Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-magellan/patches-2.6.25-r5/0102-2.6.25.3-all-fixes.patch

    Annotation of /trunk/kernel26-magellan/patches-2.6.25-r5/0102-2.6.25.3-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 677 - (hide annotations) (download)
    Wed Sep 10 21:27:27 2008 UTC (15 years, 8 months ago) by niro
    File size: 19183 byte(s) 
    2.6.25-magellan-r5:
- updated to linux-2.6.25.17
    1 niro 677 diff --git a/arch/arm/kernel/kprobes-decode.c b/arch/arm/kernel/kprobes-decode.c
    2     index d51bc8b..b4565bb 100644
    3     --- a/arch/arm/kernel/kprobes-decode.c
    4     +++ b/arch/arm/kernel/kprobes-decode.c
    5     @@ -1176,7 +1176,7 @@ space_cccc_001x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
    6     * *S (bit 20) updates condition codes
    7     * ADC/SBC/RSC reads the C flag
    8     */
    9     - insn &= 0xfff00ff0; /* Rn = r0, Rd = r0 */
    10     + insn &= 0xfff00fff; /* Rn = r0, Rd = r0 */
    11     asi->insn[0] = insn;
    12     asi->insn_handler = (insn & (1 << 20)) ? /* S-bit */
    13     emulate_alu_imm_rwflags : emulate_alu_imm_rflags;
    14     diff --git a/arch/arm/kernel/kprobes.c b/arch/arm/kernel/kprobes.c
    15     index 13e371a..5593dd2 100644
    16     --- a/arch/arm/kernel/kprobes.c
    17     +++ b/arch/arm/kernel/kprobes.c
    18     @@ -66,7 +66,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
    19     return -ENOMEM;
    20     for (is = 0; is < MAX_INSN_SIZE; ++is)
    21     p->ainsn.insn[is] = tmp_insn[is];
    22     - flush_insns(&p->ainsn.insn, MAX_INSN_SIZE);
    23     + flush_insns(p->ainsn.insn, MAX_INSN_SIZE);
    24     break;
    25    
    26     case INSN_GOOD_NO_SLOT: /* instruction doesn't need insn slot */
    27     diff --git a/arch/sparc/kernel/sys_sparc.c b/arch/sparc/kernel/sys_sparc.c
    28     index 42bf09d..9f8c8e1 100644
    29     --- a/arch/sparc/kernel/sys_sparc.c
    30     +++ b/arch/sparc/kernel/sys_sparc.c
    31     @@ -224,8 +224,7 @@ int sparc_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
    32     {
    33     if (ARCH_SUN4C_SUN4 &&
    34     (len > 0x20000000 ||
    35     - ((flags & MAP_FIXED) &&
    36     - addr < 0xe0000000 && addr + len > 0x20000000)))
    37     + (addr < 0xe0000000 && addr + len > 0x20000000)))
    38     return -EINVAL;
    39    
    40     /* See asm-sparc/uaccess.h */
    41     diff --git a/arch/sparc64/kernel/sys_sparc.c b/arch/sparc64/kernel/sys_sparc.c
    42     index f952745..cc37936 100644
    43     --- a/arch/sparc64/kernel/sys_sparc.c
    44     +++ b/arch/sparc64/kernel/sys_sparc.c
    45     @@ -549,13 +549,13 @@ int sparc64_mmap_check(unsigned long addr, unsigned long len,
    46     if (len >= STACK_TOP32)
    47     return -EINVAL;
    48    
    49     - if ((flags & MAP_FIXED) && addr > STACK_TOP32 - len)
    50     + if (addr > STACK_TOP32 - len)
    51     return -EINVAL;
    52     } else {
    53     if (len >= VA_EXCLUDE_START)
    54     return -EINVAL;
    55    
    56     - if ((flags & MAP_FIXED) && invalid_64bit_range(addr, len))
    57     + if (invalid_64bit_range(addr, len))
    58     return -EINVAL;
    59     }
    60    
    61     diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
    62     index 7b6e3bb..05356ce 100644
    63     --- a/arch/x86/pci/common.c
    64     +++ b/arch/x86/pci/common.c
    65     @@ -372,13 +372,16 @@ static struct dmi_system_id __devinitdata pciprobe_dmi_table[] = {
    66     {}
    67     };
    68    
    69     +void __init dmi_check_pciprobe(void)
    70     +{
    71     + dmi_check_system(pciprobe_dmi_table);
    72     +}
    73     +
    74     struct pci_bus * __devinit pcibios_scan_root(int busnum)
    75     {
    76     struct pci_bus *bus = NULL;
    77     struct pci_sysdata *sd;
    78    
    79     - dmi_check_system(pciprobe_dmi_table);
    80     -
    81     while ((bus = pci_find_next_bus(bus)) != NULL) {
    82     if (bus->number == busnum) {
    83     /* Already scanned */
    84     diff --git a/arch/x86/pci/init.c b/arch/x86/pci/init.c
    85     index 3de9f9b..f1bf4e5 100644
    86     --- a/arch/x86/pci/init.c
    87     +++ b/arch/x86/pci/init.c
    88     @@ -32,6 +32,8 @@ static __init int pci_access_init(void)
    89     printk(KERN_ERR
    90     "PCI: Fatal: No config space access function found\n");
    91    
    92     + dmi_check_pciprobe();
    93     +
    94     return 0;
    95     }
    96     arch_initcall(pci_access_init);
    97     diff --git a/arch/x86/pci/pci.h b/arch/x86/pci/pci.h
    98     index 3431518..95e5675 100644
    99     --- a/arch/x86/pci/pci.h
    100     +++ b/arch/x86/pci/pci.h
    101     @@ -39,6 +39,8 @@ enum pci_bf_sort_state {
    102     pci_dmi_bf,
    103     };
    104    
    105     +extern void __init dmi_check_pciprobe(void);
    106     +
    107     /* pci-i386.c */
    108    
    109     extern unsigned int pcibios_max_latency;
    110     diff --git a/crypto/authenc.c b/crypto/authenc.c
    111     index ed8ac5a..4b22676 100644
    112     --- a/crypto/authenc.c
    113     +++ b/crypto/authenc.c
    114     @@ -217,9 +217,10 @@ static void crypto_authenc_givencrypt_done(struct crypto_async_request *req,
    115     int err)
    116     {
    117     if (!err) {
    118     - struct aead_givcrypt_request *greq = req->data;
    119     + struct aead_request *areq = req->data;
    120     + struct skcipher_givcrypt_request *greq = aead_request_ctx(areq);
    121    
    122     - err = crypto_authenc_genicv(&greq->areq, greq->giv, 0);
    123     + err = crypto_authenc_genicv(areq, greq->giv, 0);
    124     }
    125    
    126     aead_request_complete(req->data, err);
    127     diff --git a/crypto/cryptd.c b/crypto/cryptd.c
    128     index 2504252..b150de5 100644
    129     --- a/crypto/cryptd.c
    130     +++ b/crypto/cryptd.c
    131     @@ -190,8 +190,10 @@ static struct crypto_instance *cryptd_alloc_instance(struct crypto_alg *alg,
    132     int err;
    133    
    134     inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
    135     - if (IS_ERR(inst))
    136     + if (!inst) {
    137     + inst = ERR_PTR(-ENOMEM);
    138     goto out;
    139     + }
    140    
    141     err = -ENAMETOOLONG;
    142     if (snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME,
    143     diff --git a/crypto/eseqiv.c b/crypto/eseqiv.c
    144     index b14f14e..881d309 100644
    145     --- a/crypto/eseqiv.c
    146     +++ b/crypto/eseqiv.c
    147     @@ -136,7 +136,8 @@ static int eseqiv_givencrypt(struct skcipher_givcrypt_request *req)
    148     }
    149    
    150     ablkcipher_request_set_crypt(subreq, reqctx->src, dst,
    151     - req->creq.nbytes, req->creq.info);
    152     + req->creq.nbytes + ivsize,
    153     + req->creq.info);
    154    
    155     memcpy(req->creq.info, ctx->salt, ivsize);
    156    
    157     diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
    158     index 788da97..836362b 100644
    159     --- a/drivers/acpi/processor_idle.c
    160     +++ b/drivers/acpi/processor_idle.c
    161     @@ -848,6 +848,7 @@ static int acpi_processor_get_power_info_default(struct acpi_processor *pr)
    162     /* all processors need to support C1 */
    163     pr->power.states[ACPI_STATE_C1].type = ACPI_STATE_C1;
    164     pr->power.states[ACPI_STATE_C1].valid = 1;
    165     + pr->power.states[ACPI_STATE_C1].entry_method = ACPI_CSTATE_HALT;
    166     }
    167     /* the C0 state only exists as a filler in our array */
    168     pr->power.states[ACPI_STATE_C0].valid = 1;
    169     @@ -960,6 +961,9 @@ static int acpi_processor_get_power_info_cst(struct acpi_processor *pr)
    170     cx.address);
    171     }
    172    
    173     + if (cx.type == ACPI_STATE_C1) {
    174     + cx.valid = 1;
    175     + }
    176    
    177     obj = &(element->package.elements[2]);
    178     if (obj->type != ACPI_TYPE_INTEGER)
    179     diff --git a/drivers/md/md.c b/drivers/md/md.c
    180     index 61ccbd2..9f6d228 100644
    181     --- a/drivers/md/md.c
    182     +++ b/drivers/md/md.c
    183     @@ -2096,7 +2096,7 @@ rdev_attr_store(struct kobject *kobj, struct attribute *attr,
    184     rv = -EBUSY;
    185     else
    186     rv = entry->store(rdev, page, length);
    187     - mddev_unlock(rdev->mddev);
    188     + mddev_unlock(mddev);
    189     }
    190     return rv;
    191     }
    192     diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
    193     index f13346b..44ebdea 100644
    194     --- a/drivers/net/wireless/b43/b43.h
    195     +++ b/drivers/net/wireless/b43/b43.h
    196     @@ -628,6 +628,10 @@ struct b43_wl {
    197    
    198     struct mutex mutex;
    199     spinlock_t irq_lock;
    200     + /* R/W lock for data transmission.
    201     + * Transmissions on 2+ queues can run concurrently, but somebody else
    202     + * might sync with TX by write_lock_irqsave()'ing. */
    203     + rwlock_t tx_lock;
    204     /* Lock for LEDs access. */
    205     spinlock_t leds_lock;
    206     /* Lock for SHM access. */
    207     diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
    208     index f23317e..e0055d0 100644
    209     --- a/drivers/net/wireless/b43/main.c
    210     +++ b/drivers/net/wireless/b43/main.c
    211     @@ -622,6 +622,7 @@ static void b43_synchronize_irq(struct b43_wldev *dev)
    212     */
    213     void b43_dummy_transmission(struct b43_wldev *dev)
    214     {
    215     + struct b43_wl *wl = dev->wl;
    216     struct b43_phy *phy = &dev->phy;
    217     unsigned int i, max_loop;
    218     u16 value;
    219     @@ -648,6 +649,9 @@ void b43_dummy_transmission(struct b43_wldev *dev)
    220     return;
    221     }
    222    
    223     + spin_lock_irq(&wl->irq_lock);
    224     + write_lock(&wl->tx_lock);
    225     +
    226     for (i = 0; i < 5; i++)
    227     b43_ram_write(dev, i * 4, buffer[i]);
    228    
    229     @@ -688,6 +692,9 @@ void b43_dummy_transmission(struct b43_wldev *dev)
    230     }
    231     if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
    232     b43_radio_write16(dev, 0x0051, 0x0037);
    233     +
    234     + write_unlock(&wl->tx_lock);
    235     + spin_unlock_irq(&wl->irq_lock);
    236     }
    237    
    238     static void key_write(struct b43_wldev *dev,
    239     @@ -2592,15 +2599,21 @@ static int b43_op_tx(struct ieee80211_hw *hw,
    240     {
    241     struct b43_wl *wl = hw_to_b43_wl(hw);
    242     struct b43_wldev *dev = wl->current_dev;
    243     - int err = -ENODEV;
    244     + unsigned long flags;
    245     + int err;
    246    
    247     if (unlikely(!dev))
    248     - goto out;
    249     - if (unlikely(b43_status(dev) < B43_STAT_STARTED))
    250     - goto out;
    251     - /* DMA-TX is done without a global lock. */
    252     - err = b43_dma_tx(dev, skb, ctl);
    253     -out:
    254     + return NETDEV_TX_BUSY;
    255     +
    256     + /* Transmissions on seperate queues can run concurrently. */
    257     + read_lock_irqsave(&wl->tx_lock, flags);
    258     +
    259     + err = -ENODEV;
    260     + if (likely(b43_status(dev) >= B43_STAT_STARTED))
    261     + err = b43_dma_tx(dev, skb, ctl);
    262     +
    263     + read_unlock_irqrestore(&wl->tx_lock, flags);
    264     +
    265     if (unlikely(err))
    266     return NETDEV_TX_BUSY;
    267     return NETDEV_TX_OK;
    268     @@ -3109,7 +3122,9 @@ static void b43_wireless_core_stop(struct b43_wldev *dev)
    269     spin_unlock_irqrestore(&wl->irq_lock, flags);
    270     b43_synchronize_irq(dev);
    271    
    272     + write_lock_irqsave(&wl->tx_lock, flags);
    273     b43_set_status(dev, B43_STAT_INITIALIZED);
    274     + write_unlock_irqrestore(&wl->tx_lock, flags);
    275    
    276     mutex_unlock(&wl->mutex);
    277     /* Must unlock as it would otherwise deadlock. No races here.
    278     @@ -3117,8 +3132,6 @@ static void b43_wireless_core_stop(struct b43_wldev *dev)
    279     cancel_delayed_work_sync(&dev->periodic_work);
    280     mutex_lock(&wl->mutex);
    281    
    282     - ieee80211_stop_queues(wl->hw); //FIXME this could cause a deadlock, as mac80211 seems buggy.
    283     -
    284     b43_mac_suspend(dev);
    285     free_irq(dev->dev->irq, dev);
    286     b43dbg(wl, "Wireless interface stopped\n");
    287     @@ -3912,6 +3925,14 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
    288     err = -EOPNOTSUPP;
    289     goto err_powerdown;
    290     }
    291     + if (1 /* disable A-PHY */) {
    292     + /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
    293     + if (dev->phy.type != B43_PHYTYPE_N) {
    294     + have_2ghz_phy = 1;
    295     + have_5ghz_phy = 0;
    296     + }
    297     + }
    298     +
    299     dev->phy.gmode = have_2ghz_phy;
    300     tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
    301     b43_wireless_core_reset(dev, tmp);
    302     @@ -4076,6 +4097,7 @@ static int b43_wireless_init(struct ssb_device *dev)
    303     memset(wl, 0, sizeof(*wl));
    304     wl->hw = hw;
    305     spin_lock_init(&wl->irq_lock);
    306     + rwlock_init(&wl->tx_lock);
    307     spin_lock_init(&wl->leds_lock);
    308     spin_lock_init(&wl->shm_lock);
    309     mutex_init(&wl->mutex);
    310     diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
    311     index d93b357..7a3625f 100644
    312     --- a/drivers/serial/mpc52xx_uart.c
    313     +++ b/drivers/serial/mpc52xx_uart.c
    314     @@ -1221,8 +1221,8 @@ static struct of_device_id mpc52xx_uart_of_match[] = {
    315     #endif
    316     #ifdef CONFIG_PPC_MPC512x
    317     { .compatible = "fsl,mpc5121-psc-uart", .data = &mpc512x_psc_ops, },
    318     - {},
    319     #endif
    320     + {},
    321     };
    322    
    323     static int __devinit
    324     diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
    325     index e0f0f09..9f877ab 100644
    326     --- a/fs/reiserfs/ioctl.c
    327     +++ b/fs/reiserfs/ioctl.c
    328     @@ -11,8 +11,6 @@
    329     #include <linux/smp_lock.h>
    330     #include <linux/compat.h>
    331    
    332     -static int reiserfs_unpack(struct inode *inode, struct file *filp);
    333     -
    334     /*
    335     ** reiserfs_ioctl - handler for ioctl for inode
    336     ** supported commands:
    337     @@ -140,7 +138,7 @@ int reiserfs_prepare_write(struct file *f, struct page *page,
    338     ** Function try to convert tail from direct item into indirect.
    339     ** It set up nopack attribute in the REISERFS_I(inode)->nopack
    340     */
    341     -static int reiserfs_unpack(struct inode *inode, struct file *filp)
    342     +int reiserfs_unpack(struct inode *inode, struct file *filp)
    343     {
    344     int retval = 0;
    345     int index;
    346     diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
    347     index 393cc22..3302259 100644
    348     --- a/fs/reiserfs/super.c
    349     +++ b/fs/reiserfs/super.c
    350     @@ -2019,6 +2019,7 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
    351     {
    352     int err;
    353     struct nameidata nd;
    354     + struct inode *inode;
    355    
    356     if (!(REISERFS_SB(sb)->s_mount_opt & (1 << REISERFS_QUOTA)))
    357     return -EINVAL;
    358     @@ -2030,12 +2031,18 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
    359     path_put(&nd.path);
    360     return -EXDEV;
    361     }
    362     + inode = nd.path.dentry->d_inode;
    363     /* We must not pack tails for quota files on reiserfs for quota IO to work */
    364     - if (!(REISERFS_I(nd.path.dentry->d_inode)->i_flags & i_nopack_mask)) {
    365     - reiserfs_warning(sb,
    366     - "reiserfs: Quota file must have tail packing disabled.");
    367     - path_put(&nd.path);
    368     - return -EINVAL;
    369     + if (!(REISERFS_I(inode)->i_flags & i_nopack_mask)) {
    370     + err = reiserfs_unpack(inode, NULL);
    371     + if (err) {
    372     + reiserfs_warning(sb,
    373     + "reiserfs: Unpacking tail of quota file failed"
    374     + " (%d). Cannot turn on quotas.", err);
    375     + path_put(&nd.path);
    376     + return -EINVAL;
    377     + }
    378     + mark_inode_dirty(inode);
    379     }
    380     /* Not journalling quota? No more tests needed... */
    381     if (!REISERFS_SB(sb)->s_qf_names[USRQUOTA] &&
    382     diff --git a/fs/utimes.c b/fs/utimes.c
    383     index b18da9c..80a481e 100644
    384     --- a/fs/utimes.c
    385     +++ b/fs/utimes.c
    386     @@ -39,9 +39,14 @@ asmlinkage long sys_utime(char __user *filename, struct utimbuf __user *times)
    387    
    388     #endif
    389    
    390     +static bool nsec_special(long nsec)
    391     +{
    392     + return nsec == UTIME_OMIT || nsec == UTIME_NOW;
    393     +}
    394     +
    395     static bool nsec_valid(long nsec)
    396     {
    397     - if (nsec == UTIME_OMIT || nsec == UTIME_NOW)
    398     + if (nsec_special(nsec))
    399     return true;
    400    
    401     return nsec >= 0 && nsec <= 999999999;
    402     @@ -115,7 +120,15 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
    403     newattrs.ia_mtime.tv_nsec = times[1].tv_nsec;
    404     newattrs.ia_valid |= ATTR_MTIME_SET;
    405     }
    406     - } else {
    407     + }
    408     +
    409     + /*
    410     + * If times is NULL or both times are either UTIME_OMIT or
    411     + * UTIME_NOW, then need to check permissions, because
    412     + * inode_change_ok() won't do it.
    413     + */
    414     + if (!times || (nsec_special(times[0].tv_nsec) &&
    415     + nsec_special(times[1].tv_nsec))) {
    416     error = -EACCES;
    417     if (IS_IMMUTABLE(inode))
    418     goto dput_and_out;
    419     diff --git a/include/crypto/scatterwalk.h b/include/crypto/scatterwalk.h
    420     index 224658b..833d208 100644
    421     --- a/include/crypto/scatterwalk.h
    422     +++ b/include/crypto/scatterwalk.h
    423     @@ -57,10 +57,14 @@ static inline void scatterwalk_sg_chain(struct scatterlist *sg1, int num,
    424     struct scatterlist *sg2)
    425     {
    426     sg_set_page(&sg1[num - 1], (void *)sg2, 0, 0);
    427     + sg1[num - 1].page_link &= ~0x02;
    428     }
    429    
    430     static inline struct scatterlist *scatterwalk_sg_next(struct scatterlist *sg)
    431     {
    432     + if (sg_is_last(sg))
    433     + return NULL;
    434     +
    435     return (++sg)->length ? sg : (void *)sg_page(sg);
    436     }
    437    
    438     diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
    439     index 8e7eff2..4aacaee 100644
    440     --- a/include/linux/reiserfs_fs.h
    441     +++ b/include/linux/reiserfs_fs.h
    442     @@ -2176,6 +2176,7 @@ int reiserfs_ioctl(struct inode *inode, struct file *filp,
    443     unsigned int cmd, unsigned long arg);
    444     long reiserfs_compat_ioctl(struct file *filp,
    445     unsigned int cmd, unsigned long arg);
    446     +int reiserfs_unpack(struct inode *inode, struct file *filp);
    447    
    448     /* ioctl's command */
    449     #define REISERFS_IOC_UNPACK _IOW(0xCD,1,long)
    450     diff --git a/kernel/sched.c b/kernel/sched.c
    451     index 8dcdec6..1e4596c 100644
    452     --- a/kernel/sched.c
    453     +++ b/kernel/sched.c
    454     @@ -876,6 +876,7 @@ static inline void resched_rq(struct rq *rq)
    455     enum {
    456     HRTICK_SET, /* re-programm hrtick_timer */
    457     HRTICK_RESET, /* not a new slice */
    458     + HRTICK_BLOCK, /* stop hrtick operations */
    459     };
    460    
    461     /*
    462     @@ -887,6 +888,8 @@ static inline int hrtick_enabled(struct rq *rq)
    463     {
    464     if (!sched_feat(HRTICK))
    465     return 0;
    466     + if (unlikely(test_bit(HRTICK_BLOCK, &rq->hrtick_flags)))
    467     + return 0;
    468     return hrtimer_is_hres_active(&rq->hrtick_timer);
    469     }
    470    
    471     @@ -969,7 +972,63 @@ static enum hrtimer_restart hrtick(struct hrtimer *timer)
    472     return HRTIMER_NORESTART;
    473     }
    474    
    475     -static inline void init_rq_hrtick(struct rq *rq)
    476     +static void hotplug_hrtick_disable(int cpu)
    477     +{
    478     + struct rq *rq = cpu_rq(cpu);
    479     + unsigned long flags;
    480     +
    481     + spin_lock_irqsave(&rq->lock, flags);
    482     + rq->hrtick_flags = 0;
    483     + __set_bit(HRTICK_BLOCK, &rq->hrtick_flags);
    484     + spin_unlock_irqrestore(&rq->lock, flags);
    485     +
    486     + hrtick_clear(rq);
    487     +}
    488     +
    489     +static void hotplug_hrtick_enable(int cpu)
    490     +{
    491     + struct rq *rq = cpu_rq(cpu);
    492     + unsigned long flags;
    493     +
    494     + spin_lock_irqsave(&rq->lock, flags);
    495     + __clear_bit(HRTICK_BLOCK, &rq->hrtick_flags);
    496     + spin_unlock_irqrestore(&rq->lock, flags);
    497     +}
    498     +
    499     +static int
    500     +hotplug_hrtick(struct notifier_block *nfb, unsigned long action, void *hcpu)
    501     +{
    502     + int cpu = (int)(long)hcpu;
    503     +
    504     + switch (action) {
    505     + case CPU_UP_CANCELED:
    506     + case CPU_UP_CANCELED_FROZEN:
    507     + case CPU_DOWN_PREPARE:
    508     + case CPU_DOWN_PREPARE_FROZEN:
    509     + case CPU_DEAD:
    510     + case CPU_DEAD_FROZEN:
    511     + hotplug_hrtick_disable(cpu);
    512     + return NOTIFY_OK;
    513     +
    514     + case CPU_UP_PREPARE:
    515     + case CPU_UP_PREPARE_FROZEN:
    516     + case CPU_DOWN_FAILED:
    517     + case CPU_DOWN_FAILED_FROZEN:
    518     + case CPU_ONLINE:
    519     + case CPU_ONLINE_FROZEN:
    520     + hotplug_hrtick_enable(cpu);
    521     + return NOTIFY_OK;
    522     + }
    523     +
    524     + return NOTIFY_DONE;
    525     +}
    526     +
    527     +static void init_hrtick(void)
    528     +{
    529     + hotcpu_notifier(hotplug_hrtick, 0);
    530     +}
    531     +
    532     +static void init_rq_hrtick(struct rq *rq)
    533     {
    534     rq->hrtick_flags = 0;
    535     hrtimer_init(&rq->hrtick_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
    536     @@ -1006,6 +1065,10 @@ static inline void init_rq_hrtick(struct rq *rq)
    537     void hrtick_resched(void)
    538     {
    539     }
    540     +
    541     +static inline void init_hrtick(void)
    542     +{
    543     +}
    544     #endif
    545    
    546     /*
    547     @@ -7094,6 +7157,7 @@ void __init sched_init_smp(void)
    548     put_online_cpus();
    549     /* XXX: Theoretical race here - CPU may be hotplugged now */
    550     hotcpu_notifier(update_sched_domains, 0);
    551     + init_hrtick();
    552    
    553     /* Move init over to a non-isolated CPU */
    554     if (set_cpus_allowed(current, non_isolated_cpus) < 0)
    555     diff --git a/mm/page_alloc.c b/mm/page_alloc.c
    556     index 402a504..55443c2 100644
    557     --- a/mm/page_alloc.c
    558     +++ b/mm/page_alloc.c
    559     @@ -2518,7 +2518,9 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
    560     struct page *page;
    561     unsigned long end_pfn = start_pfn + size;
    562     unsigned long pfn;
    563     + struct zone *z;
    564    
    565     + z = &NODE_DATA(nid)->node_zones[zone];
    566     for (pfn = start_pfn; pfn < end_pfn; pfn++) {
    567     /*
    568     * There can be holes in boot-time mem_map[]s
    569     @@ -2536,7 +2538,6 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
    570     init_page_count(page);
    571     reset_page_mapcount(page);
    572     SetPageReserved(page);
    573     -
    574     /*
    575     * Mark the block movable so that blocks are reserved for
    576     * movable at startup. This will force kernel allocations
    577     @@ -2545,8 +2546,15 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
    578     * kernel allocations are made. Later some blocks near
    579     * the start are marked MIGRATE_RESERVE by
    580     * setup_zone_migrate_reserve()
    581     + *
    582     + * bitmap is created for zone's valid pfn range. but memmap
    583     + * can be created for invalid pages (for alignment)
    584     + * check here not to call set_pageblock_migratetype() against
    585     + * pfn out of zone.
    586     */
    587     - if ((pfn & (pageblock_nr_pages-1)))
    588     + if ((z->zone_start_pfn <= pfn)
    589     + && (pfn < z->zone_start_pfn + z->spanned_pages)
    590     + && !(pfn & (pageblock_nr_pages - 1)))
    591     set_pageblock_migratetype(page, MIGRATE_MOVABLE);
    592    
    593     INIT_LIST_HEAD(&page->lru);
    594     @@ -4460,6 +4468,8 @@ void set_pageblock_flags_group(struct page *page, unsigned long flags,
    595     pfn = page_to_pfn(page);
    596     bitmap = get_pageblock_bitmap(zone, pfn);
    597     bitidx = pfn_to_bitidx(zone, pfn);
    598     + VM_BUG_ON(pfn < zone->zone_start_pfn);
    599     + VM_BUG_ON(pfn >= zone->zone_start_pfn + zone->spanned_pages);
    600    
    601     for (; start_bitidx <= end_bitidx; start_bitidx++, value <<= 1)
    602     if (flags & value)
    603     diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
    604     index 1656c00..4de86c4 100644
    605     --- a/net/ipv6/sit.c
    606     +++ b/net/ipv6/sit.c
    607     @@ -446,9 +446,9 @@ static int ipip6_rcv(struct sk_buff *skb)
    608     }
    609    
    610     icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
    611     - kfree_skb(skb);
    612     read_unlock(&ipip6_lock);
    613     out:
    614     + kfree_skb(skb);
    615     return 0;
    616     }
    617