfs_write_data *wdata = data;
    676     -
    677     put_nfs_open_context(wdata->args.context);
    678     nfs_writedata_free(wdata);
    679     }
    680     diff --git a/fs/proc/base.c b/fs/proc/base.c
    681     index a488f61..76f9ffc 100644
    682     --- a/fs/proc/base.c
    683     +++ b/fs/proc/base.c
    684     @@ -240,22 +240,19 @@ static int check_mem_permission(struct task_struct *task)
    685     struct mm_struct *mm_for_maps(struct task_struct *task)
    686     {
    687     struct mm_struct *mm = get_task_mm(task);
    688     - if (!mm)
    689     - return NULL;
    690     - down_read(&mm->mmap_sem);
    691     - task_lock(task);
    692     - if (task->mm != mm)
    693     - goto out;
    694     - if (task->mm != current->mm &&
    695     - __ptrace_may_access(task, PTRACE_MODE_READ) < 0)
    696     - goto out;
    697     - task_unlock(task);
    698     +
    699     + if (mm && mm != current->mm) {
    700     + /*
    701     + * task->mm can be changed before security check,
    702     + * in that case we must notice the change after.
    703     + */
    704     + if (!ptrace_may_access(task, PTRACE_MODE_READ) ||
    705     + mm != task->mm) {
    706     + mmput(mm);
    707     + mm = NULL;
    708     + }
    709     + }
    710     return mm;
    711     -out:
    712     - task_unlock(task);
    713     - up_read(&mm->mmap_sem);
    714     - mmput(mm);
    715     - return NULL;
    716     }
    717    
    718     static int proc_pid_cmdline(struct task_struct *task, char * buffer)
    719     diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
    720     index c7f64a9..d8be92a 100644
    721     --- a/fs/proc/task_mmu.c
    722     +++ b/fs/proc/task_mmu.c
    723     @@ -119,6 +119,7 @@ static void *m_start(struct seq_file *m, loff_t *pos)
    724     mm = mm_for_maps(priv->task);
    725     if (!mm)
    726     return NULL;
    727     + down_read(&mm->mmap_sem);
    728    
    729     tail_vma = get_gate_vma(priv->task);
    730     priv->tail_vma = tail_vma;
    731     diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c
    732     index 5d84e71..737d219 100644
    733     --- a/fs/proc/task_nommu.c
    734     +++ b/fs/proc/task_nommu.c
    735     @@ -137,6 +137,7 @@ static void *m_start(struct seq_file *m, loff_t *pos)
    736     priv->task = NULL;
    737     return NULL;
    738     }
    739     + down_read(&mm->mmap_sem);
    740    
    741     /* start from the Nth VMA */
    742     for (vml = mm->context.vmlist; vml; vml = vml->next)
    743     diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
    744     index aedaeba..6def64c 100644
    745     --- a/fs/sysfs/dir.c
    746     +++ b/fs/sysfs/dir.c
    747     @@ -914,8 +914,10 @@ again:
    748     /* Remove from old parent's list and insert into new parent's list. */
    749     sysfs_unlink_sibling(sd);
    750     sysfs_get(new_parent_sd);
    751     + drop_nlink(old_parent->d_inode);
    752     sysfs_put(sd->s_parent);
    753     sd->s_parent = new_parent_sd;
    754     + inc_nlink(new_parent->d_inode);
    755     sysfs_link_sibling(sd);
    756    
    757     out_unlock:
    758     diff --git a/include/asm-parisc/tlbflush.h b/include/asm-parisc/tlbflush.h
    759     index 1f6fd4f..9c5d646 100644
    760     --- a/include/asm-parisc/tlbflush.h
    761     +++ b/include/asm-parisc/tlbflush.h
    762     @@ -12,14 +12,12 @@
    763     * N class systems, only one PxTLB inter processor broadcast can be
    764     * active at any one time on the Merced bus. This tlb purge
    765     * synchronisation is fairly lightweight and harmless so we activate
    766     - * it on all SMP systems not just the N class. We also need to have
    767     - * preemption disabled on uniprocessor machines, and spin_lock does that
    768     - * nicely.
    769     + * it on all systems not just the N class.
    770     */
    771     extern spinlock_t pa_tlb_lock;
    772    
    773     -#define purge_tlb_start(x) spin_lock(&pa_tlb_lock)
    774     -#define purge_tlb_end(x) spin_unlock(&pa_tlb_lock)
    775     +#define purge_tlb_start(flags) spin_lock_irqsave(&pa_tlb_lock, flags)
    776     +#define purge_tlb_end(flags) spin_unlock_irqrestore(&pa_tlb_lock, flags)
    777    
    778     extern void flush_tlb_all(void);
    779     extern void flush_tlb_all_local(void *);
    780     @@ -63,14 +61,15 @@ static inline void flush_tlb_mm(struct mm_struct *mm)
    781     static inline void flush_tlb_page(struct vm_area_struct *vma,
    782     unsigned long addr)
    783     {
    784     + unsigned long flags;
    785     /* For one page, it's not worth testing the split_tlb variable */
    786    
    787     mb();
    788     mtsp(vma->vm_mm->context,1);
    789     - purge_tlb_start();
    790     + purge_tlb_start(flags);
    791     pdtlb(addr);
    792     pitlb(addr);
    793     - purge_tlb_end();
    794     + purge_tlb_end(flags);
    795     }
    796    
    797     void __flush_tlb_range(unsigned long sid,
    798     diff --git a/include/asm-x86/irqflags.h b/include/asm-x86/irqflags.h
    799     index 424acb4..f57f2fb 100644
    800     --- a/include/asm-x86/irqflags.h
    801     +++ b/include/asm-x86/irqflags.h
    802     @@ -12,9 +12,15 @@ static inline unsigned long native_save_fl(void)
    803     {
    804     unsigned long flags;
    805    
    806     + /*
    807     + * Note: this needs to be "=r" not "=rm", because we have the
    808     + * stack offset from what gcc expects at the time the "pop" is
    809     + * executed, and so a memory reference with respect to the stack
    810     + * would end up using the wrong address.
    811     + */
    812     asm volatile("# __raw_save_flags\n\t"
    813     "pushf ; pop %0"
    814     - : "=g" (flags)
    815     + : "=r" (flags)
    816     : /* no input */
    817     : "memory");
    818    
    819     diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
    820     index 78a5922..0dee17c 100644
    821     --- a/include/linux/nfs_fs.h
    822     +++ b/include/linux/nfs_fs.h
    823     @@ -461,7 +461,6 @@ extern int nfs_writepages(struct address_space *, struct writeback_control *);
    824     extern int nfs_flush_incompatible(struct file *file, struct page *page);
    825     extern int nfs_updatepage(struct file *, struct page *, unsigned int, unsigned int);
    826     extern int nfs_writeback_done(struct rpc_task *, struct nfs_write_data *);
    827     -extern void nfs_writedata_release(void *);
    828    
    829     /*
    830     * Try to write back everything synchronously (but check the
    831     @@ -476,7 +475,6 @@ extern int nfs_wb_page_cancel(struct inode *inode, struct page* page);
    832     extern int nfs_commit_inode(struct inode *, int);
    833     extern struct nfs_write_data *nfs_commitdata_alloc(void);
    834     extern void nfs_commit_free(struct nfs_write_data *wdata);
    835     -extern void nfs_commitdata_release(void *wdata);
    836     #else
    837     static inline int
    838     nfs_commit_inode(struct inode *inode, int how)
    839     @@ -495,6 +493,7 @@ nfs_have_writebacks(struct inode *inode)
    840     * Allocate nfs_write_data structures
    841     */
    842     extern struct nfs_write_data *nfs_writedata_alloc(unsigned int npages);
    843     +extern void nfs_writedata_free(struct nfs_write_data *);
    844    
    845     /*
    846     * linux/fs/nfs/read.c
    847     @@ -503,12 +502,12 @@ extern int nfs_readpage(struct file *, struct page *);
    848     extern int nfs_readpages(struct file *, struct address_space *,
    849     struct list_head *, unsigned);
    850     extern int nfs_readpage_result(struct rpc_task *, struct nfs_read_data *);
    851     -extern void nfs_readdata_release(void *data);
    852    
    853     /*
    854     * Allocate nfs_read_data structures
    855     */
    856     extern struct nfs_read_data *nfs_readdata_alloc(unsigned int npages);
    857     +extern void nfs_readdata_free(struct nfs_read_data *);
    858    
    859     /*
    860     * linux/fs/nfs3proc.c
    861     diff --git a/kernel/fork.c b/kernel/fork.c
    862     index 843ce75..fcbd28c 100644
    863     --- a/kernel/fork.c
    864     +++ b/kernel/fork.c
    865     @@ -536,18 +536,18 @@ void mm_release(struct task_struct *tsk, struct mm_struct *mm)
    866     * the value intact in a core dump, and to save the unnecessary
    867     * trouble otherwise. Userland only wants this done for a sys_exit.
    868     */
    869     - if (tsk->clear_child_tid
    870     - && !(tsk->flags & PF_SIGNALED)
    871     - && atomic_read(&mm->mm_users) > 1) {
    872     - u32 __user * tidptr = tsk->clear_child_tid;
    873     + if (tsk->clear_child_tid) {
    874     + if (!(tsk->flags & PF_SIGNALED) &&
    875     + atomic_read(&mm->mm_users) > 1) {
    876     + /*
    877     + * We don't check the error code - if userspace has
    878     + * not set up a proper pointer then tough luck.
    879     + */
    880     + put_user(0, tsk->clear_child_tid);
    881     + sys_futex(tsk->clear_child_tid, FUTEX_WAKE,
    882     + 1, NULL, NULL, 0);
    883     + }
    884     tsk->clear_child_tid = NULL;
    885     -
    886     - /*
    887     - * We don't check the error code - if userspace has
    888     - * not set up a proper pointer then tough luck.
    889     - */
    890     - put_user(0, tidptr);
    891     - sys_futex(tidptr, FUTEX_WAKE, 1, NULL, NULL, 0);
    892     }
    893     }
    894    
    895     diff --git a/mm/hugetlb.c b/mm/hugetlb.c
    896     index 1ecbcf6..2885674 100644
    897     --- a/mm/hugetlb.c
    898     +++ b/mm/hugetlb.c
    899     @@ -2257,7 +2257,7 @@ void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed)
    900     long chg = region_truncate(&inode->i_mapping->private_list, offset);
    901    
    902     spin_lock(&inode->i_lock);
    903     - inode->i_blocks -= blocks_per_huge_page(h);
    904     + inode->i_blocks -= (blocks_per_huge_page(h) * freed);
    905     spin_unlock(&inode->i_lock);
    906    
    907     hugetlb_put_quota(inode->i_mapping, (chg - freed));
    908     diff --git a/mm/page_alloc.c b/mm/page_alloc.c
    909     index 85799e8..c6ecf87 100644
    910     --- a/mm/page_alloc.c
    911     +++ b/mm/page_alloc.c
    912     @@ -846,7 +846,7 @@ static struct page *__rmqueue(struct zone *zone, unsigned int order,
    913     */
    914     static int rmqueue_bulk(struct zone *zone, unsigned int order,
    915     unsigned long count, struct list_head *list,
    916     - int migratetype)
    917     + int migratetype, int cold)
    918     {
    919     int i;
    920    
    921     @@ -865,7 +865,10 @@ static int rmqueue_bulk(struct zone *zone, unsigned int order,
    922     * merge IO requests if the physical pages are ordered
    923     * properly.
    924     */
    925     - list_add(&page->lru, list);
    926     + if (likely(cold == 0))
    927     + list_add(&page->lru, list);
    928     + else
    929     + list_add_tail(&page->lru, list);
    930     set_page_private(page, migratetype);
    931     list = &page->lru;
    932     }
    933     @@ -1068,7 +1071,8 @@ again:
    934     local_irq_save(flags);
    935     if (!pcp->count) {
    936     pcp->count = rmqueue_bulk(zone, 0,
    937     - pcp->batch, &pcp->list, migratetype);
    938     + pcp->batch, &pcp->list,
    939     + migratetype, cold);
    940     if (unlikely(!pcp->count))
    941     goto failed;
    942     }
    943     @@ -1087,7 +1091,8 @@ again:
    944     /* Allocate more to the pcp list if necessary */
    945     if (unlikely(&page->lru == &pcp->list)) {
    946     pcp->count += rmqueue_bulk(zone, 0,
    947     - pcp->batch, &pcp->list, migratetype);
    948     + pcp->batch, &pcp->list,
    949     + migratetype, cold);
    950     page = list_entry(pcp->list.next, struct page, lru);
    951     }
    952    
    953     diff --git a/net/socket.c b/net/socket.c
    954     index 3e2859c..058d965 100644
    955     --- a/net/socket.c
    956     +++ b/net/socket.c
    957     @@ -695,7 +695,7 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
    958     if (more)
    959     flags |= MSG_MORE;
    960    
    961     - return sock->ops->sendpage(sock, page, offset, size, flags);
    962     + return kernel_sendpage(sock, page, offset, size, flags);
    963     }
    964    
    965     static ssize_t sock_splice_read(struct file *file, loff_t *ppos,