Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-xen/patches-2.6.25-r1/0102-2.6.25.3-all-fixes.patch

    Contents of /trunk/kernel26-xen/patches-2.6.25-r1/0102-2.6.25.3-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 606 - (show annotations) (download)
    Thu May 22 23:13:13 2008 UTC (15 years, 11 months ago) by niro
    File size: 19183 byte(s) 
    -ver bump to 2.6.25-magellan-r1:
- linux-2.6.25.4
- fbcondecor-0.9.4
- squashfs-3.3
- unionfs-2.3.3
- tuxonice-3.0-rc7
- linux-phc-0.3.0
- acpi-dstd-0.9a
- reiser4
- xen-3.2.0
. ipw3945-1.2.2
    1 diff --git a/arch/arm/kernel/kprobes-decode.c b/arch/arm/kernel/kprobes-decode.c
    2 index d51bc8b..b4565bb 100644
    3 --- a/arch/arm/kernel/kprobes-decode.c
    4 +++ b/arch/arm/kernel/kprobes-decode.c
    5 @@ -1176,7 +1176,7 @@ space_cccc_001x(kprobe_opcode_t insn, struct arch_specific_insn *asi)
    6 * *S (bit 20) updates condition codes
    7 * ADC/SBC/RSC reads the C flag
    8 */
    9 - insn &= 0xfff00ff0; /* Rn = r0, Rd = r0 */
    10 + insn &= 0xfff00fff; /* Rn = r0, Rd = r0 */
    11 asi->insn[0] = insn;
    12 asi->insn_handler = (insn & (1 << 20)) ? /* S-bit */
    13 emulate_alu_imm_rwflags : emulate_alu_imm_rflags;
    14 diff --git a/arch/arm/kernel/kprobes.c b/arch/arm/kernel/kprobes.c
    15 index 13e371a..5593dd2 100644
    16 --- a/arch/arm/kernel/kprobes.c
    17 +++ b/arch/arm/kernel/kprobes.c
    18 @@ -66,7 +66,7 @@ int __kprobes arch_prepare_kprobe(struct kprobe *p)
    19 return -ENOMEM;
    20 for (is = 0; is < MAX_INSN_SIZE; ++is)
    21 p->ainsn.insn[is] = tmp_insn[is];
    22 - flush_insns(&p->ainsn.insn, MAX_INSN_SIZE);
    23 + flush_insns(p->ainsn.insn, MAX_INSN_SIZE);
    24 break;
    25
    26 case INSN_GOOD_NO_SLOT: /* instruction doesn't need insn slot */
    27 diff --git a/arch/sparc/kernel/sys_sparc.c b/arch/sparc/kernel/sys_sparc.c
    28 index 42bf09d..9f8c8e1 100644
    29 --- a/arch/sparc/kernel/sys_sparc.c
    30 +++ b/arch/sparc/kernel/sys_sparc.c
    31 @@ -224,8 +224,7 @@ int sparc_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
    32 {
    33 if (ARCH_SUN4C_SUN4 &&
    34 (len > 0x20000000 ||
    35 - ((flags & MAP_FIXED) &&
    36 - addr < 0xe0000000 && addr + len > 0x20000000)))
    37 + (addr < 0xe0000000 && addr + len > 0x20000000)))
    38 return -EINVAL;
    39
    40 /* See asm-sparc/uaccess.h */
    41 diff --git a/arch/sparc64/kernel/sys_sparc.c b/arch/sparc64/kernel/sys_sparc.c
    42 index f952745..cc37936 100644
    43 --- a/arch/sparc64/kernel/sys_sparc.c
    44 +++ b/arch/sparc64/kernel/sys_sparc.c
    45 @@ -549,13 +549,13 @@ int sparc64_mmap_check(unsigned long addr, unsigned long len,
    46 if (len >= STACK_TOP32)
    47 return -EINVAL;
    48
    49 - if ((flags & MAP_FIXED) && addr > STACK_TOP32 - len)
    50 + if (addr > STACK_TOP32 - len)
    51 return -EINVAL;
    52 } else {
    53 if (len >= VA_EXCLUDE_START)
    54 return -EINVAL;
    55
    56 - if ((flags & MAP_FIXED) && invalid_64bit_range(addr, len))
    57 + if (invalid_64bit_range(addr, len))
    58 return -EINVAL;
    59 }
    60
    61 diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
    62 index 7b6e3bb..05356ce 100644
    63 --- a/arch/x86/pci/common.c
    64 +++ b/arch/x86/pci/common.c
    65 @@ -372,13 +372,16 @@ static struct dmi_system_id __devinitdata pciprobe_dmi_table[] = {
    66 {}
    67 };
    68
    69 +void __init dmi_check_pciprobe(void)
    70 +{
    71 + dmi_check_system(pciprobe_dmi_table);
    72 +}
    73 +
    74 struct pci_bus * __devinit pcibios_scan_root(int busnum)
    75 {
    76 struct pci_bus *bus = NULL;
    77 struct pci_sysdata *sd;
    78
    79 - dmi_check_system(pciprobe_dmi_table);
    80 -
    81 while ((bus = pci_find_next_bus(bus)) != NULL) {
    82 if (bus->number == busnum) {
    83 /* Already scanned */
    84 diff --git a/arch/x86/pci/init.c b/arch/x86/pci/init.c
    85 index 3de9f9b..f1bf4e5 100644
    86 --- a/arch/x86/pci/init.c
    87 +++ b/arch/x86/pci/init.c
    88 @@ -32,6 +32,8 @@ static __init int pci_access_init(void)
    89 printk(KERN_ERR
    90 "PCI: Fatal: No config space access function found\n");
    91
    92 + dmi_check_pciprobe();
    93 +
    94 return 0;
    95 }
    96 arch_initcall(pci_access_init);
    97 diff --git a/arch/x86/pci/pci.h b/arch/x86/pci/pci.h
    98 index 3431518..95e5675 100644
    99 --- a/arch/x86/pci/pci.h
    100 +++ b/arch/x86/pci/pci.h
    101 @@ -39,6 +39,8 @@ enum pci_bf_sort_state {
    102 pci_dmi_bf,
    103 };
    104
    105 +extern void __init dmi_check_pciprobe(void);
    106 +
    107 /* pci-i386.c */
    108
    109 extern unsigned int pcibios_max_latency;
    110 diff --git a/crypto/authenc.c b/crypto/authenc.c
    111 index ed8ac5a..4b22676 100644
    112 --- a/crypto/authenc.c
    113 +++ b/crypto/authenc.c
    114 @@ -217,9 +217,10 @@ static void crypto_authenc_givencrypt_done(struct crypto_async_request *req,
    115 int err)
    116 {
    117 if (!err) {
    118 - struct aead_givcrypt_request *greq = req->data;
    119 + struct aead_request *areq = req->data;
    120 + struct skcipher_givcrypt_request *greq = aead_request_ctx(areq);
    121
    122 - err = crypto_authenc_genicv(&greq->areq, greq->giv, 0);
    123 + err = crypto_authenc_genicv(areq, greq->giv, 0);
    124 }
    125
    126 aead_request_complete(req->data, err);
    127 diff --git a/crypto/cryptd.c b/crypto/cryptd.c
    128 index 2504252..b150de5 100644
    129 --- a/crypto/cryptd.c
    130 +++ b/crypto/cryptd.c
    131 @@ -190,8 +190,10 @@ static struct crypto_instance *cryptd_alloc_instance(struct crypto_alg *alg,
    132 int err;
    133
    134 inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
    135 - if (IS_ERR(inst))
    136 + if (!inst) {
    137 + inst = ERR_PTR(-ENOMEM);
    138 goto out;
    139 + }
    140
    141 err = -ENAMETOOLONG;
    142 if (snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME,
    143 diff --git a/crypto/eseqiv.c b/crypto/eseqiv.c
    144 index b14f14e..881d309 100644
    145 --- a/crypto/eseqiv.c
    146 +++ b/crypto/eseqiv.c
    147 @@ -136,7 +136,8 @@ static int eseqiv_givencrypt(struct skcipher_givcrypt_request *req)
    148 }
    149
    150 ablkcipher_request_set_crypt(subreq, reqctx->src, dst,
    151 - req->creq.nbytes, req->creq.info);
    152 + req->creq.nbytes + ivsize,
    153 + req->creq.info);
    154
    155 memcpy(req->creq.info, ctx->salt, ivsize);
    156
    157 diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
    158 index 788da97..836362b 100644
    159 --- a/drivers/acpi/processor_idle.c
    160 +++ b/drivers/acpi/processor_idle.c
    161 @@ -848,6 +848,7 @@ static int acpi_processor_get_power_info_default(struct acpi_processor *pr)
    162 /* all processors need to support C1 */
    163 pr->power.states[ACPI_STATE_C1].type = ACPI_STATE_C1;
    164 pr->power.states[ACPI_STATE_C1].valid = 1;
    165 + pr->power.states[ACPI_STATE_C1].entry_method = ACPI_CSTATE_HALT;
    166 }
    167 /* the C0 state only exists as a filler in our array */
    168 pr->power.states[ACPI_STATE_C0].valid = 1;
    169 @@ -960,6 +961,9 @@ static int acpi_processor_get_power_info_cst(struct acpi_processor *pr)
    170 cx.address);
    171 }
    172
    173 + if (cx.type == ACPI_STATE_C1) {
    174 + cx.valid = 1;
    175 + }
    176
    177 obj = &(element->package.elements[2]);
    178 if (obj->type != ACPI_TYPE_INTEGER)
    179 diff --git a/drivers/md/md.c b/drivers/md/md.c
    180 index 61ccbd2..9f6d228 100644
    181 --- a/drivers/md/md.c
    182 +++ b/drivers/md/md.c
    183 @@ -2096,7 +2096,7 @@ rdev_attr_store(struct kobject *kobj, struct attribute *attr,
    184 rv = -EBUSY;
    185 else
    186 rv = entry->store(rdev, page, length);
    187 - mddev_unlock(rdev->mddev);
    188 + mddev_unlock(mddev);
    189 }
    190 return rv;
    191 }
    192 diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
    193 index f13346b..44ebdea 100644
    194 --- a/drivers/net/wireless/b43/b43.h
    195 +++ b/drivers/net/wireless/b43/b43.h
    196 @@ -628,6 +628,10 @@ struct b43_wl {
    197
    198 struct mutex mutex;
    199 spinlock_t irq_lock;
    200 + /* R/W lock for data transmission.
    201 + * Transmissions on 2+ queues can run concurrently, but somebody else
    202 + * might sync with TX by write_lock_irqsave()'ing. */
    203 + rwlock_t tx_lock;
    204 /* Lock for LEDs access. */
    205 spinlock_t leds_lock;
    206 /* Lock for SHM access. */
    207 diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
    208 index f23317e..e0055d0 100644
    209 --- a/drivers/net/wireless/b43/main.c
    210 +++ b/drivers/net/wireless/b43/main.c
    211 @@ -622,6 +622,7 @@ static void b43_synchronize_irq(struct b43_wldev *dev)
    212 */
    213 void b43_dummy_transmission(struct b43_wldev *dev)
    214 {
    215 + struct b43_wl *wl = dev->wl;
    216 struct b43_phy *phy = &dev->phy;
    217 unsigned int i, max_loop;
    218 u16 value;
    219 @@ -648,6 +649,9 @@ void b43_dummy_transmission(struct b43_wldev *dev)
    220 return;
    221 }
    222
    223 + spin_lock_irq(&wl->irq_lock);
    224 + write_lock(&wl->tx_lock);
    225 +
    226 for (i = 0; i < 5; i++)
    227 b43_ram_write(dev, i * 4, buffer[i]);
    228
    229 @@ -688,6 +692,9 @@ void b43_dummy_transmission(struct b43_wldev *dev)
    230 }
    231 if (phy->radio_ver == 0x2050 && phy->radio_rev <= 0x5)
    232 b43_radio_write16(dev, 0x0051, 0x0037);
    233 +
    234 + write_unlock(&wl->tx_lock);
    235 + spin_unlock_irq(&wl->irq_lock);
    236 }
    237
    238 static void key_write(struct b43_wldev *dev,
    239 @@ -2592,15 +2599,21 @@ static int b43_op_tx(struct ieee80211_hw *hw,
    240 {
    241 struct b43_wl *wl = hw_to_b43_wl(hw);
    242 struct b43_wldev *dev = wl->current_dev;
    243 - int err = -ENODEV;
    244 + unsigned long flags;
    245 + int err;
    246
    247 if (unlikely(!dev))
    248 - goto out;
    249 - if (unlikely(b43_status(dev) < B43_STAT_STARTED))
    250 - goto out;
    251 - /* DMA-TX is done without a global lock. */
    252 - err = b43_dma_tx(dev, skb, ctl);
    253 -out:
    254 + return NETDEV_TX_BUSY;
    255 +
    256 + /* Transmissions on seperate queues can run concurrently. */
    257 + read_lock_irqsave(&wl->tx_lock, flags);
    258 +
    259 + err = -ENODEV;
    260 + if (likely(b43_status(dev) >= B43_STAT_STARTED))
    261 + err = b43_dma_tx(dev, skb, ctl);
    262 +
    263 + read_unlock_irqrestore(&wl->tx_lock, flags);
    264 +
    265 if (unlikely(err))
    266 return NETDEV_TX_BUSY;
    267 return NETDEV_TX_OK;
    268 @@ -3109,7 +3122,9 @@ static void b43_wireless_core_stop(struct b43_wldev *dev)
    269 spin_unlock_irqrestore(&wl->irq_lock, flags);
    270 b43_synchronize_irq(dev);
    271
    272 + write_lock_irqsave(&wl->tx_lock, flags);
    273 b43_set_status(dev, B43_STAT_INITIALIZED);
    274 + write_unlock_irqrestore(&wl->tx_lock, flags);
    275
    276 mutex_unlock(&wl->mutex);
    277 /* Must unlock as it would otherwise deadlock. No races here.
    278 @@ -3117,8 +3132,6 @@ static void b43_wireless_core_stop(struct b43_wldev *dev)
    279 cancel_delayed_work_sync(&dev->periodic_work);
    280 mutex_lock(&wl->mutex);
    281
    282 - ieee80211_stop_queues(wl->hw); //FIXME this could cause a deadlock, as mac80211 seems buggy.
    283 -
    284 b43_mac_suspend(dev);
    285 free_irq(dev->dev->irq, dev);
    286 b43dbg(wl, "Wireless interface stopped\n");
    287 @@ -3912,6 +3925,14 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
    288 err = -EOPNOTSUPP;
    289 goto err_powerdown;
    290 }
    291 + if (1 /* disable A-PHY */) {
    292 + /* FIXME: For now we disable the A-PHY on multi-PHY devices. */
    293 + if (dev->phy.type != B43_PHYTYPE_N) {
    294 + have_2ghz_phy = 1;
    295 + have_5ghz_phy = 0;
    296 + }
    297 + }
    298 +
    299 dev->phy.gmode = have_2ghz_phy;
    300 tmp = dev->phy.gmode ? B43_TMSLOW_GMODE : 0;
    301 b43_wireless_core_reset(dev, tmp);
    302 @@ -4076,6 +4097,7 @@ static int b43_wireless_init(struct ssb_device *dev)
    303 memset(wl, 0, sizeof(*wl));
    304 wl->hw = hw;
    305 spin_lock_init(&wl->irq_lock);
    306 + rwlock_init(&wl->tx_lock);
    307 spin_lock_init(&wl->leds_lock);
    308 spin_lock_init(&wl->shm_lock);
    309 mutex_init(&wl->mutex);
    310 diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
    311 index d93b357..7a3625f 100644
    312 --- a/drivers/serial/mpc52xx_uart.c
    313 +++ b/drivers/serial/mpc52xx_uart.c
    314 @@ -1221,8 +1221,8 @@ static struct of_device_id mpc52xx_uart_of_match[] = {
    315 #endif
    316 #ifdef CONFIG_PPC_MPC512x
    317 { .compatible = "fsl,mpc5121-psc-uart", .data = &mpc512x_psc_ops, },
    318 - {},
    319 #endif
    320 + {},
    321 };
    322
    323 static int __devinit
    324 diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c
    325 index e0f0f09..9f877ab 100644
    326 --- a/fs/reiserfs/ioctl.c
    327 +++ b/fs/reiserfs/ioctl.c
    328 @@ -11,8 +11,6 @@
    329 #include <linux/smp_lock.h>
    330 #include <linux/compat.h>
    331
    332 -static int reiserfs_unpack(struct inode *inode, struct file *filp);
    333 -
    334 /*
    335 ** reiserfs_ioctl - handler for ioctl for inode
    336 ** supported commands:
    337 @@ -140,7 +138,7 @@ int reiserfs_prepare_write(struct file *f, struct page *page,
    338 ** Function try to convert tail from direct item into indirect.
    339 ** It set up nopack attribute in the REISERFS_I(inode)->nopack
    340 */
    341 -static int reiserfs_unpack(struct inode *inode, struct file *filp)
    342 +int reiserfs_unpack(struct inode *inode, struct file *filp)
    343 {
    344 int retval = 0;
    345 int index;
    346 diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
    347 index 393cc22..3302259 100644
    348 --- a/fs/reiserfs/super.c
    349 +++ b/fs/reiserfs/super.c
    350 @@ -2019,6 +2019,7 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
    351 {
    352 int err;
    353 struct nameidata nd;
    354 + struct inode *inode;
    355
    356 if (!(REISERFS_SB(sb)->s_mount_opt & (1 << REISERFS_QUOTA)))
    357 return -EINVAL;
    358 @@ -2030,12 +2031,18 @@ static int reiserfs_quota_on(struct super_block *sb, int type, int format_id,
    359 path_put(&nd.path);
    360 return -EXDEV;
    361 }
    362 + inode = nd.path.dentry->d_inode;
    363 /* We must not pack tails for quota files on reiserfs for quota IO to work */
    364 - if (!(REISERFS_I(nd.path.dentry->d_inode)->i_flags & i_nopack_mask)) {
    365 - reiserfs_warning(sb,
    366 - "reiserfs: Quota file must have tail packing disabled.");
    367 - path_put(&nd.path);
    368 - return -EINVAL;
    369 + if (!(REISERFS_I(inode)->i_flags & i_nopack_mask)) {
    370 + err = reiserfs_unpack(inode, NULL);
    371 + if (err) {
    372 + reiserfs_warning(sb,
    373 + "reiserfs: Unpacking tail of quota file failed"
    374 + " (%d). Cannot turn on quotas.", err);
    375 + path_put(&nd.path);
    376 + return -EINVAL;
    377 + }
    378 + mark_inode_dirty(inode);
    379 }
    380 /* Not journalling quota? No more tests needed... */
    381 if (!REISERFS_SB(sb)->s_qf_names[USRQUOTA] &&
    382 diff --git a/fs/utimes.c b/fs/utimes.c
    383 index b18da9c..80a481e 100644
    384 --- a/fs/utimes.c
    385 +++ b/fs/utimes.c
    386 @@ -39,9 +39,14 @@ asmlinkage long sys_utime(char __user *filename, struct utimbuf __user *times)
    387
    388 #endif
    389
    390 +static bool nsec_special(long nsec)
    391 +{
    392 + return nsec == UTIME_OMIT || nsec == UTIME_NOW;
    393 +}
    394 +
    395 static bool nsec_valid(long nsec)
    396 {
    397 - if (nsec == UTIME_OMIT || nsec == UTIME_NOW)
    398 + if (nsec_special(nsec))
    399 return true;
    400
    401 return nsec >= 0 && nsec <= 999999999;
    402 @@ -115,7 +120,15 @@ long do_utimes(int dfd, char __user *filename, struct timespec *times, int flags
    403 newattrs.ia_mtime.tv_nsec = times[1].tv_nsec;
    404 newattrs.ia_valid |= ATTR_MTIME_SET;
    405 }
    406 - } else {
    407 + }
    408 +
    409 + /*
    410 + * If times is NULL or both times are either UTIME_OMIT or
    411 + * UTIME_NOW, then need to check permissions, because
    412 + * inode_change_ok() won't do it.
    413 + */
    414 + if (!times || (nsec_special(times[0].tv_nsec) &&
    415 + nsec_special(times[1].tv_nsec))) {
    416 error = -EACCES;
    417 if (IS_IMMUTABLE(inode))
    418 goto dput_and_out;
    419 diff --git a/include/crypto/scatterwalk.h b/include/crypto/scatterwalk.h
    420 index 224658b..833d208 100644
    421 --- a/include/crypto/scatterwalk.h
    422 +++ b/include/crypto/scatterwalk.h
    423 @@ -57,10 +57,14 @@ static inline void scatterwalk_sg_chain(struct scatterlist *sg1, int num,
    424 struct scatterlist *sg2)
    425 {
    426 sg_set_page(&sg1[num - 1], (void *)sg2, 0, 0);
    427 + sg1[num - 1].page_link &= ~0x02;
    428 }
    429
    430 static inline struct scatterlist *scatterwalk_sg_next(struct scatterlist *sg)
    431 {
    432 + if (sg_is_last(sg))
    433 + return NULL;
    434 +
    435 return (++sg)->length ? sg : (void *)sg_page(sg);
    436 }
    437
    438 diff --git a/include/linux/reiserfs_fs.h b/include/linux/reiserfs_fs.h
    439 index 8e7eff2..4aacaee 100644
    440 --- a/include/linux/reiserfs_fs.h
    441 +++ b/include/linux/reiserfs_fs.h
    442 @@ -2176,6 +2176,7 @@ int reiserfs_ioctl(struct inode *inode, struct file *filp,
    443 unsigned int cmd, unsigned long arg);
    444 long reiserfs_compat_ioctl(struct file *filp,
    445 unsigned int cmd, unsigned long arg);
    446 +int reiserfs_unpack(struct inode *inode, struct file *filp);
    447
    448 /* ioctl's command */
    449 #define REISERFS_IOC_UNPACK _IOW(0xCD,1,long)
    450 diff --git a/kernel/sched.c b/kernel/sched.c
    451 index 8dcdec6..1e4596c 100644
    452 --- a/kernel/sched.c
    453 +++ b/kernel/sched.c
    454 @@ -876,6 +876,7 @@ static inline void resched_rq(struct rq *rq)
    455 enum {
    456 HRTICK_SET, /* re-programm hrtick_timer */
    457 HRTICK_RESET, /* not a new slice */
    458 + HRTICK_BLOCK, /* stop hrtick operations */
    459 };
    460
    461 /*
    462 @@ -887,6 +888,8 @@ static inline int hrtick_enabled(struct rq *rq)
    463 {
    464 if (!sched_feat(HRTICK))
    465 return 0;
    466 + if (unlikely(test_bit(HRTICK_BLOCK, &rq->hrtick_flags)))
    467 + return 0;
    468 return hrtimer_is_hres_active(&rq->hrtick_timer);
    469 }
    470
    471 @@ -969,7 +972,63 @@ static enum hrtimer_restart hrtick(struct hrtimer *timer)
    472 return HRTIMER_NORESTART;
    473 }
    474
    475 -static inline void init_rq_hrtick(struct rq *rq)
    476 +static void hotplug_hrtick_disable(int cpu)
    477 +{
    478 + struct rq *rq = cpu_rq(cpu);
    479 + unsigned long flags;
    480 +
    481 + spin_lock_irqsave(&rq->lock, flags);
    482 + rq->hrtick_flags = 0;
    483 + __set_bit(HRTICK_BLOCK, &rq->hrtick_flags);
    484 + spin_unlock_irqrestore(&rq->lock, flags);
    485 +
    486 + hrtick_clear(rq);
    487 +}
    488 +
    489 +static void hotplug_hrtick_enable(int cpu)
    490 +{
    491 + struct rq *rq = cpu_rq(cpu);
    492 + unsigned long flags;
    493 +
    494 + spin_lock_irqsave(&rq->lock, flags);
    495 + __clear_bit(HRTICK_BLOCK, &rq->hrtick_flags);
    496 + spin_unlock_irqrestore(&rq->lock, flags);
    497 +}
    498 +
    499 +static int
    500 +hotplug_hrtick(struct notifier_block *nfb, unsigned long action, void *hcpu)
    501 +{
    502 + int cpu = (int)(long)hcpu;
    503 +
    504 + switch (action) {
    505 + case CPU_UP_CANCELED:
    506 + case CPU_UP_CANCELED_FROZEN:
    507 + case CPU_DOWN_PREPARE:
    508 + case CPU_DOWN_PREPARE_FROZEN:
    509 + case CPU_DEAD:
    510 + case CPU_DEAD_FROZEN:
    511 + hotplug_hrtick_disable(cpu);
    512 + return NOTIFY_OK;
    513 +
    514 + case CPU_UP_PREPARE:
    515 + case CPU_UP_PREPARE_FROZEN:
    516 + case CPU_DOWN_FAILED:
    517 + case CPU_DOWN_FAILED_FROZEN:
    518 + case CPU_ONLINE:
    519 + case CPU_ONLINE_FROZEN:
    520 + hotplug_hrtick_enable(cpu);
    521 + return NOTIFY_OK;
    522 + }
    523 +
    524 + return NOTIFY_DONE;
    525 +}
    526 +
    527 +static void init_hrtick(void)
    528 +{
    529 + hotcpu_notifier(hotplug_hrtick, 0);
    530 +}
    531 +
    532 +static void init_rq_hrtick(struct rq *rq)
    533 {
    534 rq->hrtick_flags = 0;
    535 hrtimer_init(&rq->hrtick_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
    536 @@ -1006,6 +1065,10 @@ static inline void init_rq_hrtick(struct rq *rq)
    537 void hrtick_resched(void)
    538 {
    539 }
    540 +
    541 +static inline void init_hrtick(void)
    542 +{
    543 +}
    544 #endif
    545
    546 /*
    547 @@ -7094,6 +7157,7 @@ void __init sched_init_smp(void)
    548 put_online_cpus();
    549 /* XXX: Theoretical race here - CPU may be hotplugged now */
    550 hotcpu_notifier(update_sched_domains, 0);
    551 + init_hrtick();
    552
    553 /* Move init over to a non-isolated CPU */
    554 if (set_cpus_allowed(current, non_isolated_cpus) < 0)
    555 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
    556 index 402a504..55443c2 100644
    557 --- a/mm/page_alloc.c
    558 +++ b/mm/page_alloc.c
    559 @@ -2518,7 +2518,9 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
    560 struct page *page;
    561 unsigned long end_pfn = start_pfn + size;
    562 unsigned long pfn;
    563 + struct zone *z;
    564
    565 + z = &NODE_DATA(nid)->node_zones[zone];
    566 for (pfn = start_pfn; pfn < end_pfn; pfn++) {
    567 /*
    568 * There can be holes in boot-time mem_map[]s
    569 @@ -2536,7 +2538,6 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
    570 init_page_count(page);
    571 reset_page_mapcount(page);
    572 SetPageReserved(page);
    573 -
    574 /*
    575 * Mark the block movable so that blocks are reserved for
    576 * movable at startup. This will force kernel allocations
    577 @@ -2545,8 +2546,15 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone,
    578 * kernel allocations are made. Later some blocks near
    579 * the start are marked MIGRATE_RESERVE by
    580 * setup_zone_migrate_reserve()
    581 + *
    582 + * bitmap is created for zone's valid pfn range. but memmap
    583 + * can be created for invalid pages (for alignment)
    584 + * check here not to call set_pageblock_migratetype() against
    585 + * pfn out of zone.
    586 */
    587 - if ((pfn & (pageblock_nr_pages-1)))
    588 + if ((z->zone_start_pfn <= pfn)
    589 + && (pfn < z->zone_start_pfn + z->spanned_pages)
    590 + && !(pfn & (pageblock_nr_pages - 1)))
    591 set_pageblock_migratetype(page, MIGRATE_MOVABLE);
    592
    593 INIT_LIST_HEAD(&page->lru);
    594 @@ -4460,6 +4468,8 @@ void set_pageblock_flags_group(struct page *page, unsigned long flags,
    595 pfn = page_to_pfn(page);
    596 bitmap = get_pageblock_bitmap(zone, pfn);
    597 bitidx = pfn_to_bitidx(zone, pfn);
    598 + VM_BUG_ON(pfn < zone->zone_start_pfn);
    599 + VM_BUG_ON(pfn >= zone->zone_start_pfn + zone->spanned_pages);
    600
    601 for (; start_bitidx <= end_bitidx; start_bitidx++, value <<= 1)
    602 if (flags & value)
    603 diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
    604 index 1656c00..4de86c4 100644
    605 --- a/net/ipv6/sit.c
    606 +++ b/net/ipv6/sit.c
    607 @@ -446,9 +446,9 @@ static int ipip6_rcv(struct sk_buff *skb)
    608 }
    609
    610 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
    611 - kfree_skb(skb);
    612 read_unlock(&ipip6_lock);
    613 out:
    614 + kfree_skb(skb);
    615 return 0;
    616 }
    617