diff options
Diffstat (limited to 'packages/linux/linux-ezx-2.6.21/patches/patch-2.6.21.4')
| -rw-r--r-- | packages/linux/linux-ezx-2.6.21/patches/patch-2.6.21.4 | 2816 |
1 files changed, 2816 insertions, 0 deletions
diff --git a/packages/linux/linux-ezx-2.6.21/patches/patch-2.6.21.4 b/packages/linux/linux-ezx-2.6.21/patches/patch-2.6.21.4 new file mode 100644 index 0000000000..2c2ed60433 --- /dev/null +++ b/packages/linux/linux-ezx-2.6.21/patches/patch-2.6.21.4 @@ -0,0 +1,2816 @@ +diff --git a/Makefile b/Makefile +index d970cb1..e5c5531 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + VERSION = 2 + PATCHLEVEL = 6 + SUBLEVEL = 21 +-EXTRAVERSION = ++EXTRAVERSION = .4 + NAME = Nocturnal Monster Puppy + + # *DOCUMENTATION* +diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c +index 2409560..7ed141f 100644 +--- a/arch/arm/kernel/traps.c ++++ b/arch/arm/kernel/traps.c +@@ -273,6 +273,7 @@ asmlinkage void do_undefinstr(struct pt_regs *regs) + struct undef_hook *hook; + siginfo_t info; + void __user *pc; ++ unsigned long flags; + + /* + * According to the ARM ARM, PC is 2 or 4 bytes ahead, +@@ -291,7 +292,7 @@ asmlinkage void do_undefinstr(struct pt_regs *regs) + get_user(instr, (u32 __user *)pc); + } + +- spin_lock_irq(&undef_lock); ++ spin_lock_irqsave(&undef_lock, flags); + list_for_each_entry(hook, &undef_hook, node) { + if ((instr & hook->instr_mask) == hook->instr_val && + (regs->ARM_cpsr & hook->cpsr_mask) == hook->cpsr_val) { +@@ -301,7 +302,7 @@ asmlinkage void do_undefinstr(struct pt_regs *regs) + } + } + } +- spin_unlock_irq(&undef_lock); ++ spin_unlock_irqrestore(&undef_lock, flags); + + #ifdef CONFIG_DEBUG_USER + if (user_debug & UDBG_UNDEFINED) { +diff --git a/arch/arm/mach-iop13xx/pci.c b/arch/arm/mach-iop13xx/pci.c +index 89ec70e..d907a2a 100644 +--- a/arch/arm/mach-iop13xx/pci.c ++++ b/arch/arm/mach-iop13xx/pci.c +@@ -1023,7 +1023,7 @@ int iop13xx_pci_setup(int nr, struct pci_sys_data *sys) + << IOP13XX_ATUX_PCIXSR_FUNC_NUM; + __raw_writel(pcixsr, IOP13XX_ATUX_PCIXSR); + +- res[0].start = IOP13XX_PCIX_LOWER_IO_PA; ++ res[0].start = IOP13XX_PCIX_LOWER_IO_PA + IOP13XX_PCIX_IO_BUS_OFFSET; + res[0].end = IOP13XX_PCIX_UPPER_IO_PA; + res[0].name = "IQ81340 ATUX PCI I/O Space"; + res[0].flags = IORESOURCE_IO; +@@ -1033,7 +1033,7 @@ int iop13xx_pci_setup(int nr, struct pci_sys_data *sys) + res[1].name = "IQ81340 ATUX PCI Memory Space"; + res[1].flags = IORESOURCE_MEM; + sys->mem_offset = IOP13XX_PCIX_MEM_OFFSET; +- sys->io_offset = IOP13XX_PCIX_IO_OFFSET; ++ sys->io_offset = IOP13XX_PCIX_LOWER_IO_PA; + break; + case IOP13XX_INIT_ATU_ATUE: + /* Note: the function number field in the PCSR is ro */ +@@ -1044,7 +1044,7 @@ int iop13xx_pci_setup(int nr, struct pci_sys_data *sys) + + __raw_writel(pcsr, IOP13XX_ATUE_PCSR); + +- res[0].start = IOP13XX_PCIE_LOWER_IO_PA; ++ res[0].start = IOP13XX_PCIE_LOWER_IO_PA + IOP13XX_PCIE_IO_BUS_OFFSET; + res[0].end = IOP13XX_PCIE_UPPER_IO_PA; + res[0].name = "IQ81340 ATUE PCI I/O Space"; + res[0].flags = IORESOURCE_IO; +@@ -1054,7 +1054,7 @@ int iop13xx_pci_setup(int nr, struct pci_sys_data *sys) + res[1].name = "IQ81340 ATUE PCI Memory Space"; + res[1].flags = IORESOURCE_MEM; + sys->mem_offset = IOP13XX_PCIE_MEM_OFFSET; +- sys->io_offset = IOP13XX_PCIE_IO_OFFSET; ++ sys->io_offset = IOP13XX_PCIE_LOWER_IO_PA; + sys->map_irq = iop13xx_pcie_map_irq; + break; + default: +diff --git a/arch/arm/plat-iop/time.c b/arch/arm/plat-iop/time.c +index 16300ad..0cc26da 100644 +--- a/arch/arm/plat-iop/time.c ++++ b/arch/arm/plat-iop/time.c +@@ -32,22 +32,22 @@ static unsigned long next_jiffy_time; + + unsigned long iop_gettimeoffset(void) + { +- unsigned long offset, temp1, temp2; ++ unsigned long offset, temp; + + /* enable cp6, if necessary, to avoid taking the overhead of an + * undefined instruction trap + */ + asm volatile ( + "mrc p15, 0, %0, c15, c1, 0\n\t" +- "ands %1, %0, #(1 << 6)\n\t" ++ "tst %0, #(1 << 6)\n\t" + "orreq %0, %0, #(1 << 6)\n\t" + "mcreq p15, 0, %0, c15, c1, 0\n\t" +-#ifdef CONFIG_XSCALE ++#ifdef CONFIG_CPU_XSCALE + "mrceq p15, 0, %0, c15, c1, 0\n\t" + "moveq %0, %0\n\t" + "subeq pc, pc, #4\n\t" + #endif +- : "=r"(temp1), "=r"(temp2) : : "cc"); ++ : "=r"(temp) : : "cc"); + + offset = next_jiffy_time - read_tcr1(); + +diff --git a/arch/i386/kernel/cpu/cpufreq/powernow-k7.c b/arch/i386/kernel/cpu/cpufreq/powernow-k7.c +index 837b041..ca3e1d3 100644 +--- a/arch/i386/kernel/cpu/cpufreq/powernow-k7.c ++++ b/arch/i386/kernel/cpu/cpufreq/powernow-k7.c +@@ -341,15 +341,17 @@ static int powernow_acpi_init(void) + pc.val = (unsigned long) acpi_processor_perf->states[0].control; + for (i = 0; i < number_scales; i++) { + u8 fid, vid; +- unsigned int speed; ++ struct acpi_processor_px *state = ++ &acpi_processor_perf->states[i]; ++ unsigned int speed, speed_mhz; + +- pc.val = (unsigned long) acpi_processor_perf->states[i].control; ++ pc.val = (unsigned long) state->control; + dprintk ("acpi: P%d: %d MHz %d mW %d uS control %08x SGTC %d\n", + i, +- (u32) acpi_processor_perf->states[i].core_frequency, +- (u32) acpi_processor_perf->states[i].power, +- (u32) acpi_processor_perf->states[i].transition_latency, +- (u32) acpi_processor_perf->states[i].control, ++ (u32) state->core_frequency, ++ (u32) state->power, ++ (u32) state->transition_latency, ++ (u32) state->control, + pc.bits.sgtc); + + vid = pc.bits.vid; +@@ -360,6 +362,18 @@ static int powernow_acpi_init(void) + powernow_table[i].index |= (vid << 8); /* upper 8 bits */ + + speed = powernow_table[i].frequency; ++ speed_mhz = speed / 1000; ++ ++ /* processor_perflib will multiply the MHz value by 1000 to ++ * get a KHz value (e.g. 1266000). However, powernow-k7 works ++ * with true KHz values (e.g. 1266768). To ensure that all ++ * powernow frequencies are available, we must ensure that ++ * ACPI doesn't restrict them, so we round up the MHz value ++ * to ensure that perflib's computed KHz value is greater than ++ * or equal to powernow's KHz value. ++ */ ++ if (speed % 1000 > 0) ++ speed_mhz++; + + if ((fid_codes[fid] % 10)==5) { + if (have_a0 == 1) +@@ -368,10 +382,16 @@ static int powernow_acpi_init(void) + + dprintk (" FID: 0x%x (%d.%dx [%dMHz]) " + "VID: 0x%x (%d.%03dV)\n", fid, fid_codes[fid] / 10, +- fid_codes[fid] % 10, speed/1000, vid, ++ fid_codes[fid] % 10, speed_mhz, vid, + mobile_vid_table[vid]/1000, + mobile_vid_table[vid]%1000); + ++ if (state->core_frequency != speed_mhz) { ++ state->core_frequency = speed_mhz; ++ dprintk(" Corrected ACPI frequency to %d\n", ++ speed_mhz); ++ } ++ + if (latency < pc.bits.sgtc) + latency = pc.bits.sgtc; + +@@ -602,7 +622,7 @@ static int __init powernow_cpu_init (struct cpufreq_policy *policy) + result = powernow_acpi_init(); + if (result) { + printk (KERN_INFO PFX "ACPI and legacy methods failed\n"); +- printk (KERN_INFO PFX "See http://www.codemonkey.org.uk/projects/cpufreq/powernow-k7.shtml\n"); ++ printk (KERN_INFO PFX "See http://www.codemonkey.org.uk/projects/cpufreq/powernow-k7.html\n"); + } + } else { + /* SGTC use the bus clock as timer */ +diff --git a/arch/i386/kernel/cpu/cpufreq/powernow-k8.c b/arch/i386/kernel/cpu/cpufreq/powernow-k8.c +index fe3b670..e295d87 100644 +--- a/arch/i386/kernel/cpu/cpufreq/powernow-k8.c ++++ b/arch/i386/kernel/cpu/cpufreq/powernow-k8.c +@@ -521,7 +521,7 @@ static int check_supported_cpu(unsigned int cpu) + + if ((eax & CPUID_XFAM) == CPUID_XFAM_K8) { + if (((eax & CPUID_USE_XFAM_XMOD) != CPUID_USE_XFAM_XMOD) || +- ((eax & CPUID_XMOD) > CPUID_XMOD_REV_G)) { ++ ((eax & CPUID_XMOD) > CPUID_XMOD_REV_MASK)) { + printk(KERN_INFO PFX "Processor cpuid %x not supported\n", eax); + goto out; + } +diff --git a/arch/i386/kernel/cpu/cpufreq/powernow-k8.h b/arch/i386/kernel/cpu/cpufreq/powernow-k8.h +index 0fb2a30..575541f 100644 +--- a/arch/i386/kernel/cpu/cpufreq/powernow-k8.h ++++ b/arch/i386/kernel/cpu/cpufreq/powernow-k8.h +@@ -46,8 +46,8 @@ struct powernow_k8_data { + #define CPUID_XFAM 0x0ff00000 /* extended family */ + #define CPUID_XFAM_K8 0 + #define CPUID_XMOD 0x000f0000 /* extended model */ +-#define CPUID_XMOD_REV_G 0x00060000 +-#define CPUID_XFAM_10H 0x00100000 /* family 0x10 */ ++#define CPUID_XMOD_REV_MASK 0x00080000 ++#define CPUID_XFAM_10H 0x00100000 /* family 0x10 */ + #define CPUID_USE_XFAM_XMOD 0x00000f00 + #define CPUID_GET_MAX_CAPABILITIES 0x80000000 + #define CPUID_FREQ_VOLT_CAPABILITIES 0x80000007 +diff --git a/arch/sparc64/kernel/of_device.c b/arch/sparc64/kernel/of_device.c +index fb9bf1e..f56569f 100644 +--- a/arch/sparc64/kernel/of_device.c ++++ b/arch/sparc64/kernel/of_device.c +@@ -508,6 +508,13 @@ static int __init build_one_resource(struct device_node *parent, + return 0; + } + ++ /* When we miss an I/O space match on PCI, just pass it up ++ * to the next PCI bridge and/or controller. ++ */ ++ if (!strcmp(bus->name, "pci") && ++ (addr[0] & 0x03000000) == 0x01000000) ++ return 0; ++ + return 1; + } + +diff --git a/arch/sparc64/kernel/prom.c b/arch/sparc64/kernel/prom.c +index 0917c24..3494adf 100644 +--- a/arch/sparc64/kernel/prom.c ++++ b/arch/sparc64/kernel/prom.c +@@ -1555,10 +1555,21 @@ static struct device_node * __init create_node(phandle node, struct device_node + + static struct device_node * __init build_tree(struct device_node *parent, phandle node, struct device_node ***nextp) + { ++ struct device_node *ret = NULL, *prev_sibling = NULL; + struct device_node *dp; + +- dp = create_node(node, parent); +- if (dp) { ++ while (1) { ++ dp = create_node(node, parent); ++ if (!dp) ++ break; ++ ++ if (prev_sibling) ++ prev_sibling->sibling = dp; ++ ++ if (!ret) ++ ret = dp; ++ prev_sibling = dp; ++ + *(*nextp) = dp; + *nextp = &dp->allnext; + +@@ -1567,10 +1578,10 @@ static struct device_node * __init build_tree(struct device_node *parent, phandl + + dp->child = build_tree(dp, prom_getchild(node), nextp); + +- dp->sibling = build_tree(parent, prom_getsibling(node), nextp); ++ node = prom_getsibling(node); + } + +- return dp; ++ return ret; + } + + void __init prom_build_devicetree(void) +diff --git a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c +index fc99f7b..8ad7bdb 100644 +--- a/arch/sparc64/kernel/smp.c ++++ b/arch/sparc64/kernel/smp.c +@@ -566,6 +566,9 @@ static void hypervisor_xcall_deliver(u64 data0, u64 data1, u64 data2, cpumask_t + unsigned long flags, status; + int cnt, retries, this_cpu, prev_sent, i; + ++ if (cpus_empty(mask)) ++ return; ++ + /* We have to do this whole thing with interrupts fully disabled. + * Otherwise if we send an xcall from interrupt context it will + * corrupt both our mondo block and cpu list state. +diff --git a/arch/x86_64/kernel/vsyscall.c b/arch/x86_64/kernel/vsyscall.c +index b43c698..fc9f042 100644 +--- a/arch/x86_64/kernel/vsyscall.c ++++ b/arch/x86_64/kernel/vsyscall.c +@@ -132,7 +132,7 @@ static __always_inline void do_vgettimeofday(struct timeval * tv) + + /* convert to usecs and add to timespec: */ + tv->tv_usec += nsec_delta / NSEC_PER_USEC; +- while (tv->tv_usec > USEC_PER_SEC) { ++ while (tv->tv_usec >= USEC_PER_SEC) { + tv->tv_sec += 1; + tv->tv_usec -= USEC_PER_SEC; + } +diff --git a/crypto/api.c b/crypto/api.c +index 55af8bb..33734fd 100644 +--- a/crypto/api.c ++++ b/crypto/api.c +@@ -48,8 +48,10 @@ EXPORT_SYMBOL_GPL(crypto_mod_get); + + void crypto_mod_put(struct crypto_alg *alg) + { ++ struct module *module = alg->cra_module; ++ + crypto_alg_put(alg); +- module_put(alg->cra_module); ++ module_put(module); + } + EXPORT_SYMBOL_GPL(crypto_mod_put); + +diff --git a/drivers/acpi/tables/tbfadt.c b/drivers/acpi/tables/tbfadt.c +index 807c711..d341491 100644 +--- a/drivers/acpi/tables/tbfadt.c ++++ b/drivers/acpi/tables/tbfadt.c +@@ -347,6 +347,20 @@ static void acpi_tb_convert_fadt(void) + acpi_gbl_xpm1b_enable.space_id = acpi_gbl_FADT.xpm1a_event_block.space_id; + + } ++ /* ++ * _CST object and C States change notification start with ++ * ACPI 2.0 (FADT r3). Although the field should be Reserved ++ * and 0 before then, some pre-r3 FADT set this field and ++ * it results in SMM-related boot failures. For them, clear it. ++ */ ++ if ((acpi_gbl_FADT.header.revision < 3) && ++ (acpi_gbl_FADT.cst_control != 0)) { ++ ACPI_WARNING((AE_INFO, ++ "Ignoring BIOS FADT r%u C-state control", ++ acpi_gbl_FADT.header.revision)); ++ acpi_gbl_FADT.cst_control = 0; ++ } ++ + } + + /****************************************************************************** +diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c +index 2ffcca0..4d63974 100644 +--- a/drivers/ata/libata-sff.c ++++ b/drivers/ata/libata-sff.c +@@ -557,12 +557,30 @@ ata_pci_init_native_mode(struct pci_dev *pdev, struct ata_port_info **port, int + int i, p = 0; + void __iomem * const *iomap; + ++ /* Discard disabled ports. Some controllers show their ++ unused channels this way */ ++ if (ata_resources_present(pdev, 0) == 0) ++ ports &= ~ATA_PORT_PRIMARY; ++ if (ata_resources_present(pdev, 1) == 0) ++ ports &= ~ATA_PORT_SECONDARY; ++ + /* iomap BARs */ +- for (i = 0; i < 4; i++) { +- if (pcim_iomap(pdev, i, 0) == NULL) { +- dev_printk(KERN_ERR, &pdev->dev, +- "failed to iomap PCI BAR %d\n", i); +- return NULL; ++ if (ports & ATA_PORT_PRIMARY) { ++ for (i = 0; i <= 1; i++) { ++ if (pcim_iomap(pdev, i, 0) == NULL) { ++ dev_printk(KERN_ERR, &pdev->dev, ++ "failed to iomap PCI BAR %d\n", i); ++ return NULL; ++ } ++ } ++ } ++ if (ports & ATA_PORT_SECONDARY) { ++ for (i = 2; i <= 3; i++) { ++ if (pcim_iomap(pdev, i, 0) == NULL) { ++ dev_printk(KERN_ERR, &pdev->dev, ++ "failed to iomap PCI BAR %d\n", i); ++ return NULL; ++ } + } + } + +@@ -577,13 +595,6 @@ ata_pci_init_native_mode(struct pci_dev *pdev, struct ata_port_info **port, int + probe_ent->irq = pdev->irq; + probe_ent->irq_flags = IRQF_SHARED; + +- /* Discard disabled ports. Some controllers show their +- unused channels this way */ +- if (ata_resources_present(pdev, 0) == 0) +- ports &= ~ATA_PORT_PRIMARY; +- if (ata_resources_present(pdev, 1) == 0) +- ports &= ~ATA_PORT_SECONDARY; +- + if (ports & ATA_PORT_PRIMARY) { + probe_ent->port[p].cmd_addr = iomap[0]; + probe_ent->port[p].altstatus_addr = +diff --git a/drivers/ata/sata_via.c b/drivers/ata/sata_via.c +index 598e6a2..ea6efca 100644 +--- a/drivers/ata/sata_via.c ++++ b/drivers/ata/sata_via.c +@@ -97,6 +97,10 @@ static struct pci_driver svia_pci_driver = { + .name = DRV_NAME, + .id_table = svia_pci_tbl, + .probe = svia_init_one, ++#ifdef CONFIG_PM ++ .suspend = ata_pci_device_suspend, ++ .resume = ata_pci_device_resume, ++#endif + .remove = ata_pci_remove_one, + }; + +@@ -116,6 +120,10 @@ static struct scsi_host_template svia_sht = { + .slave_configure = ata_scsi_slave_config, + .slave_destroy = ata_scsi_slave_destroy, + .bios_param = ata_std_bios_param, ++#ifdef CONFIG_PM ++ .suspend = ata_scsi_device_suspend, ++ .resume = ata_scsi_device_resume, ++#endif + }; + + static const struct ata_port_operations vt6420_sata_ops = { +diff --git a/drivers/base/core.c b/drivers/base/core.c +index d7fcf82..a8dfee2 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -93,6 +93,9 @@ static void device_release(struct kobject * kobj) + { + struct device * dev = to_dev(kobj); + ++ kfree(dev->devt_attr); ++ dev->devt_attr = NULL; ++ + if (dev->release) + dev->release(dev); + else if (dev->type && dev->type->release) +@@ -765,10 +768,8 @@ void device_del(struct device * dev) + + if (parent) + klist_del(&dev->knode_parent); +- if (dev->devt_attr) { ++ if (dev->devt_attr) + device_remove_file(dev, dev->devt_attr); +- kfree(dev->devt_attr); +- } + if (dev->class) { + sysfs_remove_link(&dev->kobj, "subsystem"); + /* If this is not a "fake" compatible device, remove the +diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c +index e221465..cc13ebc 100644 +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -1859,10 +1859,10 @@ static __devinit int try_init_acpi(struct SPMITable *spmi) + + if (spmi->addr.space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) { + info->io_setup = mem_setup; +- info->io.addr_type = IPMI_IO_ADDR_SPACE; ++ info->io.addr_type = IPMI_MEM_ADDR_SPACE; + } else if (spmi->addr.space_id == ACPI_ADR_SPACE_SYSTEM_IO) { + info->io_setup = port_setup; +- info->io.addr_type = IPMI_MEM_ADDR_SPACE; ++ info->io.addr_type = IPMI_IO_ADDR_SPACE; + } else { + kfree(info); + printk("ipmi_si: Unknown ACPI I/O Address type\n"); +diff --git a/drivers/char/random.c b/drivers/char/random.c +index b9dc7aa..fa5b95b 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -760,7 +760,7 @@ static size_t account(struct entropy_store *r, size_t nbytes, int min, + + static void extract_buf(struct entropy_store *r, __u8 *out) + { +- int i, x; ++ int i; + __u32 data[16], buf[5 + SHA_WORKSPACE_WORDS]; + + sha_init(buf); +@@ -772,9 +772,11 @@ static void extract_buf(struct entropy_store *r, __u8 *out) + * attempts to find previous ouputs), unless the hash + * function can be inverted. + */ +- for (i = 0, x = 0; i < r->poolinfo->poolwords; i += 16, x+=2) { +- sha_transform(buf, (__u8 *)r->pool+i, buf + 5); +- add_entropy_words(r, &buf[x % 5], 1); ++ for (i = 0; i < r->poolinfo->poolwords; i += 16) { ++ /* hash blocks of 16 words = 512 bits */ ++ sha_transform(buf, (__u8 *)(r->pool + i), buf + 5); ++ /* feed back portion of the resulting hash */ ++ add_entropy_words(r, &buf[i % 5], 1); + } + + /* +@@ -782,7 +784,7 @@ static void extract_buf(struct entropy_store *r, __u8 *out) + * portion of the pool while mixing, and hash one + * final time. + */ +- __add_entropy_words(r, &buf[x % 5], 1, data); ++ __add_entropy_words(r, &buf[i % 5], 1, data); + sha_transform(buf, (__u8 *)data, buf + 5); + + /* +@@ -1022,37 +1024,44 @@ random_poll(struct file *file, poll_table * wait) + return mask; + } + +-static ssize_t +-random_write(struct file * file, const char __user * buffer, +- size_t count, loff_t *ppos) ++static int ++write_pool(struct entropy_store *r, const char __user *buffer, size_t count) + { +- int ret = 0; + size_t bytes; + __u32 buf[16]; + const char __user *p = buffer; +- size_t c = count; + +- while (c > 0) { +- bytes = min(c, sizeof(buf)); ++ while (count > 0) { ++ bytes = min(count, sizeof(buf)); ++ if (copy_from_user(&buf, p, bytes)) ++ return -EFAULT; + +- bytes -= copy_from_user(&buf, p, bytes); +- if (!bytes) { +- ret = -EFAULT; +- break; +- } +- c -= bytes; ++ count -= bytes; + p += bytes; + +- add_entropy_words(&input_pool, buf, (bytes + 3) / 4); +- } +- if (p == buffer) { +- return (ssize_t)ret; +- } else { +- struct inode *inode = file->f_path.dentry->d_inode; +- inode->i_mtime = current_fs_time(inode->i_sb); +- mark_inode_dirty(inode); +- return (ssize_t)(p - buffer); ++ add_entropy_words(r, buf, (bytes + 3) / 4); + } ++ ++ return 0; ++} ++ ++static ssize_t ++random_write(struct file * file, const char __user * buffer, ++ size_t count, loff_t *ppos) ++{ ++ size_t ret; ++ struct inode *inode = file->f_path.dentry->d_inode; ++ ++ ret = write_pool(&blocking_pool, buffer, count); ++ if (ret) ++ return ret; ++ ret = write_pool(&nonblocking_pool, buffer, count); ++ if (ret) ++ return ret; ++ ++ inode->i_mtime = current_fs_time(inode->i_sb); ++ mark_inode_dirty(inode); ++ return (ssize_t)count; + } + + static int +@@ -1091,8 +1100,8 @@ random_ioctl(struct inode * inode, struct file * file, + return -EINVAL; + if (get_user(size, p++)) + return -EFAULT; +- retval = random_write(file, (const char __user *) p, +- size, &file->f_pos); ++ retval = write_pool(&input_pool, (const char __user *)p, ++ size); + if (retval < 0) + return retval; + credit_entropy_store(&input_pool, ent_count); +diff --git a/drivers/crypto/geode-aes.c b/drivers/crypto/geode-aes.c +index 6d3840e..6a86958 100644 +--- a/drivers/crypto/geode-aes.c ++++ b/drivers/crypto/geode-aes.c +@@ -102,10 +102,15 @@ geode_aes_crypt(struct geode_aes_op *op) + u32 flags = 0; + unsigned long iflags; + +- if (op->len == 0 || op->src == op->dst) ++ if (op->len == 0) + return 0; + +- if (op->flags & AES_FLAGS_COHERENT) ++ /* If the source and destination is the same, then ++ * we need to turn on the coherent flags, otherwise ++ * we don't need to worry ++ */ ++ ++ if (op->src == op->dst) + flags |= (AES_CTRL_DCA | AES_CTRL_SCA); + + if (op->dir == AES_DIR_ENCRYPT) +@@ -120,7 +125,7 @@ geode_aes_crypt(struct geode_aes_op *op) + _writefield(AES_WRITEIV0_REG, op->iv); + } + +- if (op->flags & AES_FLAGS_USRKEY) { ++ if (!(op->flags & AES_FLAGS_HIDDENKEY)) { + flags |= AES_CTRL_WRKEY; + _writefield(AES_WRITEKEY0_REG, op->key); + } +@@ -289,6 +294,7 @@ static struct crypto_alg geode_cbc_alg = { + .setkey = geode_setkey, + .encrypt = geode_cbc_encrypt, + .decrypt = geode_cbc_decrypt, ++ .ivsize = AES_IV_LENGTH, + } + } + }; +diff --git a/drivers/crypto/geode-aes.h b/drivers/crypto/geode-aes.h +index 8003a36..f479686 100644 +--- a/drivers/crypto/geode-aes.h ++++ b/drivers/crypto/geode-aes.h +@@ -20,8 +20,7 @@ + #define AES_DIR_DECRYPT 0 + #define AES_DIR_ENCRYPT 1 + +-#define AES_FLAGS_USRKEY (1 << 0) +-#define AES_FLAGS_COHERENT (1 << 1) ++#define AES_FLAGS_HIDDENKEY (1 << 0) + + struct geode_aes_op { + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 97ee870..3a95cc5 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -271,21 +271,25 @@ static int raid1_end_read_request(struct bio *bio, unsigned int bytes_done, int + */ + update_head_pos(mirror, r1_bio); + +- if (uptodate || (conf->raid_disks - conf->mddev->degraded) <= 1) { +- /* +- * Set R1BIO_Uptodate in our master bio, so that +- * we will return a good error code for to the higher +- * levels even if IO on some other mirrored buffer fails. +- * +- * The 'master' represents the composite IO operation to +- * user-side. So if something waits for IO, then it will +- * wait for the 'master' bio. ++ if (uptodate) ++ set_bit(R1BIO_Uptodate, &r1_bio->state); ++ else { ++ /* If all other devices have failed, we want to return ++ * the error upwards rather than fail the last device. ++ * Here we redefine "uptodate" to mean "Don't want to retry" + */ +- if (uptodate) +- set_bit(R1BIO_Uptodate, &r1_bio->state); ++ unsigned long flags; ++ spin_lock_irqsave(&conf->device_lock, flags); ++ if (r1_bio->mddev->degraded == conf->raid_disks || ++ (r1_bio->mddev->degraded == conf->raid_disks-1 && ++ !test_bit(Faulty, &conf->mirrors[mirror].rdev->flags))) ++ uptodate = 1; ++ spin_unlock_irqrestore(&conf->device_lock, flags); ++ } + ++ if (uptodate) + raid_end_bio_io(r1_bio); +- } else { ++ else { + /* + * oops, read error: + */ +@@ -992,13 +996,14 @@ static void error(mddev_t *mddev, mdk_rdev_t *rdev) + unsigned long flags; + spin_lock_irqsave(&conf->device_lock, flags); + mddev->degraded++; ++ set_bit(Faulty, &rdev->flags); + spin_unlock_irqrestore(&conf->device_lock, flags); + /* + * if recovery is running, make sure it aborts. + */ + set_bit(MD_RECOVERY_ERR, &mddev->recovery); +- } +- set_bit(Faulty, &rdev->flags); ++ } else ++ set_bit(Faulty, &rdev->flags); + set_bit(MD_CHANGE_DEVS, &mddev->flags); + printk(KERN_ALERT "raid1: Disk failure on %s, disabling device. \n" + " Operation continuing on %d devices\n", +diff --git a/drivers/message/fusion/mptspi.c b/drivers/message/fusion/mptspi.c +index 85f21b5..2eb5741 100644 +--- a/drivers/message/fusion/mptspi.c ++++ b/drivers/message/fusion/mptspi.c +@@ -726,13 +726,15 @@ static int mptspi_slave_configure(struct scsi_device *sdev) + struct _MPT_SCSI_HOST *hd = + (struct _MPT_SCSI_HOST *)sdev->host->hostdata; + VirtTarget *vtarget = scsi_target(sdev)->hostdata; +- int ret = mptscsih_slave_configure(sdev); ++ int ret; ++ ++ mptspi_initTarget(hd, vtarget, sdev); ++ ++ ret = mptscsih_slave_configure(sdev); + + if (ret) + return ret; + +- mptspi_initTarget(hd, vtarget, sdev); +- + ddvprintk((MYIOC_s_INFO_FMT "id=%d min_period=0x%02x" + " max_offset=0x%02x max_width=%d\n", hd->ioc->name, + sdev->id, spi_min_period(scsi_target(sdev)), +diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig +index a3d46ea..32a3003 100644 +--- a/drivers/net/Kconfig ++++ b/drivers/net/Kconfig +@@ -2929,11 +2929,6 @@ endif #NETDEVICES + config NETPOLL + def_bool NETCONSOLE + +-config NETPOLL_RX +- bool "Netpoll support for trapping incoming packets" +- default n +- depends on NETPOLL +- + config NETPOLL_TRAP + bool "Netpoll traffic trapping" + default n +diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c +index e85f5ec..5006c67 100644 +--- a/drivers/net/bnx2.c ++++ b/drivers/net/bnx2.c +@@ -54,8 +54,8 @@ + + #define DRV_MODULE_NAME "bnx2" + #define PFX DRV_MODULE_NAME ": " +-#define DRV_MODULE_VERSION "1.5.8" +-#define DRV_MODULE_RELDATE "April 24, 2007" ++#define DRV_MODULE_VERSION "1.5.8.1" ++#define DRV_MODULE_RELDATE "May 7, 2007" + + #define RUN_AT(x) (jiffies + (x)) + +@@ -4510,8 +4510,7 @@ bnx2_start_xmit(struct sk_buff *skb, struct net_device *dev) + vlan_tag_flags |= + (TX_BD_FLAGS_VLAN_TAG | (vlan_tx_tag_get(skb) << 16)); + } +- if ((mss = skb_shinfo(skb)->gso_size) && +- (skb->len > (bp->dev->mtu + ETH_HLEN))) { ++ if ((mss = skb_shinfo(skb)->gso_size)) { + u32 tcp_opt_len, ip_tcp_len; + + if (skb_header_cloned(skb) && +@@ -5565,6 +5564,9 @@ bnx2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + case SIOCGMIIREG: { + u32 mii_regval; + ++ if (!netif_running(dev)) ++ return -EAGAIN; ++ + spin_lock_bh(&bp->phy_lock); + err = bnx2_read_phy(bp, data->reg_num & 0x1f, &mii_regval); + spin_unlock_bh(&bp->phy_lock); +@@ -5578,6 +5580,9 @@ bnx2_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + if (!capable(CAP_NET_ADMIN)) + return -EPERM; + ++ if (!netif_running(dev)) ++ return -EAGAIN; ++ + spin_lock_bh(&bp->phy_lock); + err = bnx2_write_phy(bp, data->reg_num & 0x1f, data->val_in); + spin_unlock_bh(&bp->phy_lock); +@@ -6143,6 +6148,7 @@ bnx2_suspend(struct pci_dev *pdev, pm_message_t state) + reset_code = BNX2_DRV_MSG_CODE_SUSPEND_NO_WOL; + bnx2_reset_chip(bp, reset_code); + bnx2_free_skbs(bp); ++ pci_save_state(pdev); + bnx2_set_power_state(bp, pci_choose_state(pdev, state)); + return 0; + } +@@ -6156,6 +6162,7 @@ bnx2_resume(struct pci_dev *pdev) + if (!netif_running(dev)) + return 0; + ++ pci_restore_state(pdev); + bnx2_set_power_state(bp, PCI_D0); + netif_device_attach(dev); + bnx2_init_nic(bp); +diff --git a/drivers/net/sis900.c b/drivers/net/sis900.c +index b2a3b19..ce547af 100644 +--- a/drivers/net/sis900.c ++++ b/drivers/net/sis900.c +@@ -1754,6 +1754,7 @@ static int sis900_rx(struct net_device *net_dev) + sis_priv->rx_ring[entry].cmdsts = RX_BUF_SIZE; + } else { + struct sk_buff * skb; ++ struct sk_buff * rx_skb; + + pci_unmap_single(sis_priv->pci_dev, + sis_priv->rx_ring[entry].bufptr, RX_BUF_SIZE, +@@ -1787,10 +1788,10 @@ static int sis900_rx(struct net_device *net_dev) + } + + /* give the socket buffer to upper layers */ +- skb = sis_priv->rx_skbuff[entry]; +- skb_put(skb, rx_size); +- skb->protocol = eth_type_trans(skb, net_dev); +- netif_rx(skb); ++ rx_skb = sis_priv->rx_skbuff[entry]; ++ skb_put(rx_skb, rx_size); ++ rx_skb->protocol = eth_type_trans(rx_skb, net_dev); ++ netif_rx(rx_skb); + + /* some network statistics */ + if ((rx_status & BCAST) == MCAST) +diff --git a/drivers/net/skge.c b/drivers/net/skge.c +index d476a3c..5ef9023 100644 +--- a/drivers/net/skge.c ++++ b/drivers/net/skge.c +@@ -135,10 +135,13 @@ static void skge_get_regs(struct net_device *dev, struct ethtool_regs *regs, + /* Wake on Lan only supported on Yukon chips with rev 1 or above */ + static u32 wol_supported(const struct skge_hw *hw) + { +- if (hw->chip_id == CHIP_ID_YUKON && hw->chip_rev != 0) +- return WAKE_MAGIC | WAKE_PHY; +- else ++ if (hw->chip_id == CHIP_ID_GENESIS) ++ return 0; ++ ++ if (hw->chip_id == CHIP_ID_YUKON && hw->chip_rev == 0) + return 0; ++ ++ return WAKE_MAGIC | WAKE_PHY; + } + + static u32 pci_wake_enabled(struct pci_dev *dev) +@@ -3583,7 +3586,9 @@ static struct net_device *skge_devinit(struct skge_hw *hw, int port, + skge->duplex = -1; + skge->speed = -1; + skge->advertising = skge_supported_modes(hw); +- skge->wol = pci_wake_enabled(hw->pdev) ? wol_supported(hw) : 0; ++ ++ if (pci_wake_enabled(hw->pdev)) ++ skge->wol = wol_supported(hw) & WAKE_MAGIC; + + hw->dev[port] = dev; + +@@ -3789,6 +3794,9 @@ static int skge_suspend(struct pci_dev *pdev, pm_message_t state) + struct skge_hw *hw = pci_get_drvdata(pdev); + int i, err, wol = 0; + ++ if (!hw) ++ return 0; ++ + err = pci_save_state(pdev); + if (err) + return err; +@@ -3817,6 +3825,9 @@ static int skge_resume(struct pci_dev *pdev) + struct skge_hw *hw = pci_get_drvdata(pdev); + int i, err; + ++ if (!hw) ++ return 0; ++ + err = pci_set_power_state(pdev, PCI_D0); + if (err) + goto out; +@@ -3855,6 +3866,9 @@ static void skge_shutdown(struct pci_dev *pdev) + struct skge_hw *hw = pci_get_drvdata(pdev); + int i, wol = 0; + ++ if (!hw) ++ return; ++ + for (i = 0; i < hw->ports; i++) { + struct net_device *dev = hw->dev[i]; + struct skge_port *skge = netdev_priv(dev); +diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c +index ac36152..b6b444b 100644 +--- a/drivers/net/sky2.c ++++ b/drivers/net/sky2.c +@@ -123,16 +123,13 @@ static const struct pci_device_id sky2_id_table[] = { + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4361) }, /* 88E8050 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4362) }, /* 88E8053 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4363) }, /* 88E8055 */ +-#ifdef broken +- /* This device causes data corruption problems that are not resolved */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4364) }, /* 88E8056 */ +-#endif + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4366) }, /* 88EC036 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4367) }, /* 88EC032 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4368) }, /* 88EC034 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4369) }, /* 88EC042 */ + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436A) }, /* 88E8058 */ +- { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436B) }, /* 88E8071 */ ++// { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436B) }, /* 88E8071 */ + { 0 } + }; + +@@ -3722,6 +3719,7 @@ err_out_free_regions: + pci_release_regions(pdev); + pci_disable_device(pdev); + err_out: ++ pci_set_drvdata(pdev, NULL); + return err; + } + +@@ -3774,6 +3772,9 @@ static int sky2_suspend(struct pci_dev *pdev, pm_message_t state) + struct sky2_hw *hw = pci_get_drvdata(pdev); + int i, wol = 0; + ++ if (!hw) ++ return 0; ++ + del_timer_sync(&hw->idle_timer); + netif_poll_disable(hw->dev[0]); + +@@ -3805,6 +3806,9 @@ static int sky2_resume(struct pci_dev *pdev) + struct sky2_hw *hw = pci_get_drvdata(pdev); + int i, err; + ++ if (!hw) ++ return 0; ++ + err = pci_set_power_state(pdev, PCI_D0); + if (err) + goto out; +@@ -3851,6 +3855,9 @@ static void sky2_shutdown(struct pci_dev *pdev) + struct sky2_hw *hw = pci_get_drvdata(pdev); + int i, wol = 0; + ++ if (!hw) ++ return; ++ + del_timer_sync(&hw->idle_timer); + netif_poll_disable(hw->dev[0]); + +diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c +index c956141..0b89812 100644 +--- a/drivers/net/smc911x.c ++++ b/drivers/net/smc911x.c +@@ -499,7 +499,7 @@ static inline void smc911x_rcv(struct net_device *dev) + SMC_SET_RX_CFG(RX_CFG_RX_END_ALGN4_ | ((2<<8) & RX_CFG_RXDOFF_)); + SMC_PULL_DATA(data, pkt_len+2+3); + +- DBG(SMC_DEBUG_PKTS, "%s: Received packet\n", dev->name,); ++ DBG(SMC_DEBUG_PKTS, "%s: Received packet\n", dev->name); + PRINT_PKT(data, ((pkt_len - 4) <= 64) ? pkt_len - 4 : 64); + dev->last_rx = jiffies; + skb->dev = dev; +diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c +index 256969e..3d20115 100644 +--- a/drivers/net/tg3.c ++++ b/drivers/net/tg3.c +@@ -64,8 +64,8 @@ + + #define DRV_MODULE_NAME "tg3" + #define PFX DRV_MODULE_NAME ": " +-#define DRV_MODULE_VERSION "3.75" +-#define DRV_MODULE_RELDATE "March 23, 2007" ++#define DRV_MODULE_VERSION "3.75.1" ++#define DRV_MODULE_RELDATE "May 7, 2007" + + #define TG3_DEF_MAC_MODE 0 + #define TG3_DEF_RX_MODE 0 +@@ -3895,8 +3895,7 @@ static int tg3_start_xmit(struct sk_buff *skb, struct net_device *dev) + entry = tp->tx_prod; + base_flags = 0; + mss = 0; +- if (skb->len > (tp->dev->mtu + ETH_HLEN) && +- (mss = skb_shinfo(skb)->gso_size) != 0) { ++ if ((mss = skb_shinfo(skb)->gso_size) != 0) { + int tcp_opt_len, ip_tcp_len; + + if (skb_header_cloned(skb) && +@@ -4053,8 +4052,7 @@ static int tg3_start_xmit_dma_bug(struct sk_buff *skb, struct net_device *dev) + if (skb->ip_summed == CHECKSUM_PARTIAL) + base_flags |= TXD_FLAG_TCPUDP_CSUM; + mss = 0; +- if (skb->len > (tp->dev->mtu + ETH_HLEN) && +- (mss = skb_shinfo(skb)->gso_size) != 0) { ++ if ((mss = skb_shinfo(skb)->gso_size) != 0) { + int tcp_opt_len, ip_tcp_len, hdr_len; + + if (skb_header_cloned(skb) && +@@ -5936,7 +5934,7 @@ static int tg3_load_tso_firmware(struct tg3 *tp) + + + /* tp->lock is held. */ +-static void __tg3_set_mac_addr(struct tg3 *tp) ++static void __tg3_set_mac_addr(struct tg3 *tp, int skip_mac_1) + { + u32 addr_high, addr_low; + int i; +@@ -5948,6 +5946,8 @@ static void __tg3_set_mac_addr(struct tg3 *tp) + (tp->dev->dev_addr[4] << 8) | + (tp->dev->dev_addr[5] << 0)); + for (i = 0; i < 4; i++) { ++ if (i == 1 && skip_mac_1) ++ continue; + tw32(MAC_ADDR_0_HIGH + (i * 8), addr_high); + tw32(MAC_ADDR_0_LOW + (i * 8), addr_low); + } +@@ -5974,7 +5974,7 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p) + { + struct tg3 *tp = netdev_priv(dev); + struct sockaddr *addr = p; +- int err = 0; ++ int err = 0, skip_mac_1 = 0; + + if (!is_valid_ether_addr(addr->sa_data)) + return -EINVAL; +@@ -5985,22 +5985,21 @@ static int tg3_set_mac_addr(struct net_device *dev, void *p) + return 0; + + if (tp->tg3_flags & TG3_FLAG_ENABLE_ASF) { +- /* Reset chip so that ASF can re-init any MAC addresses it +- * needs. +- */ +- tg3_netif_stop(tp); +- tg3_full_lock(tp, 1); ++ u32 addr0_high, addr0_low, addr1_high, addr1_low; + +- tg3_halt(tp, RESET_KIND_SHUTDOWN, 1); +- err = tg3_restart_hw(tp, 0); +- if (!err) +- tg3_netif_start(tp); +- tg3_full_unlock(tp); +- } else { +- spin_lock_bh(&tp->lock); +- __tg3_set_mac_addr(tp); +- spin_unlock_bh(&tp->lock); ++ addr0_high = tr32(MAC_ADDR_0_HIGH); ++ addr0_low = tr32(MAC_ADDR_0_LOW); ++ addr1_high = tr32(MAC_ADDR_1_HIGH); ++ addr1_low = tr32(MAC_ADDR_1_LOW); ++ ++ /* Skip MAC addr 1 if ASF is using it. */ ++ if ((addr0_high != addr1_high || addr0_low != addr1_low) && ++ !(addr1_high == 0 && addr1_low == 0)) ++ skip_mac_1 = 1; + } ++ spin_lock_bh(&tp->lock); ++ __tg3_set_mac_addr(tp, skip_mac_1); ++ spin_unlock_bh(&tp->lock); + + return err; + } +@@ -6317,7 +6316,7 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy) + tp->rx_jumbo_ptr); + + /* Initialize MAC address and backoff seed. */ +- __tg3_set_mac_addr(tp); ++ __tg3_set_mac_addr(tp, 0); + + /* MTU + ethernet header + FCS + optional VLAN tag */ + tw32(MAC_RX_MTU_SIZE, tp->dev->mtu + ETH_HLEN + 8); +@@ -6348,8 +6347,7 @@ static int tg3_reset_hw(struct tg3 *tp, int reset_phy) + tp->pci_chip_rev_id != CHIPREV_ID_5705_A0) || + (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5750)) { + if (tp->tg3_flags2 & TG3_FLG2_TSO_CAPABLE && +- (tp->pci_chip_rev_id == CHIPREV_ID_5705_A1 || +- tp->pci_chip_rev_id == CHIPREV_ID_5705_A2)) { ++ GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5705) { + rdmac_mode |= RDMAC_MODE_FIFO_SIZE_128; + } else if (!(tr32(TG3PCI_PCISTATE) & PCISTATE_BUS_SPEED_HIGH) && + !(tp->tg3_flags2 & TG3_FLG2_IS_5788)) { +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 65d6f23..5af9125 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1737,18 +1737,20 @@ DECLARE_PCI_FIXUP_RESUME(PCI_VENDOR_ID_NVIDIA, PCI_DEVICE_ID_NVIDIA_CK804_PCIE, + quirk_nvidia_ck804_pcie_aer_ext_cap); + + #ifdef CONFIG_PCI_MSI +-/* The Serverworks PCI-X chipset does not support MSI. We cannot easily rely +- * on setting PCI_BUS_FLAGS_NO_MSI in its bus flags because there are actually +- * some other busses controlled by the chipset even if Linux is not aware of it. +- * Instead of setting the flag on all busses in the machine, simply disable MSI +- * globally. ++/* Some chipsets do not support MSI. We cannot easily rely on setting ++ * PCI_BUS_FLAGS_NO_MSI in its bus flags because there are actually ++ * some other busses controlled by the chipset even if Linux is not ++ * aware of it. Instead of setting the flag on all busses in the ++ * machine, simply disable MSI globally. + */ +-static void __init quirk_svw_msi(struct pci_dev *dev) ++static void __init quirk_disable_all_msi(struct pci_dev *dev) + { + pci_no_msi(); + printk(KERN_WARNING "PCI: MSI quirk detected. MSI deactivated.\n"); + } +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_GCNB_LE, quirk_svw_msi); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_GCNB_LE, quirk_disable_all_msi); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS400_200, quirk_disable_all_msi); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RS480, quirk_disable_all_msi); + + /* Disable MSI on chipsets that are known to not support it */ + static void __devinit quirk_disable_msi(struct pci_dev *dev) +diff --git a/drivers/serial/sunhv.c b/drivers/serial/sunhv.c +index 40d4856..c3a6bd2 100644 +--- a/drivers/serial/sunhv.c ++++ b/drivers/serial/sunhv.c +@@ -493,6 +493,10 @@ static struct of_device_id hv_match[] = { + .name = "console", + .compatible = "qcn", + }, ++ { ++ .name = "console", ++ .compatible = "SUNW,sun4v-console", ++ }, + {}, + }; + MODULE_DEVICE_TABLE(of, hv_match); +diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c +index 3dfa3e4..3257d94 100644 +--- a/drivers/usb/atm/cxacru.c ++++ b/drivers/usb/atm/cxacru.c +@@ -146,6 +146,12 @@ enum cxacru_info_idx { + CXINF_MAX = 0x1c, + }; + ++enum poll_state { ++ CX_INIT, ++ CX_POLLING, ++ CX_ABORT ++}; ++ + struct cxacru_modem_type { + u32 pll_f_clk; + u32 pll_b_clk; +@@ -159,6 +165,8 @@ struct cxacru_data { + + int line_status; + struct delayed_work poll_work; ++ struct mutex poll_state_serialize; ++ enum poll_state poll_state; + + /* contol handles */ + struct mutex cm_serialize; +@@ -356,7 +364,7 @@ static int cxacru_atm_start(struct usbatm_data *usbatm_instance, + /* + struct atm_dev *atm_dev = usbatm_instance->atm_dev; + */ +- int ret; ++ int ret, start_polling = 1; + + dbg("cxacru_atm_start"); + +@@ -376,7 +384,15 @@ static int cxacru_atm_start(struct usbatm_data *usbatm_instance, + } + + /* Start status polling */ +- cxacru_poll_status(&instance->poll_work.work); ++ mutex_lock(&instance->poll_state_serialize); ++ if (instance->poll_state == CX_INIT) ++ instance->poll_state = CX_POLLING; ++ else /* poll_state == CX_ABORT */ ++ start_polling = 0; ++ mutex_unlock(&instance->poll_state_serialize); ++ ++ if (start_polling) ++ cxacru_poll_status(&instance->poll_work.work); + return 0; + } + +@@ -685,6 +701,9 @@ static int cxacru_bind(struct usbatm_data *usbatm_instance, + instance->usbatm = usbatm_instance; + instance->modem_type = (struct cxacru_modem_type *) id->driver_info; + ++ mutex_init(&instance->poll_state_serialize); ++ instance->poll_state = CX_INIT; ++ + instance->rcv_buf = (u8 *) __get_free_page(GFP_KERNEL); + if (!instance->rcv_buf) { + dbg("cxacru_bind: no memory for rcv_buf"); +@@ -744,6 +763,7 @@ static void cxacru_unbind(struct usbatm_data *usbatm_instance, + struct usb_interface *intf) + { + struct cxacru_data *instance = usbatm_instance->driver_data; ++ int stop_polling = 1; + + dbg("cxacru_unbind entered"); + +@@ -752,8 +772,20 @@ static void cxacru_unbind(struct usbatm_data *usbatm_instance, + return; + } + +- while (!cancel_delayed_work(&instance->poll_work)) +- flush_scheduled_work(); ++ mutex_lock(&instance->poll_state_serialize); ++ if (instance->poll_state != CX_POLLING) { ++ /* Polling hasn't started yet and with ++ * the mutex locked it can be prevented ++ * from starting. ++ */ ++ instance->poll_state = CX_ABORT; ++ stop_polling = 0; ++ } ++ mutex_unlock(&instance->poll_state_serialize); ++ ++ if (stop_polling) ++ while (!cancel_delayed_work(&instance->poll_work)) ++ flush_scheduled_work(); + + usb_kill_urb(instance->snd_urb); + usb_kill_urb(instance->rcv_urb); +diff --git a/drivers/usb/input/hiddev.c b/drivers/usb/input/hiddev.c +index a8b3d66..488d61b 100644 +--- a/drivers/usb/input/hiddev.c ++++ b/drivers/usb/input/hiddev.c +@@ -51,6 +51,7 @@ struct hiddev { + wait_queue_head_t wait; + struct hid_device *hid; + struct list_head list; ++ spinlock_t list_lock; + }; + + struct hiddev_list { +@@ -161,7 +162,9 @@ static void hiddev_send_event(struct hid_device *hid, + { + struct hiddev *hiddev = hid->hiddev; + struct hiddev_list *list; ++ unsigned long flags; + ++ spin_lock_irqsave(&hiddev->list_lock, flags); + list_for_each_entry(list, &hiddev->list, node) { + if (uref->field_index != HID_FIELD_INDEX_NONE || + (list->flags & HIDDEV_FLAG_REPORT) != 0) { +@@ -171,6 +174,7 @@ static void hiddev_send_event(struct hid_device *hid, + kill_fasync(&list->fasync, SIGIO, POLL_IN); + } + } ++ spin_unlock_irqrestore(&hiddev->list_lock, flags); + + wake_up_interruptible(&hiddev->wait); + } +@@ -235,9 +239,13 @@ static int hiddev_fasync(int fd, struct file *file, int on) + static int hiddev_release(struct inode * inode, struct file * file) + { + struct hiddev_list *list = file->private_data; ++ unsigned long flags; + + hiddev_fasync(-1, file, 0); ++ ++ spin_lock_irqsave(&list->hiddev->list_lock, flags); + list_del(&list->node); ++ spin_unlock_irqrestore(&list->hiddev->list_lock, flags); + + if (!--list->hiddev->open) { + if (list->hiddev->exist) +@@ -257,6 +265,7 @@ static int hiddev_release(struct inode * inode, struct file * file) + static int hiddev_open(struct inode *inode, struct file *file) + { + struct hiddev_list *list; ++ unsigned long flags; + + int i = iminor(inode) - HIDDEV_MINOR_BASE; + +@@ -267,7 +276,11 @@ static int hiddev_open(struct inode *inode, struct file *file) + return -ENOMEM; + + list->hiddev = hiddev_table[i]; ++ ++ spin_lock_irqsave(&list->hiddev->list_lock, flags); + list_add_tail(&list->node, &hiddev_table[i]->list); ++ spin_unlock_irqrestore(&list->hiddev->list_lock, flags); ++ + file->private_data = list; + + if (!list->hiddev->open++) +@@ -773,6 +786,7 @@ int hiddev_connect(struct hid_device *hid) + + init_waitqueue_head(&hiddev->wait); + INIT_LIST_HEAD(&hiddev->list); ++ spin_lock_init(&hiddev->list_lock); + hiddev->hid = hid; + hiddev->exist = 1; + +diff --git a/fs/fat/dir.c b/fs/fat/dir.c +index c16af24..ccf161d 100644 +--- a/fs/fat/dir.c ++++ b/fs/fat/dir.c +@@ -422,7 +422,7 @@ EODir: + EXPORT_SYMBOL_GPL(fat_search_long); + + struct fat_ioctl_filldir_callback { +- struct dirent __user *dirent; ++ void __user *dirent; + int result; + /* for dir ioctl */ + const char *longname; +@@ -647,62 +647,85 @@ static int fat_readdir(struct file *filp, void *dirent, filldir_t filldir) + return __fat_readdir(inode, filp, dirent, filldir, 0, 0); + } + +-static int fat_ioctl_filldir(void *__buf, const char *name, int name_len, +- loff_t offset, u64 ino, unsigned int d_type) ++#define FAT_IOCTL_FILLDIR_FUNC(func, dirent_type) \ ++static int func(void *__buf, const char *name, int name_len, \ ++ loff_t offset, u64 ino, unsigned int d_type) \ ++{ \ ++ struct fat_ioctl_filldir_callback *buf = __buf; \ ++ struct dirent_type __user *d1 = buf->dirent; \ ++ struct dirent_type __user *d2 = d1 + 1; \ ++ \ ++ if (buf->result) \ ++ return -EINVAL; \ ++ buf->result++; \ ++ \ ++ if (name != NULL) { \ ++ /* dirent has only short name */ \ ++ if (name_len >= sizeof(d1->d_name)) \ ++ name_len = sizeof(d1->d_name) - 1; \ ++ \ ++ if (put_user(0, d2->d_name) || \ ++ put_user(0, &d2->d_reclen) || \ ++ copy_to_user(d1->d_name, name, name_len) || \ ++ put_user(0, d1->d_name + name_len) || \ ++ put_user(name_len, &d1->d_reclen)) \ ++ goto efault; \ ++ } else { \ ++ /* dirent has short and long name */ \ ++ const char *longname = buf->longname; \ ++ int long_len = buf->long_len; \ ++ const char *shortname = buf->shortname; \ ++ int short_len = buf->short_len; \ ++ \ ++ if (long_len >= sizeof(d1->d_name)) \ ++ long_len = sizeof(d1->d_name) - 1; \ ++ if (short_len >= sizeof(d1->d_name)) \ ++ short_len = sizeof(d1->d_name) - 1; \ ++ \ ++ if (copy_to_user(d2->d_name, longname, long_len) || \ ++ put_user(0, d2->d_name + long_len) || \ ++ put_user(long_len, &d2->d_reclen) || \ ++ put_user(ino, &d2->d_ino) || \ ++ put_user(offset, &d2->d_off) || \ ++ copy_to_user(d1->d_name, shortname, short_len) || \ ++ put_user(0, d1->d_name + short_len) || \ ++ put_user(short_len, &d1->d_reclen)) \ ++ goto efault; \ ++ } \ ++ return 0; \ ++efault: \ ++ buf->result = -EFAULT; \ ++ return -EFAULT; \ ++} ++ ++FAT_IOCTL_FILLDIR_FUNC(fat_ioctl_filldir, dirent) ++ ++static int fat_ioctl_readdir(struct inode *inode, struct file *filp, ++ void __user *dirent, filldir_t filldir, ++ int short_only, int both) + { +- struct fat_ioctl_filldir_callback *buf = __buf; +- struct dirent __user *d1 = buf->dirent; +- struct dirent __user *d2 = d1 + 1; +- +- if (buf->result) +- return -EINVAL; +- buf->result++; +- +- if (name != NULL) { +- /* dirent has only short name */ +- if (name_len >= sizeof(d1->d_name)) +- name_len = sizeof(d1->d_name) - 1; +- +- if (put_user(0, d2->d_name) || +- put_user(0, &d2->d_reclen) || +- copy_to_user(d1->d_name, name, name_len) || +- put_user(0, d1->d_name + name_len) || +- put_user(name_len, &d1->d_reclen)) +- goto efault; +- } else { +- /* dirent has short and long name */ +- const char *longname = buf->longname; +- int long_len = buf->long_len; +- const char *shortname = buf->shortname; +- int short_len = buf->short_len; +- +- if (long_len >= sizeof(d1->d_name)) +- long_len = sizeof(d1->d_name) - 1; +- if (short_len >= sizeof(d1->d_name)) +- short_len = sizeof(d1->d_name) - 1; +- +- if (copy_to_user(d2->d_name, longname, long_len) || +- put_user(0, d2->d_name + long_len) || +- put_user(long_len, &d2->d_reclen) || +- put_user(ino, &d2->d_ino) || +- put_user(offset, &d2->d_off) || +- copy_to_user(d1->d_name, shortname, short_len) || +- put_user(0, d1->d_name + short_len) || +- put_user(short_len, &d1->d_reclen)) +- goto efault; ++ struct fat_ioctl_filldir_callback buf; ++ int ret; ++ ++ buf.dirent = dirent; ++ buf.result = 0; ++ mutex_lock(&inode->i_mutex); ++ ret = -ENOENT; ++ if (!IS_DEADDIR(inode)) { ++ ret = __fat_readdir(inode, filp, &buf, filldir, ++ short_only, both); + } +- return 0; +-efault: +- buf->result = -EFAULT; +- return -EFAULT; ++ mutex_unlock(&inode->i_mutex); ++ if (ret >= 0) ++ ret = buf.result; ++ return ret; + } + +-static int fat_dir_ioctl(struct inode * inode, struct file * filp, +- unsigned int cmd, unsigned long arg) ++static int fat_dir_ioctl(struct inode *inode, struct file *filp, ++ unsigned int cmd, unsigned long arg) + { +- struct fat_ioctl_filldir_callback buf; +- struct dirent __user *d1; +- int ret, short_only, both; ++ struct dirent __user *d1 = (struct dirent __user *)arg; ++ int short_only, both; + + switch (cmd) { + case VFAT_IOCTL_READDIR_SHORT: +@@ -717,7 +740,6 @@ static int fat_dir_ioctl(struct inode * inode, struct file * filp, + return fat_generic_ioctl(inode, filp, cmd, arg); + } + +- d1 = (struct dirent __user *)arg; + if (!access_ok(VERIFY_WRITE, d1, sizeof(struct dirent[2]))) + return -EFAULT; + /* +@@ -728,69 +750,48 @@ static int fat_dir_ioctl(struct inode * inode, struct file * filp, + if (put_user(0, &d1->d_reclen)) + return -EFAULT; + +- buf.dirent = d1; +- buf.result = 0; +- mutex_lock(&inode->i_mutex); +- ret = -ENOENT; +- if (!IS_DEADDIR(inode)) { +- ret = __fat_readdir(inode, filp, &buf, fat_ioctl_filldir, +- short_only, both); +- } +- mutex_unlock(&inode->i_mutex); +- if (ret >= 0) +- ret = buf.result; +- return ret; ++ return fat_ioctl_readdir(inode, filp, d1, fat_ioctl_filldir, ++ short_only, both); + } + + #ifdef CONFIG_COMPAT + #define VFAT_IOCTL_READDIR_BOTH32 _IOR('r', 1, struct compat_dirent[2]) + #define VFAT_IOCTL_READDIR_SHORT32 _IOR('r', 2, struct compat_dirent[2]) + +-static long fat_compat_put_dirent32(struct dirent *d, +- struct compat_dirent __user *d32) +-{ +- if (!access_ok(VERIFY_WRITE, d32, sizeof(struct compat_dirent))) +- return -EFAULT; +- +- __put_user(d->d_ino, &d32->d_ino); +- __put_user(d->d_off, &d32->d_off); +- __put_user(d->d_reclen, &d32->d_reclen); +- if (__copy_to_user(d32->d_name, d->d_name, d->d_reclen)) +- return -EFAULT; ++FAT_IOCTL_FILLDIR_FUNC(fat_compat_ioctl_filldir, compat_dirent) + +- return 0; +-} +- +-static long fat_compat_dir_ioctl(struct file *file, unsigned cmd, ++static long fat_compat_dir_ioctl(struct file *filp, unsigned cmd, + unsigned long arg) + { +- struct compat_dirent __user *p = compat_ptr(arg); +- int ret; +- mm_segment_t oldfs = get_fs(); +- struct dirent d[2]; ++ struct inode *inode = filp->f_path.dentry->d_inode; ++ struct compat_dirent __user *d1 = compat_ptr(arg); ++ int short_only, both; + + switch (cmd) { +- case VFAT_IOCTL_READDIR_BOTH32: +- cmd = VFAT_IOCTL_READDIR_BOTH; +- break; + case VFAT_IOCTL_READDIR_SHORT32: +- cmd = VFAT_IOCTL_READDIR_SHORT; ++ short_only = 1; ++ both = 0; ++ break; ++ case VFAT_IOCTL_READDIR_BOTH32: ++ short_only = 0; ++ both = 1; + break; + default: + return -ENOIOCTLCMD; + } + +- set_fs(KERNEL_DS); +- lock_kernel(); +- ret = fat_dir_ioctl(file->f_path.dentry->d_inode, file, +- cmd, (unsigned long) &d); +- unlock_kernel(); +- set_fs(oldfs); +- if (ret >= 0) { +- ret |= fat_compat_put_dirent32(&d[0], p); +- ret |= fat_compat_put_dirent32(&d[1], p + 1); +- } +- return ret; ++ if (!access_ok(VERIFY_WRITE, d1, sizeof(struct compat_dirent[2]))) ++ return -EFAULT; ++ /* ++ * Yes, we don't need this put_user() absolutely. However old ++ * code didn't return the right value. So, app use this value, ++ * in order to check whether it is EOF. ++ */ ++ if (put_user(0, &d1->d_reclen)) ++ return -EFAULT; ++ ++ return fat_ioctl_readdir(inode, filp, d1, fat_compat_ioctl_filldir, ++ short_only, both); + } + #endif /* CONFIG_COMPAT */ + +diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c +index 5065baa..3760d02 100644 +--- a/fs/jfs/jfs_logmgr.c ++++ b/fs/jfs/jfs_logmgr.c +@@ -2354,12 +2354,13 @@ int jfsIOWait(void *arg) + lbmStartIO(bp); + spin_lock_irq(&log_redrive_lock); + } +- spin_unlock_irq(&log_redrive_lock); + + if (freezing(current)) { ++ spin_unlock_irq(&log_redrive_lock); + refrigerator(); + } else { + set_current_state(TASK_INTERRUPTIBLE); ++ spin_unlock_irq(&log_redrive_lock); + schedule(); + current->state = TASK_RUNNING; + } +diff --git a/fs/nfsd/export.c b/fs/nfsd/export.c +index 6f24768..79bd03b 100644 +--- a/fs/nfsd/export.c ++++ b/fs/nfsd/export.c +@@ -469,6 +469,13 @@ static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen) + nd.dentry = NULL; + exp.ex_path = NULL; + ++ /* fs locations */ ++ exp.ex_fslocs.locations = NULL; ++ exp.ex_fslocs.locations_count = 0; ++ exp.ex_fslocs.migrated = 0; ++ ++ exp.ex_uuid = NULL; ++ + if (mesg[mlen-1] != '\n') + return -EINVAL; + mesg[mlen-1] = 0; +@@ -509,13 +516,6 @@ static int svc_export_parse(struct cache_detail *cd, char *mesg, int mlen) + if (exp.h.expiry_time == 0) + goto out; + +- /* fs locations */ +- exp.ex_fslocs.locations = NULL; +- exp.ex_fslocs.locations_count = 0; +- exp.ex_fslocs.migrated = 0; +- +- exp.ex_uuid = NULL; +- + /* flags */ + err = get_int(&mesg, &an_int); + if (err == -ENOENT) +diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c +index c8178b7..2cac562 100644 +--- a/fs/reiserfs/xattr.c ++++ b/fs/reiserfs/xattr.c +@@ -68,7 +68,7 @@ static struct dentry *get_xa_root(struct super_block *sb, int flags) + if (!privroot) + return ERR_PTR(-ENODATA); + +- mutex_lock(&privroot->d_inode->i_mutex); ++ mutex_lock_nested(&privroot->d_inode->i_mutex, I_MUTEX_XATTR); + if (REISERFS_SB(sb)->xattr_root) { + xaroot = dget(REISERFS_SB(sb)->xattr_root); + goto out; +diff --git a/fs/udf/namei.c b/fs/udf/namei.c +index fe361cd..b254375 100644 +--- a/fs/udf/namei.c ++++ b/fs/udf/namei.c +@@ -878,7 +878,7 @@ static int udf_rmdir(struct inode * dir, struct dentry * dentry) + inode->i_nlink); + clear_nlink(inode); + inode->i_size = 0; +- inode_dec_link_count(inode); ++ inode_dec_link_count(dir); + inode->i_ctime = dir->i_ctime = dir->i_mtime = current_fs_time(dir->i_sb); + mark_inode_dirty(dir); + +diff --git a/include/asm-arm/arch-iop13xx/iop13xx.h b/include/asm-arm/arch-iop13xx/iop13xx.h +index d26b755..74d7498 100644 +--- a/include/asm-arm/arch-iop13xx/iop13xx.h ++++ b/include/asm-arm/arch-iop13xx/iop13xx.h +@@ -27,19 +27,24 @@ static inline int iop13xx_cpu_id(void) + #define IOP13XX_PCI_OFFSET IOP13XX_MAX_RAM_SIZE + + /* PCI MAP +- * 0x0000.0000 - 0x8000.0000 1:1 mapping with Physical RAM +- * 0x8000.0000 - 0x8800.0000 PCIX/PCIE memory window (128MB) +-*/ ++ * bus range cpu phys cpu virt note ++ * 0x0000.0000 + 2GB (n/a) (n/a) inbound, 1:1 mapping with Physical RAM ++ * 0x8000.0000 + 928M 0x1.8000.0000 (ioremap) PCIX outbound memory window ++ * 0x8000.0000 + 928M 0x2.8000.0000 (ioremap) PCIE outbound memory window ++ * ++ * IO MAP ++ * 0x1000 + 64K 0x0.fffb.1000 0xfec6.1000 PCIX outbound i/o window ++ * 0x1000 + 64K 0x0.fffd.1000 0xfed7.1000 PCIE outbound i/o window ++ */ + #define IOP13XX_PCIX_IO_WINDOW_SIZE 0x10000UL + #define IOP13XX_PCIX_LOWER_IO_PA 0xfffb0000UL + #define IOP13XX_PCIX_LOWER_IO_VA 0xfec60000UL +-#define IOP13XX_PCIX_LOWER_IO_BA 0x0fff0000UL ++#define IOP13XX_PCIX_LOWER_IO_BA 0x0UL /* OIOTVR */ ++#define IOP13XX_PCIX_IO_BUS_OFFSET 0x1000UL + #define IOP13XX_PCIX_UPPER_IO_PA (IOP13XX_PCIX_LOWER_IO_PA +\ + IOP13XX_PCIX_IO_WINDOW_SIZE - 1) + #define IOP13XX_PCIX_UPPER_IO_VA (IOP13XX_PCIX_LOWER_IO_VA +\ + IOP13XX_PCIX_IO_WINDOW_SIZE - 1) +-#define IOP13XX_PCIX_IO_OFFSET (IOP13XX_PCIX_LOWER_IO_VA -\ +- IOP13XX_PCIX_LOWER_IO_BA) + #define IOP13XX_PCIX_IO_PHYS_TO_VIRT(addr) (u32) ((u32) addr -\ + (IOP13XX_PCIX_LOWER_IO_PA\ + - IOP13XX_PCIX_LOWER_IO_VA)) +@@ -65,15 +70,14 @@ static inline int iop13xx_cpu_id(void) + #define IOP13XX_PCIE_IO_WINDOW_SIZE 0x10000UL + #define IOP13XX_PCIE_LOWER_IO_PA 0xfffd0000UL + #define IOP13XX_PCIE_LOWER_IO_VA 0xfed70000UL +-#define IOP13XX_PCIE_LOWER_IO_BA 0x0fff0000UL ++#define IOP13XX_PCIE_LOWER_IO_BA 0x0UL /* OIOTVR */ ++#define IOP13XX_PCIE_IO_BUS_OFFSET 0x1000UL + #define IOP13XX_PCIE_UPPER_IO_PA (IOP13XX_PCIE_LOWER_IO_PA +\ + IOP13XX_PCIE_IO_WINDOW_SIZE - 1) + #define IOP13XX_PCIE_UPPER_IO_VA (IOP13XX_PCIE_LOWER_IO_VA +\ + IOP13XX_PCIE_IO_WINDOW_SIZE - 1) + #define IOP13XX_PCIE_UPPER_IO_BA (IOP13XX_PCIE_LOWER_IO_BA +\ + IOP13XX_PCIE_IO_WINDOW_SIZE - 1) +-#define IOP13XX_PCIE_IO_OFFSET (IOP13XX_PCIE_LOWER_IO_VA -\ +- IOP13XX_PCIE_LOWER_IO_BA) + #define IOP13XX_PCIE_IO_PHYS_TO_VIRT(addr) (u32) ((u32) addr -\ + (IOP13XX_PCIE_LOWER_IO_PA\ + - IOP13XX_PCIE_LOWER_IO_VA)) +diff --git a/include/asm-sparc64/openprom.h b/include/asm-sparc64/openprom.h +index e01b805..26ec046 100644 +--- a/include/asm-sparc64/openprom.h ++++ b/include/asm-sparc64/openprom.h +@@ -177,7 +177,7 @@ struct linux_nodeops { + /* More fun PROM structures for device probing. */ + #define PROMREG_MAX 24 + #define PROMVADDR_MAX 16 +-#define PROMINTR_MAX 15 ++#define PROMINTR_MAX 32 + + struct linux_prom_registers { + unsigned which_io; /* hi part of physical address */ +diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h +index daa4940..bf92c26 100644 +--- a/include/linux/clocksource.h ++++ b/include/linux/clocksource.h +@@ -48,6 +48,7 @@ struct clocksource; + * @shift: cycle to nanosecond divisor (power of two) + * @flags: flags describing special properties + * @vread: vsyscall based read ++ * @resume: resume function for the clocksource, if necessary + * @cycle_interval: Used internally by timekeeping core, please ignore. + * @xtime_interval: Used internally by timekeeping core, please ignore. + */ +@@ -61,6 +62,7 @@ struct clocksource { + u32 shift; + unsigned long flags; + cycle_t (*vread)(void); ++ void (*resume)(void); + + /* timekeeping specific data, ignore */ + cycle_t cycle_last, cycle_interval; +@@ -198,6 +200,7 @@ static inline void clocksource_calculate_interval(struct clocksource *c, + extern int clocksource_register(struct clocksource*); + extern struct clocksource* clocksource_get_next(void); + extern void clocksource_change_rating(struct clocksource *cs, int rating); ++extern void clocksource_resume(void); + + #ifdef CONFIG_GENERIC_TIME_VSYSCALL + extern void update_vsyscall(struct timespec *ts, struct clocksource *c); +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 1a52854..b1b0f68 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -647,8 +647,10 @@ static inline void netif_start_queue(struct net_device *dev) + static inline void netif_wake_queue(struct net_device *dev) + { + #ifdef CONFIG_NETPOLL_TRAP +- if (netpoll_trap()) ++ if (netpoll_trap()) { ++ clear_bit(__LINK_STATE_XOFF, &dev->state); + return; ++ } + #endif + if (test_and_clear_bit(__LINK_STATE_XOFF, &dev->state)) + __netif_schedule(dev); +@@ -656,10 +658,6 @@ static inline void netif_wake_queue(struct net_device *dev) + + static inline void netif_stop_queue(struct net_device *dev) + { +-#ifdef CONFIG_NETPOLL_TRAP +- if (netpoll_trap()) +- return; +-#endif + set_bit(__LINK_STATE_XOFF, &dev->state); + } + +diff --git a/include/linux/netfilter/nf_conntrack_proto_gre.h b/include/linux/netfilter/nf_conntrack_proto_gre.h +index 4e6bbce..535e421 100644 +--- a/include/linux/netfilter/nf_conntrack_proto_gre.h ++++ b/include/linux/netfilter/nf_conntrack_proto_gre.h +@@ -87,24 +87,6 @@ int nf_ct_gre_keymap_add(struct nf_conn *ct, enum ip_conntrack_dir dir, + /* delete keymap entries */ + void nf_ct_gre_keymap_destroy(struct nf_conn *ct); + +-/* get pointer to gre key, if present */ +-static inline __be32 *gre_key(struct gre_hdr *greh) +-{ +- if (!greh->key) +- return NULL; +- if (greh->csum || greh->routing) +- return (__be32 *)(greh+sizeof(*greh)+4); +- return (__be32 *)(greh+sizeof(*greh)); +-} +- +-/* get pointer ot gre csum, if present */ +-static inline __sum16 *gre_csum(struct gre_hdr *greh) +-{ +- if (!greh->csum) +- return NULL; +- return (__sum16 *)(greh+sizeof(*greh)); +-} +- + extern void nf_ct_gre_keymap_flush(void); + extern void nf_nat_need_gre(void); + +diff --git a/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h b/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h +index e371e0f..d0f36f5 100644 +--- a/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h ++++ b/include/linux/netfilter_ipv4/ip_conntrack_proto_gre.h +@@ -90,25 +90,6 @@ int ip_ct_gre_keymap_add(struct ip_conntrack *ct, + /* delete keymap entries */ + void ip_ct_gre_keymap_destroy(struct ip_conntrack *ct); + +- +-/* get pointer to gre key, if present */ +-static inline __be32 *gre_key(struct gre_hdr *greh) +-{ +- if (!greh->key) +- return NULL; +- if (greh->csum || greh->routing) +- return (__be32 *) (greh+sizeof(*greh)+4); +- return (__be32 *) (greh+sizeof(*greh)); +-} +- +-/* get pointer ot gre csum, if present */ +-static inline __sum16 *gre_csum(struct gre_hdr *greh) +-{ +- if (!greh->csum) +- return NULL; +- return (__sum16 *) (greh+sizeof(*greh)); +-} +- + #endif /* __KERNEL__ */ + + #endif /* _CONNTRACK_PROTO_GRE_H */ +diff --git a/kernel/cpuset.c b/kernel/cpuset.c +index f382b0f..9e45dd1 100644 +--- a/kernel/cpuset.c ++++ b/kernel/cpuset.c +@@ -1751,12 +1751,7 @@ static ssize_t cpuset_tasks_read(struct file *file, char __user *buf, + { + struct ctr_struct *ctr = file->private_data; + +- if (*ppos + nbytes > ctr->bufsz) +- nbytes = ctr->bufsz - *ppos; +- if (copy_to_user(buf, ctr->buf + *ppos, nbytes)) +- return -EFAULT; +- *ppos += nbytes; +- return nbytes; ++ return simple_read_from_buffer(buf, nbytes, ppos, ctr->buf, ctr->bufsz); + } + + static int cpuset_tasks_release(struct inode *unused_inode, struct file *file) +diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c +index fe5c7db..5baee91 100644 +--- a/kernel/time/clocksource.c ++++ b/kernel/time/clocksource.c +@@ -74,6 +74,8 @@ static struct clocksource *watchdog; + static struct timer_list watchdog_timer; + static DEFINE_SPINLOCK(watchdog_lock); + static cycle_t watchdog_last; ++static int watchdog_resumed; ++ + /* + * Interval: 0.5sec Treshold: 0.0625s + */ +@@ -98,15 +100,26 @@ static void clocksource_watchdog(unsigned long data) + struct clocksource *cs, *tmp; + cycle_t csnow, wdnow; + int64_t wd_nsec, cs_nsec; ++ int resumed; + + spin_lock(&watchdog_lock); + ++ resumed = watchdog_resumed; ++ if (unlikely(resumed)) ++ watchdog_resumed = 0; ++ + wdnow = watchdog->read(); + wd_nsec = cyc2ns(watchdog, (wdnow - watchdog_last) & watchdog->mask); + watchdog_last = wdnow; + + list_for_each_entry_safe(cs, tmp, &watchdog_list, wd_list) { + csnow = cs->read(); ++ ++ if (unlikely(resumed)) { ++ cs->wd_last = csnow; ++ continue; ++ } ++ + /* Initialized ? */ + if (!(cs->flags & CLOCK_SOURCE_WATCHDOG)) { + if ((cs->flags & CLOCK_SOURCE_IS_CONTINUOUS) && +@@ -136,6 +149,13 @@ static void clocksource_watchdog(unsigned long data) + } + spin_unlock(&watchdog_lock); + } ++static void clocksource_resume_watchdog(void) ++{ ++ spin_lock(&watchdog_lock); ++ watchdog_resumed = 1; ++ spin_unlock(&watchdog_lock); ++} ++ + static void clocksource_check_watchdog(struct clocksource *cs) + { + struct clocksource *cse; +@@ -182,9 +202,34 @@ static void clocksource_check_watchdog(struct clocksource *cs) + if (cs->flags & CLOCK_SOURCE_IS_CONTINUOUS) + cs->flags |= CLOCK_SOURCE_VALID_FOR_HRES; + } ++ ++static inline void clocksource_resume_watchdog(void) { } + #endif + + /** ++ * clocksource_resume - resume the clocksource(s) ++ */ ++void clocksource_resume(void) ++{ ++ struct list_head *tmp; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&clocksource_lock, flags); ++ ++ list_for_each(tmp, &clocksource_list) { ++ struct clocksource *cs; ++ ++ cs = list_entry(tmp, struct clocksource, list); ++ if (cs->resume) ++ cs->resume(); ++ } ++ ++ clocksource_resume_watchdog(); ++ ++ spin_unlock_irqrestore(&clocksource_lock, flags); ++} ++ ++/** + * clocksource_get_next - Returns the selected clocksource + * + */ +diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c +index bfda3f7..a96ec9a 100644 +--- a/kernel/time/tick-common.c ++++ b/kernel/time/tick-common.c +@@ -31,7 +31,7 @@ DEFINE_PER_CPU(struct tick_device, tick_cpu_device); + */ + ktime_t tick_next_period; + ktime_t tick_period; +-static int tick_do_timer_cpu = -1; ++int tick_do_timer_cpu __read_mostly = -1; + DEFINE_SPINLOCK(tick_device_lock); + + /* +@@ -295,6 +295,12 @@ static void tick_shutdown(unsigned int *cpup) + clockevents_exchange_device(dev, NULL); + td->evtdev = NULL; + } ++ /* Transfer the do_timer job away from this cpu */ ++ if (*cpup == tick_do_timer_cpu) { ++ int cpu = first_cpu(cpu_online_map); ++ ++ tick_do_timer_cpu = (cpu != NR_CPUS) ? cpu : -1; ++ } + spin_unlock_irqrestore(&tick_device_lock, flags); + } + +diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h +index c9d203b..bb13f27 100644 +--- a/kernel/time/tick-internal.h ++++ b/kernel/time/tick-internal.h +@@ -5,6 +5,7 @@ DECLARE_PER_CPU(struct tick_device, tick_cpu_device); + extern spinlock_t tick_device_lock; + extern ktime_t tick_next_period; + extern ktime_t tick_period; ++extern int tick_do_timer_cpu __read_mostly; + + extern void tick_setup_periodic(struct clock_event_device *dev, int broadcast); + extern void tick_handle_periodic(struct clock_event_device *dev); +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index 51556b9..f4fc867 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -221,6 +221,18 @@ void tick_nohz_stop_sched_tick(void) + ts->tick_stopped = 1; + ts->idle_jiffies = last_jiffies; + } ++ ++ /* ++ * If this cpu is the one which updates jiffies, then ++ * give up the assignment and let it be taken by the ++ * cpu which runs the tick timer next, which might be ++ * this cpu as well. If we don't drop this here the ++ * jiffies might be stale and do_timer() never ++ * invoked. ++ */ ++ if (cpu == tick_do_timer_cpu) ++ tick_do_timer_cpu = -1; ++ + /* + * calculate the expiry time for the next timer wheel + * timer +@@ -338,12 +350,24 @@ static void tick_nohz_handler(struct clock_event_device *dev) + { + struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched); + struct pt_regs *regs = get_irq_regs(); ++ int cpu = smp_processor_id(); + ktime_t now = ktime_get(); + + dev->next_event.tv64 = KTIME_MAX; + ++ /* ++ * Check if the do_timer duty was dropped. We don't care about ++ * concurrency: This happens only when the cpu in charge went ++ * into a long sleep. If two cpus happen to assign themself to ++ * this duty, then the jiffies update is still serialized by ++ * xtime_lock. ++ */ ++ if (unlikely(tick_do_timer_cpu == -1)) ++ tick_do_timer_cpu = cpu; ++ + /* Check, if the jiffies need an update */ +- tick_do_update_jiffies64(now); ++ if (tick_do_timer_cpu == cpu) ++ tick_do_update_jiffies64(now); + + /* + * When we are idle and the tick is stopped, we have to touch +@@ -431,9 +455,23 @@ static enum hrtimer_restart tick_sched_timer(struct hrtimer *timer) + struct hrtimer_cpu_base *base = timer->base->cpu_base; + struct pt_regs *regs = get_irq_regs(); + ktime_t now = ktime_get(); ++ int cpu = smp_processor_id(); ++ ++#ifdef CONFIG_NO_HZ ++ /* ++ * Check if the do_timer duty was dropped. We don't care about ++ * concurrency: This happens only when the cpu in charge went ++ * into a long sleep. If two cpus happen to assign themself to ++ * this duty, then the jiffies update is still serialized by ++ * xtime_lock. ++ */ ++ if (unlikely(tick_do_timer_cpu == -1)) ++ tick_do_timer_cpu = cpu; ++#endif + + /* Check, if the jiffies need an update */ +- tick_do_update_jiffies64(now); ++ if (tick_do_timer_cpu == cpu) ++ tick_do_update_jiffies64(now); + + /* + * Do not call, when we are not in irq context and have +diff --git a/kernel/timer.c b/kernel/timer.c +index dd6c2c1..e045774 100644 +--- a/kernel/timer.c ++++ b/kernel/timer.c +@@ -1903,6 +1903,8 @@ unregister_time_interpolator(struct time_interpolator *ti) + prev = &curr->next; + } + ++ clocksource_resume(); ++ + write_seqlock_irqsave(&xtime_lock, flags); + if (ti == time_interpolator) { + /* we lost the best time-interpolator: */ +diff --git a/lib/zlib_inflate/inflate.c b/lib/zlib_inflate/inflate.c +index fceb97c..7e1e311 100644 +--- a/lib/zlib_inflate/inflate.c ++++ b/lib/zlib_inflate/inflate.c +@@ -743,12 +743,14 @@ int zlib_inflate(z_streamp strm, int flush) + + strm->data_type = state->bits + (state->last ? 64 : 0) + + (state->mode == TYPE ? 128 : 0); +- if (((in == 0 && out == 0) || flush == Z_FINISH) && ret == Z_OK) +- ret = Z_BUF_ERROR; + + if (flush == Z_PACKET_FLUSH && ret == Z_OK && +- (strm->avail_out != 0 || strm->avail_in == 0)) ++ strm->avail_out != 0 && strm->avail_in == 0) + return zlib_inflateSyncPacket(strm); ++ ++ if (((in == 0 && out == 0) || flush == Z_FINISH) && ret == Z_OK) ++ ret = Z_BUF_ERROR; ++ + return ret; + } + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 36db012..88e708b 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -140,6 +140,8 @@ static struct page *alloc_huge_page(struct vm_area_struct *vma, + return page; + + fail: ++ if (vma->vm_flags & VM_MAYSHARE) ++ resv_huge_pages++; + spin_unlock(&hugetlb_lock); + return NULL; + } +diff --git a/mm/oom_kill.c b/mm/oom_kill.c +index 3791edf..b3a3dd6 100644 +--- a/mm/oom_kill.c ++++ b/mm/oom_kill.c +@@ -397,6 +397,7 @@ void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask, int order) + struct task_struct *p; + unsigned long points = 0; + unsigned long freed = 0; ++ int constraint; + + blocking_notifier_call_chain(&oom_notify_list, 0, &freed); + if (freed > 0) +@@ -411,14 +412,15 @@ void out_of_memory(struct zonelist *zonelist, gfp_t gfp_mask, int order) + show_mem(); + } + +- cpuset_lock(); +- read_lock(&tasklist_lock); +- + /* + * Check if there were limitations on the allocation (only relevant for + * NUMA) that may require different handling. + */ +- switch (constrained_alloc(zonelist, gfp_mask)) { ++ constraint = constrained_alloc(zonelist, gfp_mask); ++ cpuset_lock(); ++ read_lock(&tasklist_lock); ++ ++ switch (constraint) { + case CONSTRAINT_MEMORY_POLICY: + oom_kill_process(current, points, + "No available memory (MPOL_BIND)"); +diff --git a/mm/slob.c b/mm/slob.c +index 5adc29c..c683d35 100644 +--- a/mm/slob.c ++++ b/mm/slob.c +@@ -150,15 +150,6 @@ static void slob_free(void *block, int size) + spin_unlock_irqrestore(&slob_lock, flags); + } + +-static int FASTCALL(find_order(int size)); +-static int fastcall find_order(int size) +-{ +- int order = 0; +- for ( ; size > 4096 ; size >>=1) +- order++; +- return order; +-} +- + void *__kmalloc(size_t size, gfp_t gfp) + { + slob_t *m; +@@ -174,7 +165,7 @@ void *__kmalloc(size_t size, gfp_t gfp) + if (!bb) + return 0; + +- bb->order = find_order(size); ++ bb->order = get_order(size); + bb->pages = (void *)__get_free_pages(gfp, bb->order); + + if (bb->pages) { +@@ -284,7 +275,7 @@ void *kmem_cache_alloc(struct kmem_cache *c, gfp_t flags) + if (c->size < PAGE_SIZE) + b = slob_alloc(c->size, flags, c->align); + else +- b = (void *)__get_free_pages(flags, find_order(c->size)); ++ b = (void *)__get_free_pages(flags, get_order(c->size)); + + if (c->ctor) + c->ctor(b, c, SLAB_CTOR_CONSTRUCTOR); +@@ -311,7 +302,7 @@ void kmem_cache_free(struct kmem_cache *c, void *b) + if (c->size < PAGE_SIZE) + slob_free(b, c->size); + else +- free_pages((unsigned long)b, find_order(c->size)); ++ free_pages((unsigned long)b, get_order(c->size)); + } + EXPORT_SYMBOL(kmem_cache_free); + +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index cac06c4..444a56b 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -777,6 +777,10 @@ static void nl_fib_lookup(struct fib_result_nl *frn, struct fib_table *tb ) + .tos = frn->fl_tos, + .scope = frn->fl_scope } } }; + ++#ifdef CONFIG_IP_MULTIPLE_TABLES ++ res.r = NULL; ++#endif ++ + frn->err = -ENOENT; + if (tb) { + local_bh_disable(); +diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c +index 23b99ae..75bd597 100644 +--- a/net/ipv4/netfilter/ip_conntrack_core.c ++++ b/net/ipv4/netfilter/ip_conntrack_core.c +@@ -302,7 +302,6 @@ destroy_conntrack(struct nf_conntrack *nfct) + { + struct ip_conntrack *ct = (struct ip_conntrack *)nfct; + struct ip_conntrack_protocol *proto; +- struct ip_conntrack_helper *helper; + typeof(ip_conntrack_destroyed) destroyed; + + DEBUGP("destroy_conntrack(%p)\n", ct); +@@ -312,10 +311,6 @@ destroy_conntrack(struct nf_conntrack *nfct) + ip_conntrack_event(IPCT_DESTROY, ct); + set_bit(IPS_DYING_BIT, &ct->status); + +- helper = ct->helper; +- if (helper && helper->destroy) +- helper->destroy(ct); +- + /* To make sure we don't get any weird locking issues here: + * destroy_conntrack() MUST NOT be called with a write lock + * to ip_conntrack_lock!!! -HW */ +@@ -356,6 +351,11 @@ destroy_conntrack(struct nf_conntrack *nfct) + static void death_by_timeout(unsigned long ul_conntrack) + { + struct ip_conntrack *ct = (void *)ul_conntrack; ++ struct ip_conntrack_helper *helper; ++ ++ helper = ct->helper; ++ if (helper && helper->destroy) ++ helper->destroy(ct); + + write_lock_bh(&ip_conntrack_lock); + /* Inside lock so preempt is disabled on module removal path. +diff --git a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c +index e694299..b86479a 100644 +--- a/net/ipv4/netfilter/ip_conntrack_proto_sctp.c ++++ b/net/ipv4/netfilter/ip_conntrack_proto_sctp.c +@@ -460,7 +460,8 @@ static int sctp_new(struct ip_conntrack *conntrack, + SCTP_CONNTRACK_NONE, sch->type); + + /* Invalid: delete conntrack */ +- if (newconntrack == SCTP_CONNTRACK_MAX) { ++ if (newconntrack == SCTP_CONNTRACK_NONE || ++ newconntrack == SCTP_CONNTRACK_MAX) { + DEBUGP("ip_conntrack_sctp: invalid new deleting.\n"); + return 0; + } +diff --git a/net/ipv4/netfilter/ip_nat_proto_gre.c b/net/ipv4/netfilter/ip_nat_proto_gre.c +index 9581020..e3146a3 100644 +--- a/net/ipv4/netfilter/ip_nat_proto_gre.c ++++ b/net/ipv4/netfilter/ip_nat_proto_gre.c +@@ -70,6 +70,11 @@ gre_unique_tuple(struct ip_conntrack_tuple *tuple, + __be16 *keyptr; + unsigned int min, i, range_size; + ++ /* If there is no master conntrack we are not PPTP, ++ do not change tuples */ ++ if (!conntrack->master) ++ return 0; ++ + if (maniptype == IP_NAT_MANIP_SRC) + keyptr = &tuple->src.u.gre.key; + else +@@ -122,18 +127,9 @@ gre_manip_pkt(struct sk_buff **pskb, + if (maniptype == IP_NAT_MANIP_DST) { + /* key manipulation is always dest */ + switch (greh->version) { +- case 0: +- if (!greh->key) { +- DEBUGP("can't nat GRE w/o key\n"); +- break; +- } +- if (greh->csum) { +- /* FIXME: Never tested this code... */ +- nf_proto_csum_replace4(gre_csum(greh), *pskb, +- *(gre_key(greh)), +- tuple->dst.u.gre.key, 0); +- } +- *(gre_key(greh)) = tuple->dst.u.gre.key; ++ case GRE_VERSION_1701: ++ /* We do not currently NAT any GREv0 packets. ++ * Try to behave like "ip_nat_proto_unknown" */ + break; + case GRE_VERSION_PPTP: + DEBUGP("call_id -> 0x%04x\n", +diff --git a/net/ipv4/netfilter/nf_nat_proto_gre.c b/net/ipv4/netfilter/nf_nat_proto_gre.c +index e5a34c1..ca3ff84 100644 +--- a/net/ipv4/netfilter/nf_nat_proto_gre.c ++++ b/net/ipv4/netfilter/nf_nat_proto_gre.c +@@ -72,6 +72,11 @@ gre_unique_tuple(struct nf_conntrack_tuple *tuple, + __be16 *keyptr; + unsigned int min, i, range_size; + ++ /* If there is no master conntrack we are not PPTP, ++ do not change tuples */ ++ if (!conntrack->master) ++ return 0; ++ + if (maniptype == IP_NAT_MANIP_SRC) + keyptr = &tuple->src.u.gre.key; + else +@@ -122,18 +127,9 @@ gre_manip_pkt(struct sk_buff **pskb, unsigned int iphdroff, + if (maniptype != IP_NAT_MANIP_DST) + return 1; + switch (greh->version) { +- case 0: +- if (!greh->key) { +- DEBUGP("can't nat GRE w/o key\n"); +- break; +- } +- if (greh->csum) { +- /* FIXME: Never tested this code... */ +- nf_proto_csum_replace4(gre_csum(greh), *pskb, +- *(gre_key(greh)), +- tuple->dst.u.gre.key, 0); +- } +- *(gre_key(greh)) = tuple->dst.u.gre.key; ++ case GRE_VERSION_1701: ++ /* We do not currently NAT any GREv0 packets. ++ * Try to behave like "nf_nat_proto_unknown" */ + break; + case GRE_VERSION_PPTP: + DEBUGP("call_id -> 0x%04x\n", ntohs(tuple->dst.u.gre.key)); +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 3834b10..824c6b9 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1759,8 +1759,7 @@ int tcp_disconnect(struct sock *sk, int flags) + tcp_clear_retrans(tp); + inet_csk_delack_init(sk); + sk->sk_send_head = NULL; +- tp->rx_opt.saw_tstamp = 0; +- tcp_sack_reset(&tp->rx_opt); ++ memset(&tp->rx_opt, 0, sizeof(tp->rx_opt)); + __sk_dst_reset(sk); + + BUG_TRAP(!inet->num || icsk->icsk_bind_hash); +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 452a82c..a541137 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -2281,8 +2281,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, + break; + + case NETDEV_CHANGENAME: +-#ifdef CONFIG_SYSCTL + if (idev) { ++ snmp6_unregister_dev(idev); ++#ifdef CONFIG_SYSCTL + addrconf_sysctl_unregister(&idev->cnf); + neigh_sysctl_unregister(idev->nd_parms); + neigh_sysctl_register(dev, idev->nd_parms, +@@ -2290,8 +2291,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, + &ndisc_ifinfo_sysctl_change, + NULL); + addrconf_sysctl_register(idev, &idev->cnf); +- } + #endif ++ snmp6_register_dev(idev); ++ } + break; + }; + +@@ -4060,6 +4062,10 @@ int __init addrconf_init(void) + return err; + + ip6_null_entry.rt6i_idev = in6_dev_get(&loopback_dev); ++#ifdef CONFIG_IPV6_MULTIPLE_TABLES ++ ip6_prohibit_entry.rt6i_idev = in6_dev_get(&loopback_dev); ++ ip6_blk_hole_entry.rt6i_idev = in6_dev_get(&loopback_dev); ++#endif + + register_netdevice_notifier(&ipv6_dev_notf); + +diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c +index fb39604..794b930 100644 +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -396,6 +396,7 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp) + + switch (hdr->type) { + #ifdef CONFIG_IPV6_MIP6 ++ case IPV6_SRCRT_TYPE_2: + break; + #endif + case IPV6_SRCRT_TYPE_0: +@@ -651,6 +652,14 @@ EXPORT_SYMBOL_GPL(ipv6_invert_rthdr); + Hop-by-hop options. + **********************************/ + ++/* ++ * Note: we cannot rely on skb->dst before we assign it in ip6_route_input(). ++ */ ++static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb) ++{ ++ return skb->dst ? ip6_dst_idev(skb->dst) : __in6_dev_get(skb->dev); ++} ++ + /* Router Alert as of RFC 2711 */ + + static int ipv6_hop_ra(struct sk_buff **skbp, int optoff) +@@ -677,25 +686,25 @@ static int ipv6_hop_jumbo(struct sk_buff **skbp, int optoff) + if (skb->nh.raw[optoff+1] != 4 || (optoff&3) != 2) { + LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n", + skb->nh.raw[optoff+1]); +- IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), ++ IP6_INC_STATS_BH(ipv6_skb_idev(skb), + IPSTATS_MIB_INHDRERRORS); + goto drop; + } + + pkt_len = ntohl(*(__be32*)(skb->nh.raw+optoff+2)); + if (pkt_len <= IPV6_MAXPLEN) { +- IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS); ++ IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INHDRERRORS); + icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2); + return 0; + } + if (skb->nh.ipv6h->payload_len) { +- IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS); ++ IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INHDRERRORS); + icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff); + return 0; + } + + if (pkt_len > skb->len - sizeof(struct ipv6hdr)) { +- IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INTRUNCATEDPKTS); ++ IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INTRUNCATEDPKTS); + goto drop; + } + +diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c +index 61e7a6c..1b34ee5 100644 +--- a/net/ipv6/ip6_input.c ++++ b/net/ipv6/ip6_input.c +@@ -235,7 +235,7 @@ int ip6_mc_input(struct sk_buff *skb) + IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INMCASTPKTS); + + hdr = skb->nh.ipv6h; +- deliver = likely(!(skb->dev->flags & (IFF_PROMISC|IFF_ALLMULTI))) || ++ deliver = unlikely(skb->dev->flags & (IFF_PROMISC|IFF_ALLMULTI)) || + ipv6_chk_mcast_addr(skb->dev, &hdr->daddr, NULL); + + /* +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 3055169..9fa3ffb 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -449,10 +449,17 @@ int ip6_forward(struct sk_buff *skb) + */ + if (xrlim_allow(dst, 1*HZ)) + ndisc_send_redirect(skb, n, target); +- } else if (ipv6_addr_type(&hdr->saddr)&(IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK +- |IPV6_ADDR_LINKLOCAL)) { ++ } else { ++ int addrtype = ipv6_addr_type(&hdr->saddr); ++ + /* This check is security critical. */ +- goto error; ++ if (addrtype & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK)) ++ goto error; ++ if (addrtype & IPV6_ADDR_LINKLOCAL) { ++ icmpv6_send(skb, ICMPV6_DEST_UNREACH, ++ ICMPV6_NOT_NEIGHBOUR, 0, skb->dev); ++ goto error; ++ } + } + + if (skb->len > dst_mtu(dst)) { +diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c +index fa3fb50..d57853d 100644 +--- a/net/ipv6/proc.c ++++ b/net/ipv6/proc.c +@@ -236,6 +236,7 @@ int snmp6_unregister_dev(struct inet6_dev *idev) + return -EINVAL; + remove_proc_entry(idev->stats.proc_dir_entry->name, + proc_net_devsnmp6); ++ idev->stats.proc_dir_entry = NULL; + return 0; + } + +diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c +index 93c4223..dff33cc 100644 +--- a/net/ipv6/xfrm6_tunnel.c ++++ b/net/ipv6/xfrm6_tunnel.c +@@ -261,7 +261,7 @@ static int xfrm6_tunnel_rcv(struct sk_buff *skb) + __be32 spi; + + spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&iph->saddr); +- return xfrm6_rcv_spi(skb, spi); ++ return xfrm6_rcv_spi(skb, spi) > 0 ? : 0; + } + + static int xfrm6_tunnel_err(struct sk_buff *skb, struct inet6_skb_parm *opt, +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index b3a70eb..ce28fdd 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -315,7 +315,6 @@ static void + destroy_conntrack(struct nf_conntrack *nfct) + { + struct nf_conn *ct = (struct nf_conn *)nfct; +- struct nf_conn_help *help = nfct_help(ct); + struct nf_conntrack_l3proto *l3proto; + struct nf_conntrack_l4proto *l4proto; + typeof(nf_conntrack_destroyed) destroyed; +@@ -327,9 +326,6 @@ destroy_conntrack(struct nf_conntrack *nfct) + nf_conntrack_event(IPCT_DESTROY, ct); + set_bit(IPS_DYING_BIT, &ct->status); + +- if (help && help->helper && help->helper->destroy) +- help->helper->destroy(ct); +- + /* To make sure we don't get any weird locking issues here: + * destroy_conntrack() MUST NOT be called with a write lock + * to nf_conntrack_lock!!! -HW */ +@@ -375,6 +371,10 @@ destroy_conntrack(struct nf_conntrack *nfct) + static void death_by_timeout(unsigned long ul_conntrack) + { + struct nf_conn *ct = (void *)ul_conntrack; ++ struct nf_conn_help *help = nfct_help(ct); ++ ++ if (help && help->helper && help->helper->destroy) ++ help->helper->destroy(ct); + + write_lock_bh(&nf_conntrack_lock); + /* Inside lock so preempt is disabled on module removal path. +diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c +index 3c80558..b53bc64 100644 +--- a/net/netfilter/nf_conntrack_proto_sctp.c ++++ b/net/netfilter/nf_conntrack_proto_sctp.c +@@ -469,7 +469,8 @@ static int sctp_new(struct nf_conn *conntrack, const struct sk_buff *skb, + SCTP_CONNTRACK_NONE, sch->type); + + /* Invalid: delete conntrack */ +- if (newconntrack == SCTP_CONNTRACK_MAX) { ++ if (newconntrack == SCTP_CONNTRACK_NONE || ++ newconntrack == SCTP_CONNTRACK_MAX) { + DEBUGP("nf_conntrack_sctp: invalid new deleting.\n"); + return 0; + } +diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c +index de889f2..a86f36b 100644 +--- a/net/sched/sch_prio.c ++++ b/net/sched/sch_prio.c +@@ -74,7 +74,7 @@ prio_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr) + band = res.classid; + } + band = TC_H_MIN(band) - 1; +- if (band > q->bands) ++ if (band >= q->bands) + return q->queues[q->prio2band[0]]; + + return q->queues[band]; +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index a1d026f..843c928 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -3847,7 +3847,7 @@ static int sctp_getsockopt_peer_addrs(struct sock *sk, int len, + memcpy(&temp, &from->ipaddr, sizeof(temp)); + sctp_get_pf_specific(sk->sk_family)->addr_v4map(sp, &temp); + addrlen = sctp_get_af_specific(sk->sk_family)->sockaddr_len; +- if(space_left < addrlen) ++ if (space_left < addrlen) + return -ENOMEM; + if (copy_to_user(to, &temp, addrlen)) + return -EFAULT; +@@ -3936,8 +3936,9 @@ done: + /* Helper function that copies local addresses to user and returns the number + * of addresses copied. + */ +-static int sctp_copy_laddrs_to_user_old(struct sock *sk, __u16 port, int max_addrs, +- void __user *to) ++static int sctp_copy_laddrs_old(struct sock *sk, __u16 port, ++ int max_addrs, void *to, ++ int *bytes_copied) + { + struct list_head *pos, *next; + struct sctp_sockaddr_entry *addr; +@@ -3954,10 +3955,10 @@ static int sctp_copy_laddrs_to_user_old(struct sock *sk, __u16 port, int max_add + sctp_get_pf_specific(sk->sk_family)->addr_v4map(sctp_sk(sk), + &temp); + addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len; +- if (copy_to_user(to, &temp, addrlen)) +- return -EFAULT; ++ memcpy(to, &temp, addrlen); + + to += addrlen; ++ *bytes_copied += addrlen; + cnt ++; + if (cnt >= max_addrs) break; + } +@@ -3965,8 +3966,8 @@ static int sctp_copy_laddrs_to_user_old(struct sock *sk, __u16 port, int max_add + return cnt; + } + +-static int sctp_copy_laddrs_to_user(struct sock *sk, __u16 port, +- void __user **to, size_t space_left) ++static int sctp_copy_laddrs(struct sock *sk, __u16 port, void *to, ++ size_t space_left, int *bytes_copied) + { + struct list_head *pos, *next; + struct sctp_sockaddr_entry *addr; +@@ -3983,14 +3984,14 @@ static int sctp_copy_laddrs_to_user(struct sock *sk, __u16 port, + sctp_get_pf_specific(sk->sk_family)->addr_v4map(sctp_sk(sk), + &temp); + addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len; +- if(space_left<addrlen) ++ if (space_left < addrlen) + return -ENOMEM; +- if (copy_to_user(*to, &temp, addrlen)) +- return -EFAULT; ++ memcpy(to, &temp, addrlen); + +- *to += addrlen; ++ to += addrlen; + cnt ++; + space_left -= addrlen; ++ bytes_copied += addrlen; + } + + return cnt; +@@ -4014,6 +4015,9 @@ static int sctp_getsockopt_local_addrs_old(struct sock *sk, int len, + int addrlen; + rwlock_t *addr_lock; + int err = 0; ++ void *addrs; ++ void *buf; ++ int bytes_copied = 0; + + if (len != sizeof(struct sctp_getaddrs_old)) + return -EINVAL; +@@ -4041,6 +4045,15 @@ static int sctp_getsockopt_local_addrs_old(struct sock *sk, int len, + + to = getaddrs.addrs; + ++ /* Allocate space for a local instance of packed array to hold all ++ * the data. We store addresses here first and then put write them ++ * to the user in one shot. ++ */ ++ addrs = kmalloc(sizeof(union sctp_addr) * getaddrs.addr_num, ++ GFP_KERNEL); ++ if (!addrs) ++ return -ENOMEM; ++ + sctp_read_lock(addr_lock); + + /* If the endpoint is bound to 0.0.0.0 or ::0, get the valid +@@ -4050,38 +4063,42 @@ static int sctp_getsockopt_local_addrs_old(struct sock *sk, int len, + addr = list_entry(bp->address_list.next, + struct sctp_sockaddr_entry, list); + if (sctp_is_any(&addr->a)) { +- cnt = sctp_copy_laddrs_to_user_old(sk, bp->port, +- getaddrs.addr_num, +- to); +- if (cnt < 0) { +- err = cnt; +- goto unlock; +- } ++ cnt = sctp_copy_laddrs_old(sk, bp->port, ++ getaddrs.addr_num, ++ addrs, &bytes_copied); + goto copy_getaddrs; + } + } + ++ buf = addrs; + list_for_each(pos, &bp->address_list) { + addr = list_entry(pos, struct sctp_sockaddr_entry, list); + memcpy(&temp, &addr->a, sizeof(temp)); + sctp_get_pf_specific(sk->sk_family)->addr_v4map(sp, &temp); + addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len; +- if (copy_to_user(to, &temp, addrlen)) { +- err = -EFAULT; +- goto unlock; +- } +- to += addrlen; ++ memcpy(buf, &temp, addrlen); ++ buf += addrlen; ++ bytes_copied += addrlen; + cnt ++; + if (cnt >= getaddrs.addr_num) break; + } + + copy_getaddrs: ++ sctp_read_unlock(addr_lock); ++ ++ /* copy the entire address list into the user provided space */ ++ if (copy_to_user(to, addrs, bytes_copied)) { ++ err = -EFAULT; ++ goto error; ++ } ++ ++ /* copy the leading structure back to user */ + getaddrs.addr_num = cnt; + if (copy_to_user(optval, &getaddrs, sizeof(struct sctp_getaddrs_old))) + err = -EFAULT; + +-unlock: +- sctp_read_unlock(addr_lock); ++error: ++ kfree(addrs); + return err; + } + +@@ -4101,7 +4118,9 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len, + rwlock_t *addr_lock; + int err = 0; + size_t space_left; +- int bytes_copied; ++ int bytes_copied = 0; ++ void *addrs; ++ void *buf; + + if (len <= sizeof(struct sctp_getaddrs)) + return -EINVAL; +@@ -4129,6 +4148,9 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len, + to = optval + offsetof(struct sctp_getaddrs,addrs); + space_left = len - sizeof(struct sctp_getaddrs) - + offsetof(struct sctp_getaddrs,addrs); ++ addrs = kmalloc(space_left, GFP_KERNEL); ++ if (!addrs) ++ return -ENOMEM; + + sctp_read_lock(addr_lock); + +@@ -4139,41 +4161,47 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len, + addr = list_entry(bp->address_list.next, + struct sctp_sockaddr_entry, list); + if (sctp_is_any(&addr->a)) { +- cnt = sctp_copy_laddrs_to_user(sk, bp->port, +- &to, space_left); ++ cnt = sctp_copy_laddrs(sk, bp->port, addrs, ++ space_left, &bytes_copied); + if (cnt < 0) { + err = cnt; +- goto unlock; ++ goto error; + } + goto copy_getaddrs; + } + } + ++ buf = addrs; + list_for_each(pos, &bp->address_list) { + addr = list_entry(pos, struct sctp_sockaddr_entry, list); + memcpy(&temp, &addr->a, sizeof(temp)); + sctp_get_pf_specific(sk->sk_family)->addr_v4map(sp, &temp); + addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len; +- if(space_left < addrlen) +- return -ENOMEM; /*fixme: right error?*/ +- if (copy_to_user(to, &temp, addrlen)) { +- err = -EFAULT; +- goto unlock; ++ if (space_left < addrlen) { ++ err = -ENOMEM; /*fixme: right error?*/ ++ goto error; + } +- to += addrlen; ++ memcpy(buf, &temp, addrlen); ++ buf += addrlen; ++ bytes_copied += addrlen; + cnt ++; + space_left -= addrlen; + } + + copy_getaddrs: ++ sctp_read_unlock(addr_lock); ++ ++ if (copy_to_user(to, addrs, bytes_copied)) { ++ err = -EFAULT; ++ goto error; ++ } + if (put_user(cnt, &((struct sctp_getaddrs __user *)optval)->addr_num)) + return -EFAULT; +- bytes_copied = ((char __user *)to) - optval; + if (put_user(bytes_copied, optlen)) + return -EFAULT; + +-unlock: +- sctp_read_unlock(addr_lock); ++error: ++ kfree(addrs); + return err; + } + +@@ -4961,7 +4989,12 @@ int sctp_inet_listen(struct socket *sock, int backlog) + /* Allocate HMAC for generating cookie. */ + if (sctp_hmac_alg) { + tfm = crypto_alloc_hash(sctp_hmac_alg, 0, CRYPTO_ALG_ASYNC); +- if (!tfm) { ++ if (IS_ERR(tfm)) { ++ if (net_ratelimit()) { ++ printk(KERN_INFO ++ "SCTP: failed to load transform for %s: %ld\n", ++ sctp_hmac_alg, PTR_ERR(tfm)); ++ } + err = -ENOSYS; + goto out; + } +diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c +index db298b5..c678f5f 100644 +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -1196,13 +1196,7 @@ svcauth_gss_wrap_resp_integ(struct svc_rqst *rqstp) + if (xdr_buf_subsegment(resbuf, &integ_buf, integ_offset, + integ_len)) + BUG(); +- if (resbuf->page_len == 0 +- && resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE +- < PAGE_SIZE) { +- BUG_ON(resbuf->tail[0].iov_len); +- /* Use head for everything */ +- resv = &resbuf->head[0]; +- } else if (resbuf->tail[0].iov_base == NULL) { ++ if (resbuf->tail[0].iov_base == NULL) { + if (resbuf->head[0].iov_len + RPC_MAX_AUTH_SIZE > PAGE_SIZE) + goto out_err; + resbuf->tail[0].iov_base = resbuf->head[0].iov_base +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 785c3e3..ba89293 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -782,6 +782,10 @@ struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete, + struct hlist_head *chain; + struct hlist_node *entry; + ++ *err = -ENOENT; ++ if (xfrm_policy_id2dir(id) != dir) ++ return NULL; ++ + *err = 0; + write_lock_bh(&xfrm_policy_lock); + chain = xfrm_policy_byidx + idx_hash(id); +diff --git a/scripts/basic/fixdep.c b/scripts/basic/fixdep.c +index 6bc7e7c..8912c0f 100644 +--- a/scripts/basic/fixdep.c ++++ b/scripts/basic/fixdep.c +@@ -249,6 +249,8 @@ void parse_config_file(char *map, size_t len) + found: + if (!memcmp(q - 7, "_MODULE", 7)) + q -= 7; ++ if( (q-p-7) < 0 ) ++ continue; + use_config(p+7, q-p-7); + } + } +diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c +index c94291b..a6f8992 100644 +--- a/sound/pci/hda/patch_sigmatel.c ++++ b/sound/pci/hda/patch_sigmatel.c +@@ -1751,6 +1751,7 @@ static int stac92xx_resume(struct hda_codec *codec) + + stac92xx_init(codec); + stac92xx_set_config_regs(codec); ++ snd_hda_resume_ctls(codec, spec->mixer); + for (i = 0; i < spec->num_mixers; i++) + snd_hda_resume_ctls(codec, spec->mixers[i]); + if (spec->multiout.dig_out_nid) |