78.0.17.EL

.config

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Linux kernel version: 2.6.9-prep
-# Sun Jan 23 13:03:56 2011
+# Sun Jan 23 13:05:03 2011
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y

arch/i386/mm/fault-xen.c

@@ -273,6 +273,38 @@ static void dump_fault_path(unsigned long address)
 }
 #endif
 
+static int spurious_fault(struct pt_regs *regs,
+			  unsigned long address,
+			  unsigned long error_code)
+{
+	pgd_t *pgd;
+	pmd_t *pmd;
+	pte_t *pte;
+
+	/* Reserved-bit violation or user access to kernel space? */
+	if (error_code & 0x0c)
+		return 0;
+
+	pgd = init_mm.pgd + pgd_index(address);
+	if (!pgd_present(*pgd))
+		return 0;
+
+	pmd = pmd_offset(pgd, address);
+	if (!pmd_present(*pmd))
+		return 0;
+
+	pte = pte_offset_kernel(pmd, address);
+	if (!pte_present(*pte))
+		return 0;
+	if ((error_code & 0x02) && !pte_write(*pte))
+		return 0;
+#ifdef CONFIG_X86_PAE
+	if ((error_code & 0x10) && (pte_val(*pte) & _PAGE_NX))
+		return 0;
+#endif
+
+	return 1;
+}
 
 /*
  * This routine handles page faults.  It determines the address,
@@ -338,8 +370,17 @@ fastcall void do_page_fault(struct pt_regs *regs, unsigned long error_code)
 	}
 #else
 	if (unlikely(address >= TASK_SIZE)) { 
+#ifdef CONFIG_XEN
+		/* Faults in hypervisor area can never be patched up. */
+		if (address >= HYPERVISOR_VIRT_START)
+			goto bad_area_nosemaphore;
+#endif
+
 		if (!(error_code & 5))
 			goto vmalloc_fault;
+               /* Can take a spurious fault if mapping changes R/O -> R/W. */
+               if (spurious_fault(regs, address, error_code))
+                       return;
 		/* 
 		 * Don't take the mm semaphore here. If we fixup a prefetch
 		 * fault we could otherwise deadlock.

arch/x86_64/mm/fault-xen.c

@@ -249,6 +249,44 @@ int exception_trace = 1;
 #define MEM_LOG(_f, _a...) ((void)0)
 #endif
 
+static int spurious_fault(struct pt_regs *regs,
+			  unsigned long address,
+			  unsigned long error_code)
+{
+	pgd_t *pgd;
+	pmd_t *pmd;
+	pte_t *pte;
+
+#ifdef CONFIG_XEN
+	/* Faults in hypervisor area are never spurious. */
+	if ((address >= HYPERVISOR_VIRT_START) &&
+	    (address < HYPERVISOR_VIRT_END))
+		return 0;
+#endif
+
+	/* Reserved-bit violation or user access to kernel space? */
+	if (error_code & (PF_RSVD|PF_USER))
+		return 0;
+
+	pgd = init_mm.pgd + pgd_index(address);
+	if (!pgd_present(*pgd))
+		return 0;
+
+	pmd = pmd_offset(pgd, address);
+	if (!pmd_present(*pmd))
+		return 0;
+
+	pte = pte_offset_kernel(pmd, address);
+	if (!pte_present(*pte))
+		return 0;
+	if ((error_code & PF_WRITE) && !pte_write(*pte))
+		return 0;
+	if ((error_code & PF_INSTR) && (pte_val(*pte) & _PAGE_NX))
+		return 0;
+
+	return 1;
+}
+
 /*
  * This routine handles page faults.  It determines the address,
  * and the problem, and then passes it off to one of the appropriate
@@ -317,14 +355,17 @@ asmlinkage void do_page_fault(struct pt_regs *regs, unsigned long error_code)
 	 * (error_code & 4) == 0, and that the fault was not a
 	 * protection error (error_code & 1) == 0.
 	 *
-	 * Must check for the entire kernel range here: with writable
-	 * page tables the hypervisor may temporarily clear PMD
-	 * entries.
+	 * Don't check for the module range here: its PML4
+	 * is always initialized because it's shared with the main
+	 * kernel text. Only vmalloc may need PML4 syncups.
 	 */
 	if (unlikely(address >= TASK_SIZE)) {
 		if (!(error_code & 5) &&
-		    address >= PAGE_OFFSET)
+		      ((address >= VMALLOC_START && address < VMALLOC_END)))
 			goto vmalloc_fault;
+		/* Can take a spurious fault if mapping changes R/O -> R/W. */
+		if (spurious_fault(regs, address, error_code))
+			return;
 		/*
 		 * Don't take the mm semaphore here. If we fixup a prefetch
 		 * fault we could otherwise deadlock.

configs/kernel-2.6.9-x86_64-largesmp.config

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Linux kernel version: 2.6.9-prep
-# Sun Jan 23 13:03:55 2011
+# Sun Jan 23 13:05:02 2011
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y

configs/kernel-2.6.9-x86_64-smp.config

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Linux kernel version: 2.6.9-prep
-# Sun Jan 23 13:03:55 2011
+# Sun Jan 23 13:05:02 2011
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y

configs/kernel-2.6.9-x86_64-xenU.config

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Linux kernel version: 2.6.9-prep
-# Sun Jan 23 13:03:55 2011
+# Sun Jan 23 13:05:02 2011
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y

configs/kernel-2.6.9-x86_64.config

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Linux kernel version: 2.6.9-prep
-# Sun Jan 23 13:03:56 2011
+# Sun Jan 23 13:05:03 2011
 #
 CONFIG_X86_64=y
 CONFIG_64BIT=y

drivers/block/scsi_ioctl.c

@@ -41,6 +41,7 @@ const unsigned char scsi_command_size[8] =
 EXPORT_SYMBOL(scsi_command_size);
 
 #define BLK_DEFAULT_TIMEOUT	(60 * HZ)
+#define BLK_MIN_TIMEOUT		(7 * HZ)
 
 #include <scsi/sg.h>
 
@@ -298,6 +299,8 @@ static int sg_io(struct file *file, request_queue_t *q,
 		rq->timeout = q->sg_timeout;
 	if (!rq->timeout)
 		rq->timeout = BLK_DEFAULT_TIMEOUT;
+	if (rq->timeout < BLK_MIN_TIMEOUT)
+		rq->timeout = BLK_MIN_TIMEOUT;
 
 	start_time = jiffies;
 

drivers/firmware/dell_rbu.c

@@ -556,7 +556,7 @@ static ssize_t read_packet_data_size(struct kobject *kobj,
 {
 	unsigned int size = 0;
 	if (pos == 0)
-		size = sprintf(buffer, "%lu\n", rbu_data.packetsize);
+		size = scnprintf(buffer, count, "%lu\n", rbu_data.packetsize);
 	return size;
 } 
 
@@ -597,7 +597,7 @@ static ssize_t read_rbu_data_size(struct kobject *kobj,
 {
 	unsigned int size = 0;
 	if (pos == 0)
-		size = sprintf(buffer, "%lu\n", rbu_data.bios_image_size);
+		size = scnprintf(buffer, count, "%lu\n", rbu_data.bios_image_size);
 	return size;
 } 
 

fs/buffer.c

@@ -147,6 +147,7 @@ EXPORT_SYMBOL(__lock_buffer);
 
 void fastcall unlock_buffer(struct buffer_head *bh)
 {
+	smp_mb__before_clear_bit();
 	clear_buffer_locked(bh);
 	smp_mb__after_clear_bit();
 	wake_up_buffer(bh);

include/linux/autoconf.h

@@ -1,7 +1,7 @@
 /*
  * Automatically generated C config: don't edit
  * Linux kernel version: 2.6.9-prep
- * Sun Jan 23 13:03:56 2011
+ * Sun Jan 23 13:05:03 2011
  */
 #define AUTOCONF_INCLUDED
 #define CONFIG_X86_64 1

include/linux/netdevice.h

@@ -238,7 +238,8 @@ enum netdev_state_t
 	__LINK_STATE_SCHED,
 	__LINK_STATE_NOCARRIER,
 	__LINK_STATE_RX_SCHED,
-	__LINK_STATE_LINKWATCH_PENDING
+	__LINK_STATE_LINKWATCH_PENDING,
+	__LINK_STATE_NETPOLL
 };
 
 
@@ -886,6 +887,12 @@ static inline void netif_rx_complete(struct net_device *dev)
 {
 	unsigned long flags;
 
+	/*
+	 * Don't touch the poll_list if you're in netpoll
+	 * let net_rx_action handle that.
+	 */
+	if (test_bit(__LINK_STATE_NETPOLL, &dev->state))
+		return;
 	local_irq_save(flags);
 	BUG_ON(!test_bit(__LINK_STATE_RX_SCHED, &dev->state));
 	list_del(&dev->poll_list);
@@ -913,6 +920,12 @@ static inline void netif_poll_enable(struct net_device *dev)
  */
 static inline void __netif_rx_complete(struct net_device *dev)
 {
+	/*
+	 * Don't touch the poll_list if you're in netpoll
+	 * let net_rx_action handle that.
+	 */
+	if (test_bit(__LINK_STATE_NETPOLL, &dev->state))
+		return;
 	BUG_ON(!test_bit(__LINK_STATE_RX_SCHED, &dev->state));
 	list_del(&dev->poll_list);
 	smp_mb__before_clear_bit();