--- /dev/null
+From c68d2b1594548cda7f6dbac6a4d9d30a9b01558c Mon Sep 17 00:00:00 2001
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Date: Mon, 26 Oct 2009 16:50:05 -0700
+Subject: 8250_pci: add IBM Saturn serial card
+
+From: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+
+commit c68d2b1594548cda7f6dbac6a4d9d30a9b01558c upstream.
+
+The IBM Saturn serial card has only one port. Without that fixup,
+the kernel thinks it has two, which confuses userland setup and
+admin tools as well.
+
+[akpm@linux-foundation.org: fix pci-ids.h layout]
+Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Acked-by: Alan Cox <alan@linux.intel.com>
+Cc: Michael Reed <mreed10@us.ibm.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Acked-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/serial/8250_pci.c | 11 +++++++++++
+ include/linux/pci_ids.h | 3 +++
+ 2 files changed, 14 insertions(+)
+
+--- a/drivers/serial/8250_pci.c
++++ b/drivers/serial/8250_pci.c
+@@ -1561,6 +1561,7 @@ enum pci_board_num_t {
+ pbn_exar_XR17C152,
+ pbn_exar_XR17C154,
+ pbn_exar_XR17C158,
++ pbn_exar_ibm_saturn,
+ pbn_pasemi_1682M,
+ pbn_ni8430_2,
+ pbn_ni8430_4,
+@@ -2146,6 +2147,13 @@ static struct pciserial_board pci_boards
+ .base_baud = 921600,
+ .uart_offset = 0x200,
+ },
++ [pbn_exar_ibm_saturn] = {
++ .flags = FL_BASE0,
++ .num_ports = 1,
++ .base_baud = 921600,
++ .uart_offset = 0x200,
++ },
++
+ /*
+ * PA Semi PWRficient PA6T-1682M on-chip UART
+ */
+@@ -2649,6 +2657,9 @@ static struct pci_device_id serial_pci_t
+ PCI_SUBVENDOR_ID_CONNECT_TECH,
+ PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_485, 0, 0,
+ pbn_b0_8_1843200_200 },
++ { PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17C152,
++ PCI_VENDOR_ID_IBM, PCI_SUBDEVICE_ID_IBM_SATURN_SERIAL_ONE_PORT,
++ 0, 0, pbn_exar_ibm_saturn },
+
+ { PCI_VENDOR_ID_SEALEVEL, PCI_DEVICE_ID_SEALEVEL_U530,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+--- a/include/linux/pci_ids.h
++++ b/include/linux/pci_ids.h
+@@ -479,6 +479,9 @@
+ #define PCI_DEVICE_ID_IBM_ICOM_V2_ONE_PORT_RVX_ONE_PORT_MDM_PCIE 0x0361
+ #define PCI_DEVICE_ID_IBM_ICOM_FOUR_PORT_MODEL 0x252
+
++#define PCI_SUBVENDOR_ID_IBM 0x1014
++#define PCI_SUBDEVICE_ID_IBM_SATURN_SERIAL_ONE_PORT 0x03d4
++
+ #define PCI_VENDOR_ID_UNISYS 0x1018
+ #define PCI_DEVICE_ID_UNISYS_DMA_DIRECTOR 0x001C
+
--- /dev/null
+From cebbert@redhat.com Thu Nov 5 11:58:54 2009
+From: Chuck Ebbert <cebbert@redhat.com>
+Date: Mon, 26 Oct 2009 15:27:53 -0400
+Subject: ahci: revert "Restore SB600 sata controller 64 bit DMA"
+To: stable@kernel.org
+Cc: Tejun Heo <tj@kernel.org>
+Message-ID: <20091026152753.0be8dc32@katamari.usersys.redhat.com>
+
+From: Chuck Ebbert <cebbert@redhat.com>
+
+revert commit 58a09b38cfcd700b796ea07ae3d2e0efbb28b561
+("[libata] ahci: Restore SB600 SATA controller 64 bit DMA")
+
+Upstream commit 58a09b38cfcd700b796ea07ae3d2e0efbb28b561 does
+nearly the same thing but this patch is simplified for 2.6.31
+
+Disables 64-bit DMA for _all_ boards, unlike 2.6.32 which adds a
+whitelist. (The whitelist function requires a fairly large patch
+that touches unrelated code.)
+
+Doesn't revert the DMI part as other backported patches might need
+the exported symbol.
+
+Applies to 2.6.31.4
+
+Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
+Acked-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/ahci.c | 52 ++--------------------------------------------------
+ 1 file changed, 2 insertions(+), 50 deletions(-)
+
+--- a/drivers/ata/ahci.c
++++ b/drivers/ata/ahci.c
+@@ -433,7 +433,8 @@ static const struct ata_port_info ahci_p
+ [board_ahci_sb600] =
+ {
+ AHCI_HFLAGS (AHCI_HFLAG_IGN_SERR_INTERNAL |
+- AHCI_HFLAG_NO_MSI | AHCI_HFLAG_SECT255),
++ AHCI_HFLAG_32BIT_ONLY | AHCI_HFLAG_NO_MSI |
++ AHCI_HFLAG_SECT255),
+ .flags = AHCI_FLAG_COMMON,
+ .pio_mask = ATA_PIO4,
+ .udma_mask = ATA_UDMA6,
+@@ -2602,51 +2603,6 @@ static void ahci_p5wdh_workaround(struct
+ }
+ }
+
+-/*
+- * SB600 ahci controller on ASUS M2A-VM can't do 64bit DMA with older
+- * BIOS. The oldest version known to be broken is 0901 and working is
+- * 1501 which was released on 2007-10-26. Force 32bit DMA on anything
+- * older than 1501. Please read bko#9412 for more info.
+- */
+-static bool ahci_asus_m2a_vm_32bit_only(struct pci_dev *pdev)
+-{
+- static const struct dmi_system_id sysids[] = {
+- {
+- .ident = "ASUS M2A-VM",
+- .matches = {
+- DMI_MATCH(DMI_BOARD_VENDOR,
+- "ASUSTeK Computer INC."),
+- DMI_MATCH(DMI_BOARD_NAME, "M2A-VM"),
+- },
+- },
+- { }
+- };
+- const char *cutoff_mmdd = "10/26";
+- const char *date;
+- int year;
+-
+- if (pdev->bus->number != 0 || pdev->devfn != PCI_DEVFN(0x12, 0) ||
+- !dmi_check_system(sysids))
+- return false;
+-
+- /*
+- * Argh.... both version and date are free form strings.
+- * Let's hope they're using the same date format across
+- * different versions.
+- */
+- date = dmi_get_system_info(DMI_BIOS_DATE);
+- year = dmi_get_year(DMI_BIOS_DATE);
+- if (date && strlen(date) >= 10 && date[2] == '/' && date[5] == '/' &&
+- (year > 2007 ||
+- (year == 2007 && strncmp(date, cutoff_mmdd, 5) >= 0)))
+- return false;
+-
+- dev_printk(KERN_WARNING, &pdev->dev, "ASUS M2A-VM: BIOS too old, "
+- "forcing 32bit DMA, update BIOS\n");
+-
+- return true;
+-}
+-
+ static bool ahci_broken_system_poweroff(struct pci_dev *pdev)
+ {
+ static const struct dmi_system_id broken_systems[] = {
+@@ -2857,10 +2813,6 @@ static int ahci_init_one(struct pci_dev
+ if (board_id == board_ahci_sb700 && pdev->revision >= 0x40)
+ hpriv->flags &= ~AHCI_HFLAG_IGN_SERR_INTERNAL;
+
+- /* apply ASUS M2A_VM quirk */
+- if (ahci_asus_m2a_vm_32bit_only(pdev))
+- hpriv->flags |= AHCI_HFLAG_32BIT_ONLY;
+-
+ if ((hpriv->flags & AHCI_HFLAG_NO_MSI) || pci_enable_msi(pdev))
+ pci_intx(pdev, 1);
+
--- /dev/null
+From 03022c54b9725026c0370a810168975c387ad04c Mon Sep 17 00:00:00 2001
+From: Zdenek Kabelac <zkabelac@redhat.com>
+Date: Fri, 16 Oct 2009 23:18:15 +0100
+Subject: dm: add missing del_gendisk to alloc_dev error path
+
+From: Zdenek Kabelac <zkabelac@redhat.com>
+
+commit 03022c54b9725026c0370a810168975c387ad04c upstream.
+
+Add missing del_gendisk() to error path when creation of workqueue fails.
+Otherwice there is a resource leak and following warning is shown:
+
+WARNING: at fs/sysfs/dir.c:487 sysfs_add_one+0xc5/0x160()
+sysfs: cannot create duplicate filename '/devices/virtual/block/dm-0'
+
+Signed-off-by: Zdenek Kabelac <zkabelac@redhat.com>
+Reviewed-by: Jonathan Brassow <jbrassow@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -1819,6 +1819,7 @@ static struct mapped_device *alloc_dev(i
+ bad_bdev:
+ destroy_workqueue(md->wq);
+ bad_thread:
++ del_gendisk(md->disk);
+ put_disk(md->disk);
+ bad_disk:
+ blk_cleanup_queue(md->queue);
--- /dev/null
+From f88fb981183e71daf40bbd84bc8251bbf7b59e19 Mon Sep 17 00:00:00 2001
+From: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
+Date: Fri, 16 Oct 2009 23:18:15 +0100
+Subject: dm: dec_pending needs locking to save error value
+
+From: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
+
+commit f88fb981183e71daf40bbd84bc8251bbf7b59e19 upstream.
+
+Multiple instances of dec_pending() can run concurrently so a lock is
+needed when it saves the first error code.
+
+I have never experienced actual problem without locking and just found
+this during code inspection while implementing the barrier support
+patch for request-based dm.
+
+This patch adds the locking.
+I've done compile, boot and basic I/O testings.
+
+Signed-off-by: Kiyoshi Ueda <k-ueda@ct.jp.nec.com>
+Signed-off-by: Jun'ichi Nomura <j-nomura@ce.jp.nec.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm.c
++++ b/drivers/md/dm.c
+@@ -47,6 +47,7 @@ struct dm_io {
+ atomic_t io_count;
+ struct bio *bio;
+ unsigned long start_time;
++ spinlock_t endio_lock;
+ };
+
+ /*
+@@ -576,8 +577,12 @@ static void dec_pending(struct dm_io *io
+ struct mapped_device *md = io->md;
+
+ /* Push-back supersedes any I/O errors */
+- if (error && !(io->error > 0 && __noflush_suspending(md)))
+- io->error = error;
++ if (unlikely(error)) {
++ spin_lock_irqsave(&io->endio_lock, flags);
++ if (!(io->error > 0 && __noflush_suspending(md)))
++ io->error = error;
++ spin_unlock_irqrestore(&io->endio_lock, flags);
++ }
+
+ if (atomic_dec_and_test(&io->io_count)) {
+ if (io->error == DM_ENDIO_REQUEUE) {
+@@ -1224,6 +1229,7 @@ static void __split_and_process_bio(stru
+ atomic_set(&ci.io->io_count, 1);
+ ci.io->bio = bio;
+ ci.io->md = md;
++ spin_lock_init(&ci.io->endio_lock);
+ ci.sector = bio->bi_sector;
+ ci.sector_count = bio_sectors(bio);
+ if (unlikely(bio_empty_barrier(bio)))
--- /dev/null
+From 0e8c4e4e3ebb15756ddc4170a88149a2cd323cfe Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 16 Oct 2009 23:18:16 +0100
+Subject: dm exception store: fix failed set_chunk_size error path
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 0e8c4e4e3ebb15756ddc4170a88149a2cd323cfe upstream.
+
+Properly close the device if failing because of an invalid chunk size.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-exception-store.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-exception-store.c
++++ b/drivers/md/dm-exception-store.c
+@@ -251,7 +251,7 @@ int dm_exception_store_create(struct dm_
+
+ r = set_chunk_size(tmp_store, argv[2], &ti->error);
+ if (r)
+- goto bad_cow;
++ goto bad_ctr;
+
+ r = type->ctr(tmp_store, 0, NULL);
+ if (r) {
--- /dev/null
+From bca915aae803cf01fde4461fc9c093cf5a86d7fc Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Fri, 16 Oct 2009 23:18:15 +0100
+Subject: dm log: userspace fix incorrect luid cast in userspace_ctr
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit bca915aae803cf01fde4461fc9c093cf5a86d7fc upstream.
+
+mips:
+
+drivers/md/dm-log-userspace-base.c: In function `userspace_ctr':
+drivers/md/dm-log-userspace-base.c:159: warning: cast from pointer to integer of different size
+
+Cc: Jonathan Brassow <jbrassow@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-log-userspace-base.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/md/dm-log-userspace-base.c
++++ b/drivers/md/dm-log-userspace-base.c
+@@ -156,7 +156,7 @@ static int userspace_ctr(struct dm_dirty
+ }
+
+ /* The ptr value is sufficient for local unique id */
+- lc->luid = (uint64_t)lc;
++ lc->luid = (unsigned long)lc;
+
+ lc->ti = ti;
+
--- /dev/null
+From 034a186d29dbcef099e57ab23ec39440596be911 Mon Sep 17 00:00:00 2001
+From: Jonathan Brassow <jbrassow@redhat.com>
+Date: Fri, 16 Oct 2009 23:18:14 +0100
+Subject: dm snapshot: free exception store on init failure
+
+From: Jonathan Brassow <jbrassow@redhat.com>
+
+commit 034a186d29dbcef099e57ab23ec39440596be911 upstream.
+
+While initializing the snapshot module, if we fail to register
+the snapshot target then we must back-out the exception store
+module initialization.
+
+Signed-off-by: Jonathan Brassow <jbrassow@redhat.com>
+Reviewed-by: Mikulas Patocka <mpatocka@redhat.com>
+Reviewed-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-snap.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1465,7 +1465,7 @@ static int __init dm_snapshot_init(void)
+ r = dm_register_target(&snapshot_target);
+ if (r) {
+ DMERR("snapshot target register failed %d", r);
+- return r;
++ goto bad_register_snapshot_target;
+ }
+
+ r = dm_register_target(&origin_target);
+@@ -1522,6 +1522,9 @@ bad2:
+ dm_unregister_target(&origin_target);
+ bad1:
+ dm_unregister_target(&snapshot_target);
++
++bad_register_snapshot_target:
++ dm_exception_store_exit();
+ return r;
+ }
+
--- /dev/null
+From 4c6fff445d7aa753957856278d4d93bcad6e2c14 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 16 Oct 2009 23:18:16 +0100
+Subject: dm snapshot: lock snapshot while supplying status
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 4c6fff445d7aa753957856278d4d93bcad6e2c14 upstream.
+
+This patch locks the snapshot when returning status. It fixes a race
+when it could return an invalid number of free chunks if someone
+was simultaneously modifying it.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-snap.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1147,6 +1147,8 @@ static int snapshot_status(struct dm_tar
+ unsigned sz = 0;
+ struct dm_snapshot *snap = ti->private;
+
++ down_write(&snap->lock);
++
+ switch (type) {
+ case STATUSTYPE_INFO:
+ if (!snap->valid)
+@@ -1178,6 +1180,8 @@ static int snapshot_status(struct dm_tar
+ break;
+ }
+
++ up_write(&snap->lock);
++
+ return 0;
+ }
+
--- /dev/null
+From 3f2412dc85260e5aae7ebb03bf50d5b1407e3083 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 16 Oct 2009 23:18:16 +0100
+Subject: dm snapshot: require non zero chunk size by end of ctr
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 3f2412dc85260e5aae7ebb03bf50d5b1407e3083 upstream.
+
+If we are creating snapshot with memory-stored exception store, fail if
+the user didn't specify chunk size. Zero chunk size would probably crash
+a lot of places in the rest of snapshot code.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Reviewed-by: Jonathan Brassow <jbrassow@redhat.com>
+Reviewed-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-snap.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -673,6 +673,11 @@ static int snapshot_ctr(struct dm_target
+ bio_list_init(&s->queued_bios);
+ INIT_WORK(&s->queued_bios_work, flush_queued_bios);
+
++ if (!s->store->chunk_size) {
++ ti->error = "Chunk size not set";
++ goto bad_load_and_register;
++ }
++
+ /* Add snapshot to the list of snapshots for this origin */
+ /* Exceptions aren't triggered till snapshot_resume() is called */
+ if (register_snapshot(s)) {
--- /dev/null
+From 6d45d93ead319423099b82a4efd775bc0f159121 Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 16 Oct 2009 23:18:14 +0100
+Subject: dm snapshot: sort by chunk size to fix race
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit 6d45d93ead319423099b82a4efd775bc0f159121 upstream.
+
+Avoid a race causing corruption when snapshots of the same origin have
+different chunk sizes by sorting the internal list of snapshots by chunk
+size, largest first.
+ https://bugzilla.redhat.com/show_bug.cgi?id=182659
+
+For example, let's have two snapshots with different chunk sizes. The
+first snapshot (1) has small chunk size and the second snapshot (2) has
+large chunk size. Let's have chunks A, B, C in these snapshots:
+snapshot1: ====A==== ====B====
+snapshot2: ==========C==========
+
+(Chunk size is a power of 2. Chunks are aligned.)
+
+A write to the origin at a position within A and C comes along. It
+triggers reallocation of A, then reallocation of C and links them
+together using A as the 'primary' exception.
+
+Then another write to the origin comes along at a position within B and
+C. It creates pending exception for B. C already has a reallocation in
+progress and it already has a primary exception (A), so nothing is done
+to it: B and C are not linked.
+
+If the reallocation of B finishes before the reallocation of C, because
+there is no link with the pending exception for C it does not know to
+wait for it and, the second write is dispatched to the origin and causes
+data corruption in the chunk C in snapshot2.
+
+To avoid this situation, we maintain snapshots sorted in descending
+order of chunk size. This leads to a guaranteed ordering on the links
+between the pending exceptions and avoids the problem explained above -
+both A and B now get linked to C.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-snap.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -296,6 +296,7 @@ static void __insert_origin(struct origi
+ */
+ static int register_snapshot(struct dm_snapshot *snap)
+ {
++ struct dm_snapshot *l;
+ struct origin *o, *new_o;
+ struct block_device *bdev = snap->origin->bdev;
+
+@@ -319,7 +320,11 @@ static int register_snapshot(struct dm_s
+ __insert_origin(o);
+ }
+
+- list_add_tail(&snap->list, &o->snapshots);
++ /* Sort the list according to chunk size, largest-first smallest-last */
++ list_for_each_entry(l, &o->snapshots, list)
++ if (l->store->chunk_size < snap->store->chunk_size)
++ break;
++ list_add_tail(&snap->list, &l->list);
+
+ up_write(&_origins_lock);
+ return 0;
--- /dev/null
+From df96eee679ba28c98cf722fa7c9f4286ee1ed0bd Mon Sep 17 00:00:00 2001
+From: Mikulas Patocka <mpatocka@redhat.com>
+Date: Fri, 16 Oct 2009 23:18:17 +0100
+Subject: dm snapshot: use unsigned integer chunk size
+
+From: Mikulas Patocka <mpatocka@redhat.com>
+
+commit df96eee679ba28c98cf722fa7c9f4286ee1ed0bd upstream.
+
+Use unsigned integer chunk size.
+
+Maximum chunk size is 512kB, there won't ever be need to use 4GB chunk size,
+so the number can be 32-bit. This fixes compiler failure on 32-bit systems
+with large block devices.
+
+Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Reviewed-by: Jonathan Brassow <jbrassow@redhat.com>
+Signed-off-by: Alasdair G Kergon <agk@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/md/dm-exception-store.c | 20 +++++++++++---------
+ drivers/md/dm-exception-store.h | 8 ++++----
+ drivers/md/dm-snap-persistent.c | 16 ++++++++--------
+ drivers/md/dm-snap.c | 4 ++--
+ 4 files changed, 25 insertions(+), 23 deletions(-)
+
+--- a/drivers/md/dm-exception-store.c
++++ b/drivers/md/dm-exception-store.c
+@@ -155,7 +155,8 @@ static int set_chunk_size(struct dm_exce
+ char *value;
+
+ chunk_size_ulong = simple_strtoul(chunk_size_arg, &value, 10);
+- if (*chunk_size_arg == '\0' || *value != '\0') {
++ if (*chunk_size_arg == '\0' || *value != '\0' ||
++ chunk_size_ulong > UINT_MAX) {
+ *error = "Invalid chunk size";
+ return -EINVAL;
+ }
+@@ -171,34 +172,35 @@ static int set_chunk_size(struct dm_exce
+ */
+ chunk_size_ulong = round_up(chunk_size_ulong, PAGE_SIZE >> 9);
+
+- return dm_exception_store_set_chunk_size(store, chunk_size_ulong,
++ return dm_exception_store_set_chunk_size(store,
++ (unsigned) chunk_size_ulong,
+ error);
+ }
+
+ int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
+- unsigned long chunk_size_ulong,
++ unsigned chunk_size,
+ char **error)
+ {
+ /* Check chunk_size is a power of 2 */
+- if (!is_power_of_2(chunk_size_ulong)) {
++ if (!is_power_of_2(chunk_size)) {
+ *error = "Chunk size is not a power of 2";
+ return -EINVAL;
+ }
+
+ /* Validate the chunk size against the device block size */
+- if (chunk_size_ulong % (bdev_logical_block_size(store->cow->bdev) >> 9)) {
++ if (chunk_size % (bdev_logical_block_size(store->cow->bdev) >> 9)) {
+ *error = "Chunk size is not a multiple of device blocksize";
+ return -EINVAL;
+ }
+
+- if (chunk_size_ulong > INT_MAX >> SECTOR_SHIFT) {
++ if (chunk_size > INT_MAX >> SECTOR_SHIFT) {
+ *error = "Chunk size is too high";
+ return -EINVAL;
+ }
+
+- store->chunk_size = chunk_size_ulong;
+- store->chunk_mask = chunk_size_ulong - 1;
+- store->chunk_shift = ffs(chunk_size_ulong) - 1;
++ store->chunk_size = chunk_size;
++ store->chunk_mask = chunk_size - 1;
++ store->chunk_shift = ffs(chunk_size) - 1;
+
+ return 0;
+ }
+--- a/drivers/md/dm-exception-store.h
++++ b/drivers/md/dm-exception-store.h
+@@ -101,9 +101,9 @@ struct dm_exception_store {
+ struct dm_dev *cow;
+
+ /* Size of data blocks saved - must be a power of 2 */
+- chunk_t chunk_size;
+- chunk_t chunk_mask;
+- chunk_t chunk_shift;
++ unsigned chunk_size;
++ unsigned chunk_mask;
++ unsigned chunk_shift;
+
+ void *context;
+ };
+@@ -169,7 +169,7 @@ int dm_exception_store_type_register(str
+ int dm_exception_store_type_unregister(struct dm_exception_store_type *type);
+
+ int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
+- unsigned long chunk_size_ulong,
++ unsigned chunk_size,
+ char **error);
+
+ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -961,7 +961,7 @@ static void start_copy(struct dm_snap_pe
+
+ src.bdev = bdev;
+ src.sector = chunk_to_sector(s->store, pe->e.old_chunk);
+- src.count = min(s->store->chunk_size, dev_size - src.sector);
++ src.count = min((sector_t)s->store->chunk_size, dev_size - src.sector);
+
+ dest.bdev = s->store->cow->bdev;
+ dest.sector = chunk_to_sector(s->store, pe->e.new_chunk);
+@@ -1402,7 +1402,7 @@ static void origin_resume(struct dm_targ
+ struct dm_dev *dev = ti->private;
+ struct dm_snapshot *snap;
+ struct origin *o;
+- chunk_t chunk_size = 0;
++ unsigned chunk_size = 0;
+
+ down_read(&_origins_lock);
+ o = __lookup_origin(dev->bdev);
+--- a/drivers/md/dm-snap-persistent.c
++++ b/drivers/md/dm-snap-persistent.c
+@@ -284,12 +284,13 @@ static int read_header(struct pstore *ps
+ {
+ int r;
+ struct disk_header *dh;
+- chunk_t chunk_size;
++ unsigned chunk_size;
+ int chunk_size_supplied = 1;
+ char *chunk_err;
+
+ /*
+- * Use default chunk size (or hardsect_size, if larger) if none supplied
++ * Use default chunk size (or logical_block_size, if larger)
++ * if none supplied
+ */
+ if (!ps->store->chunk_size) {
+ ps->store->chunk_size = max(DM_CHUNK_SIZE_DEFAULT_SECTORS,
+@@ -334,10 +335,9 @@ static int read_header(struct pstore *ps
+ return 0;
+
+ if (chunk_size_supplied)
+- DMWARN("chunk size %llu in device metadata overrides "
+- "table chunk size of %llu.",
+- (unsigned long long)chunk_size,
+- (unsigned long long)ps->store->chunk_size);
++ DMWARN("chunk size %u in device metadata overrides "
++ "table chunk size of %u.",
++ chunk_size, ps->store->chunk_size);
+
+ /* We had a bogus chunk_size. Fix stuff up. */
+ free_area(ps);
+@@ -345,8 +345,8 @@ static int read_header(struct pstore *ps
+ r = dm_exception_store_set_chunk_size(ps->store, chunk_size,
+ &chunk_err);
+ if (r) {
+- DMERR("invalid on-disk chunk size %llu: %s.",
+- (unsigned long long)chunk_size, chunk_err);
++ DMERR("invalid on-disk chunk size %u: %s.",
++ chunk_size, chunk_err);
+ return r;
+ }
+
--- /dev/null
+From b05ca7385a2848abdc72051f832722641daed8b0 Mon Sep 17 00:00:00 2001
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Date: Mon, 26 Oct 2009 16:49:59 -0700
+Subject: do_mbind(): fix memory leak
+
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+
+commit b05ca7385a2848abdc72051f832722641daed8b0 upstream.
+
+If migrate_prep is failed, new variable is leaked. This patch fixes it.
+
+Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Acked-by: Christoph Lameter <cl@linux-foundation.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mempolicy.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -1024,7 +1024,7 @@ static long do_mbind(unsigned long start
+
+ err = migrate_prep();
+ if (err)
+- return err;
++ goto mpol_out;
+ }
+ {
+ NODEMASK_SCRATCH(scratch);
+@@ -1039,10 +1039,9 @@ static long do_mbind(unsigned long start
+ err = -ENOMEM;
+ NODEMASK_SCRATCH_FREE(scratch);
+ }
+- if (err) {
+- mpol_put(new);
+- return err;
+- }
++ if (err)
++ goto mpol_out;
++
+ vma = check_range(mm, start, end, nmask,
+ flags | MPOL_MF_INVERT, &pagelist);
+
+@@ -1062,6 +1061,7 @@ static long do_mbind(unsigned long start
+ putback_lru_pages(&pagelist);
+
+ up_write(&mm->mmap_sem);
++ mpol_out:
+ mpol_put(new);
+ return err;
+ }
--- /dev/null
+From aefba418bfecd1985a08f50a95bd854a119f0153 Mon Sep 17 00:00:00 2001
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Date: Fri, 30 Oct 2009 17:02:31 +0900
+Subject: dpt_i2o: Fix typo of EINVAL
+
+From: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+
+commit aefba418bfecd1985a08f50a95bd854a119f0153 upstream.
+
+Commit ef7562b7f28319e6dd1f85dc1af87df2a7a84832 ("dpt_i2o: Fix up
+copy*user") had a silly typo: EINVAL should be -EINVAL.
+
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Cc: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/dpt_i2o.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/scsi/dpt_i2o.c
++++ b/drivers/scsi/dpt_i2o.c
+@@ -1919,7 +1919,7 @@ static int adpt_i2o_passthru(adpt_hba* p
+ size = size>>16;
+ size *= 4;
+ if (size > MAX_MESSAGE_SIZE) {
+- rcode = EINVAL;
++ rcode = -EINVAL;
+ goto cleanup;
+ }
+ /* Copy in the user's I2O command */
--- /dev/null
+From ef7562b7f28319e6dd1f85dc1af87df2a7a84832 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Tue, 27 Oct 2009 15:35:35 +0000
+Subject: dpt_i2o: Fix up copy*user
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit ef7562b7f28319e6dd1f85dc1af87df2a7a84832 upstream.
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/dpt_i2o.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/scsi/dpt_i2o.c
++++ b/drivers/scsi/dpt_i2o.c
+@@ -1918,6 +1918,10 @@ static int adpt_i2o_passthru(adpt_hba* p
+ }
+ size = size>>16;
+ size *= 4;
++ if (size > MAX_MESSAGE_SIZE) {
++ rcode = EINVAL;
++ goto cleanup;
++ }
+ /* Copy in the user's I2O command */
+ if (copy_from_user (msg, user_msg, size)) {
+ rcode = -EFAULT;
--- /dev/null
+From 39acbc12affcaa23ef1d887ba3d197baca8e6e47 Mon Sep 17 00:00:00 2001
+From: Stas Sergeev <stsp@aknet.ru>
+Date: Sun, 18 Oct 2009 00:31:38 +0400
+Subject: Driver core: fix driver_register() return value
+
+From: Stas Sergeev <stsp@aknet.ru>
+
+commit 39acbc12affcaa23ef1d887ba3d197baca8e6e47 upstream.
+
+In this patch:
+http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=16dc42e018c2868211b4928f20a957c0c216126c
+the check was added for another driver to already claim the same device
+on the same bus. But the returned error code was wrong: to modprobe, the
+-EEXIST means that _this_ driver is already installed. It therefore
+doesn't produce the needed error message when _another_ driver is trying
+to register for the same device. Returning -EBUSY fixes the problem.
+
+Signed-off-by: Stas Sergeev <stsp@aknet.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/driver.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/driver.c
++++ b/drivers/base/driver.c
+@@ -236,7 +236,7 @@ int driver_register(struct device_driver
+ put_driver(other);
+ printk(KERN_ERR "Error: Driver '%s' is already registered, "
+ "aborting...\n", drv->name);
+- return -EEXIST;
++ return -EBUSY;
+ }
+
+ ret = bus_add_driver(drv);
--- /dev/null
+From ad3960243e55320d74195fb85c975e0a8cc4466c Mon Sep 17 00:00:00 2001
+From: Earl Chew <earl_chew@agilent.com>
+Date: Mon, 19 Oct 2009 15:55:41 -0700
+Subject: fs: pipe.c null pointer dereference
+
+From: Earl Chew <earl_chew@agilent.com>
+
+commit ad3960243e55320d74195fb85c975e0a8cc4466c upstream.
+
+This patch fixes a null pointer exception in pipe_rdwr_open() which
+generates the stack trace:
+
+> Unable to handle kernel NULL pointer dereference at 0000000000000028 RIP:
+> [<ffffffff802899a5>] pipe_rdwr_open+0x35/0x70
+> [<ffffffff8028125c>] __dentry_open+0x13c/0x230
+> [<ffffffff8028143d>] do_filp_open+0x2d/0x40
+> [<ffffffff802814aa>] do_sys_open+0x5a/0x100
+> [<ffffffff8021faf3>] sysenter_do_call+0x1b/0x67
+
+The failure mode is triggered by an attempt to open an anonymous
+pipe via /proc/pid/fd/* as exemplified by this script:
+
+=============================================================
+while : ; do
+ { echo y ; sleep 1 ; } | { while read ; do echo z$REPLY; done ; } &
+ PID=$!
+ OUT=$(ps -efl | grep 'sleep 1' | grep -v grep |
+ { read PID REST ; echo $PID; } )
+ OUT="${OUT%% *}"
+ DELAY=$((RANDOM * 1000 / 32768))
+ usleep $((DELAY * 1000 + RANDOM % 1000 ))
+ echo n > /proc/$OUT/fd/1 # Trigger defect
+done
+=============================================================
+
+Note that the failure window is quite small and I could only
+reliably reproduce the defect by inserting a small delay
+in pipe_rdwr_open(). For example:
+
+ static int
+ pipe_rdwr_open(struct inode *inode, struct file *filp)
+ {
+ msleep(100);
+ mutex_lock(&inode->i_mutex);
+
+Although the defect was observed in pipe_rdwr_open(), I think it
+makes sense to replicate the change through all the pipe_*_open()
+functions.
+
+The core of the change is to verify that inode->i_pipe has not
+been released before attempting to manipulate it. If inode->i_pipe
+is no longer present, return ENOENT to indicate so.
+
+The comment about potentially using atomic_t for i_pipe->readers
+and i_pipe->writers has also been removed because it is no longer
+relevant in this context. The inode->i_mutex lock must be used so
+that inode->i_pipe can be dealt with correctly.
+
+Signed-off-by: Earl Chew <earl_chew@agilent.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/pipe.c | 41 ++++++++++++++++++++++++++++++-----------
+ 1 file changed, 30 insertions(+), 11 deletions(-)
+
+--- a/fs/pipe.c
++++ b/fs/pipe.c
+@@ -777,36 +777,55 @@ pipe_rdwr_release(struct inode *inode, s
+ static int
+ pipe_read_open(struct inode *inode, struct file *filp)
+ {
+- /* We could have perhaps used atomic_t, but this and friends
+- below are the only places. So it doesn't seem worthwhile. */
++ int ret = -ENOENT;
++
+ mutex_lock(&inode->i_mutex);
+- inode->i_pipe->readers++;
++
++ if (inode->i_pipe) {
++ ret = 0;
++ inode->i_pipe->readers++;
++ }
++
+ mutex_unlock(&inode->i_mutex);
+
+- return 0;
++ return ret;
+ }
+
+ static int
+ pipe_write_open(struct inode *inode, struct file *filp)
+ {
++ int ret = -ENOENT;
++
+ mutex_lock(&inode->i_mutex);
+- inode->i_pipe->writers++;
++
++ if (inode->i_pipe) {
++ ret = 0;
++ inode->i_pipe->writers++;
++ }
++
+ mutex_unlock(&inode->i_mutex);
+
+- return 0;
++ return ret;
+ }
+
+ static int
+ pipe_rdwr_open(struct inode *inode, struct file *filp)
+ {
++ int ret = -ENOENT;
++
+ mutex_lock(&inode->i_mutex);
+- if (filp->f_mode & FMODE_READ)
+- inode->i_pipe->readers++;
+- if (filp->f_mode & FMODE_WRITE)
+- inode->i_pipe->writers++;
++
++ if (inode->i_pipe) {
++ ret = 0;
++ if (filp->f_mode & FMODE_READ)
++ inode->i_pipe->readers++;
++ if (filp->f_mode & FMODE_WRITE)
++ inode->i_pipe->writers++;
++ }
++
+ mutex_unlock(&inode->i_mutex);
+
+- return 0;
++ return ret;
+ }
+
+ /*
--- /dev/null
+From 2bc872036e1c5948b5b02942810bbdd8dbdb9812 Mon Sep 17 00:00:00 2001
+From: Darren Hart <dvhltc@us.ibm.com>
+Date: Wed, 14 Oct 2009 10:12:39 -0700
+Subject: futex: Check for NULL keys in match_futex
+
+From: Darren Hart <dvhltc@us.ibm.com>
+
+commit 2bc872036e1c5948b5b02942810bbdd8dbdb9812 upstream.
+
+If userspace tries to perform a requeue_pi on a non-requeue_pi waiter,
+it will find the futex_q->requeue_pi_key to be NULL and OOPS.
+
+Check for NULL in match_futex() instead of doing explicit NULL pointer
+checks on all call sites. While match_futex(NULL, NULL) returning
+false is a little odd, it's still correct as we expect valid key
+references.
+
+Signed-off-by: Darren Hart <dvhltc@us.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Ingo Molnar <mingo@elte.hu>
+CC: Eric Dumazet <eric.dumazet@gmail.com>
+CC: Dinakar Guniguntala <dino@in.ibm.com>
+CC: John Stultz <johnstul@us.ibm.com>
+LKML-Reference: <4AD60687.10306@us.ibm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -150,7 +150,8 @@ static struct futex_hash_bucket *hash_fu
+ */
+ static inline int match_futex(union futex_key *key1, union futex_key *key2)
+ {
+- return (key1->both.word == key2->both.word
++ return (key1 && key2
++ && key1->both.word == key2->both.word
+ && key1->both.ptr == key2->both.ptr
+ && key1->both.offset == key2->both.offset);
+ }
--- /dev/null
+From 11df6dddcbc38affb7473aad3d962baf8414a947 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 28 Oct 2009 20:26:48 +0100
+Subject: futex: Fix spurious wakeup for requeue_pi really
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit 11df6dddcbc38affb7473aad3d962baf8414a947 upstream.
+
+The requeue_pi path doesn't use unqueue_me() (and the racy lock_ptr ==
+NULL test) nor does it use the wake_list of futex_wake() which where
+the reason for commit 41890f2 (futex: Handle spurious wake up)
+
+See debugging discussing on LKML Message-ID: <4AD4080C.20703@us.ibm.com>
+
+The changes in this fix to the wait_requeue_pi path were considered to
+be a likely unecessary, but harmless safety net. But it turns out that
+due to the fact that for unknown $@#!*( reasons EWOULDBLOCK is defined
+as EAGAIN we built an endless loop in the code path which returns
+correctly EWOULDBLOCK.
+
+Spurious wakeups in wait_requeue_pi code path are unlikely so we do
+the easy solution and return EWOULDBLOCK^WEAGAIN to user space and let
+it deal with the spurious wakeup.
+
+Cc: Darren Hart <dvhltc@us.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: John Stultz <johnstul@linux.vnet.ibm.com>
+Cc: Dinakar Guniguntala <dino@in.ibm.com>
+LKML-Reference: <4AE23C74.1090502@us.ibm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 6 +-----
+ 1 file changed, 1 insertion(+), 5 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2103,7 +2103,7 @@ int handle_early_requeue_pi_wakeup(struc
+ plist_del(&q->list, &q->list.plist);
+
+ /* Handle spurious wakeups gracefully */
+- ret = -EAGAIN;
++ ret = -EWOULDBLOCK;
+ if (timeout && !timeout->task)
+ ret = -ETIMEDOUT;
+ else if (signal_pending(current))
+@@ -2184,7 +2184,6 @@ static int futex_wait_requeue_pi(u32 __u
+ debug_rt_mutex_init_waiter(&rt_waiter);
+ rt_waiter.task = NULL;
+
+-retry:
+ key2 = FUTEX_KEY_INIT;
+ ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE);
+ if (unlikely(ret != 0))
+@@ -2282,9 +2281,6 @@ out_put_keys:
+ out_key2:
+ put_futex_key(fshared, &key2);
+
+- /* Spurious wakeup ? */
+- if (ret == -EAGAIN)
+- goto retry;
+ out:
+ if (to) {
+ hrtimer_cancel(&to->timer);
--- /dev/null
+From d58e6576b0deec6f0b9ff8450fe282da18c50883 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Tue, 13 Oct 2009 20:40:43 +0200
+Subject: futex: Handle spurious wake up
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+commit d58e6576b0deec6f0b9ff8450fe282da18c50883 upstream.
+
+The futex code does not handle spurious wake up in futex_wait and
+futex_wait_requeue_pi.
+
+The code assumes that any wake up which was not caused by futex_wake /
+requeue or by a timeout was caused by a signal wake up and returns one
+of the syscall restart error codes.
+
+In case of a spurious wake up the signal delivery code which deals
+with the restart error codes is not invoked and we return that error
+code to user space. That causes applications which actually check the
+return codes to fail. Blaise reported that on preempt-rt a python test
+program run into a exception trap. -rt exposed that due to a built in
+spurious wake up accelerator :)
+
+Solve this by checking signal_pending(current) in the wake up path and
+handle the spurious wake up case w/o returning to user space.
+
+Reported-by: Blaise Gassend <blaise@willowgarage.com>
+Debugged-by: Darren Hart <dvhltc@us.ibm.com>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1767,6 +1767,7 @@ static int futex_wait(u32 __user *uaddr,
+ current->timer_slack_ns);
+ }
+
++retry:
+ /* Prepare to wait on uaddr. */
+ ret = futex_wait_setup(uaddr, val, fshared, &q, &hb);
+ if (ret)
+@@ -1784,9 +1785,14 @@ static int futex_wait(u32 __user *uaddr,
+ goto out_put_key;
+
+ /*
+- * We expect signal_pending(current), but another thread may
+- * have handled it for us already.
++ * We expect signal_pending(current), but we might be the
++ * victim of a spurious wakeup as well.
+ */
++ if (!signal_pending(current)) {
++ put_futex_key(fshared, &q.key);
++ goto retry;
++ }
++
+ ret = -ERESTARTSYS;
+ if (!abs_time)
+ goto out_put_key;
+@@ -2094,9 +2100,11 @@ int handle_early_requeue_pi_wakeup(struc
+ */
+ plist_del(&q->list, &q->list.plist);
+
++ /* Handle spurious wakeups gracefully */
++ ret = -EAGAIN;
+ if (timeout && !timeout->task)
+ ret = -ETIMEDOUT;
+- else
++ else if (signal_pending(current))
+ ret = -ERESTARTNOINTR;
+ }
+ return ret;
+@@ -2174,6 +2182,7 @@ static int futex_wait_requeue_pi(u32 __u
+ debug_rt_mutex_init_waiter(&rt_waiter);
+ rt_waiter.task = NULL;
+
++retry:
+ key2 = FUTEX_KEY_INIT;
+ ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE);
+ if (unlikely(ret != 0))
+@@ -2271,6 +2280,9 @@ out_put_keys:
+ out_key2:
+ put_futex_key(fshared, &key2);
+
++ /* Spurious wakeup ? */
++ if (ret == -EAGAIN)
++ goto retry;
+ out:
+ if (to) {
+ hrtimer_cancel(&to->timer);
--- /dev/null
+From 89061d3d58e1f0742139605dc6a7950aa1ecc019 Mon Sep 17 00:00:00 2001
+From: Darren Hart <dvhltc@us.ibm.com>
+Date: Thu, 15 Oct 2009 15:30:48 -0700
+Subject: futex: Move drop_futex_key_refs out of spinlock'ed region
+
+From: Darren Hart <dvhltc@us.ibm.com>
+
+commit 89061d3d58e1f0742139605dc6a7950aa1ecc019 upstream.
+
+When requeuing tasks from one futex to another, the reference held
+by the requeued task to the original futex location needs to be
+dropped eventually.
+
+Dropping the reference may ultimately lead to a call to
+"iput_final" and subsequently call into filesystem- specific code -
+which may be non-atomic.
+
+It is therefore safer to defer this drop operation until after the
+futex_hash_bucket spinlock has been dropped.
+
+Originally-From: Helge Bahmann <hcb@chaoticmind.net>
+Signed-off-by: Darren Hart <dvhltc@us.ibm.com>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: Dinakar Guniguntala <dino@in.ibm.com>
+Cc: John Stultz <johnstul@linux.vnet.ibm.com>
+Cc: Sven-Thorsten Dietrich <sdietrich@novell.com>
+Cc: John Kacur <jkacur@redhat.com>
+LKML-Reference: <4AD7A298.5040802@us.ibm.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/futex.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -1028,7 +1028,6 @@ static inline
+ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
+ struct futex_hash_bucket *hb)
+ {
+- drop_futex_key_refs(&q->key);
+ get_futex_key_refs(key);
+ q->key = *key;
+
+@@ -1226,6 +1225,7 @@ retry_private:
+ */
+ if (ret == 1) {
+ WARN_ON(pi_state);
++ drop_count++;
+ task_count++;
+ ret = get_futex_value_locked(&curval2, uaddr2);
+ if (!ret)
+@@ -1304,6 +1304,7 @@ retry_private:
+ if (ret == 1) {
+ /* We got the lock. */
+ requeue_pi_wake_futex(this, &key2, hb2);
++ drop_count++;
+ continue;
+ } else if (ret) {
+ /* -EDEADLK */
--- /dev/null
+From 5c36fe3d87b3f0c85894a49193c66096a3d6b26f Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Mon, 26 Oct 2009 16:49:51 -0700
+Subject: hfsplus: refuse to mount volumes larger than 2TB
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit 5c36fe3d87b3f0c85894a49193c66096a3d6b26f upstream.
+
+As found in <http://bugs.debian.org/550010>, hfsplus is using type u32
+rather than sector_t for some sector number calculations.
+
+In particular, hfsplus_get_block() does:
+
+ u32 ablock, dblock, mask;
+...
+ map_bh(bh_result, sb, (dblock << HFSPLUS_SB(sb).fs_shift) + HFSPLUS_SB(sb).blockoffset + (iblock & mask));
+
+I am not confident that I can find and fix all cases where a sector number
+may be truncated. For now, avoid data loss by refusing to mount HFS+
+volumes with more than 2^32 sectors (2TB).
+
+[akpm@linux-foundation.org: fix 32 and 64-bit issues]
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Cc: Eric Sesterhenn <snakebyte@gmx.de>
+Cc: Roman Zippel <zippel@linux-m68k.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/hfsplus/wrapper.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/fs/hfsplus/wrapper.c
++++ b/fs/hfsplus/wrapper.c
+@@ -99,6 +99,10 @@ int hfsplus_read_wrapper(struct super_bl
+
+ if (hfsplus_get_last_session(sb, &part_start, &part_size))
+ return -EINVAL;
++ if ((u64)part_start + part_size > 0x100000000ULL) {
++ pr_err("hfs: volumes larger than 2TB are not supported yet\n");
++ return -EINVAL;
++ }
+ while (1) {
+ bh = sb_bread512(sb, part_start + HFSPLUS_VOLHEAD_SECTOR, vhdr);
+ if (!bh)
--- /dev/null
+From 5f5eeff4c93256ee93435a3bf08cf18c45e9a994 Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Mon, 12 Oct 2009 21:35:00 -0700
+Subject: Input: synaptics - add another Protege M300 to rate blacklist
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 5f5eeff4c93256ee93435a3bf08cf18c45e9a994 upstream.
+
+Apparently some of Toshiba Protege M300 identify themselves as
+"Portable PC" in DMI so we need to add that to the DMI table as
+well. We need DMI data so we can automatically lower Synaptics
+reporting rate from 80 to 40 pps to avoid over-taxing their
+keyboard controllers.
+
+Tested-by: Rod Davison <roddavison@gmail.com>
+Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/input/mouse/synaptics.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -652,6 +652,16 @@ static const struct dmi_system_id toshib
+ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
+ },
++
++ },
++ {
++ .ident = "Toshiba Portege M300",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
++ DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"),
++ },
++
+ },
+ { }
+ };
--- /dev/null
+From 1fdbd48c242db996107f72ae4140ffe8163e26a8 Mon Sep 17 00:00:00 2001
+From: Andre Przywara <andre.przywara@amd.com>
+Date: Wed, 24 Jun 2009 12:44:34 +0200
+Subject: KVM: ignore reads from AMDs C1E enabled MSR
+
+From: Andre Przywara <andre.przywara@amd.com>
+
+commit 1fdbd48c242db996107f72ae4140ffe8163e26a8 upstream.
+
+If the Linux kernel detects an C1E capable AMD processor (K8 RevF and
+higher), it will access a certain MSR on every attempt to go to halt.
+Explicitly handle this read and return 0 to let KVM run a Linux guest
+with the native AMD host CPU propagated to the guest.
+
+Signed-off-by: Andre Przywara <andre.przywara@amd.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/x86.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -949,6 +949,7 @@ int kvm_get_msr_common(struct kvm_vcpu *
+ case MSR_P6_EVNTSEL0:
+ case MSR_P6_EVNTSEL1:
+ case MSR_K7_EVNTSEL0:
++ case MSR_K8_INT_PENDING_MSG:
+ data = 0;
+ break;
+ case MSR_MTRRcap:
--- /dev/null
+From ace1546487a0fe4634e3251067f8a32cb2cdc099 Mon Sep 17 00:00:00 2001
+From: Marcelo Tosatti <mtosatti@redhat.com>
+Date: Thu, 8 Oct 2009 10:55:03 -0300
+Subject: KVM: use proper hrtimer function to retrieve expiration time
+
+From: Marcelo Tosatti <mtosatti@redhat.com>
+
+commit ace1546487a0fe4634e3251067f8a32cb2cdc099 upstream.
+
+hrtimer->base can be temporarily NULL due to racing hrtimer_start.
+See switch_hrtimer_base/lock_hrtimer_base.
+
+Use hrtimer_get_remaining which is robust against it.
+
+Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
+Signed-off-by: Avi Kivity <avi@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kvm/i8254.c | 2 +-
+ arch/x86/kvm/lapic.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kvm/i8254.c
++++ b/arch/x86/kvm/i8254.c
+@@ -116,7 +116,7 @@ static s64 __kpit_elapsed(struct kvm *kv
+ * itself with the initial count and continues counting
+ * from there.
+ */
+- remaining = hrtimer_expires_remaining(&ps->pit_timer.timer);
++ remaining = hrtimer_get_remaining(&ps->pit_timer.timer);
+ elapsed = ps->pit_timer.period - ktime_to_ns(remaining);
+ elapsed = mod_64(elapsed, ps->pit_timer.period);
+
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -464,7 +464,7 @@ static u32 apic_get_tmcct(struct kvm_lap
+ if (apic_get_reg(apic, APIC_TMICT) == 0)
+ return 0;
+
+- remaining = hrtimer_expires_remaining(&apic->lapic_timer.timer);
++ remaining = hrtimer_get_remaining(&apic->lapic_timer.timer);
+ if (ktime_to_ns(remaining) < 0)
+ remaining = ktime_set(0, 0);
+
--- /dev/null
+From f4b31db92d163df8a639f5a8c8633bdeb6e8432d Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Fri, 16 Oct 2009 13:00:51 +0900
+Subject: libata: fix internal command failure handling
+
+From: Tejun Heo <tj@kernel.org>
+
+commit f4b31db92d163df8a639f5a8c8633bdeb6e8432d upstream.
+
+When an internal command fails, it should be failed directly without
+invoking EH. In the original implemetation, this was accomplished by
+letting internal command bypass failure handling in ata_qc_complete().
+However, later changes added post-successful-completion handling to
+that code path and the success path is no longer adequate as internal
+command failure path. One of the visible problems is that internal
+command failure due to timeout or other freeze conditions would
+spuriously trigger WARN_ON_ONCE() in the success path.
+
+This patch updates failure path such that internal command failure
+handling is contained there.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-core.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -5008,12 +5008,14 @@ void ata_qc_complete(struct ata_queued_c
+ qc->flags |= ATA_QCFLAG_FAILED;
+
+ if (unlikely(qc->flags & ATA_QCFLAG_FAILED)) {
+- if (!ata_tag_internal(qc->tag)) {
+- /* always fill result TF for failed qc */
+- fill_result_tf(qc);
++ /* always fill result TF for failed qc */
++ fill_result_tf(qc);
++
++ if (!ata_tag_internal(qc->tag))
+ ata_qc_schedule_eh(qc);
+- return;
+- }
++ else
++ __ata_qc_complete(qc);
++ return;
+ }
+
+ /* read result TF if requested */
--- /dev/null
+From 4f7c2874995ac48a4622755b8bd159eb2fb6d8f4 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Thu, 15 Oct 2009 23:37:32 +0900
+Subject: libata: fix PMP initialization
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 4f7c2874995ac48a4622755b8bd159eb2fb6d8f4 upstream.
+
+Commit 842faa6c1a1d6faddf3377948e5cf214812c6c90 fixed error handling
+during attach by not committing detected device class to dev->class
+while attaching a new device. However, this change missed the PMP
+class check in the configuration loop causing a new PMP device to go
+through ata_dev_configure() as if it were an ATA or ATAPI device.
+
+As PMP device doesn't have a regular IDENTIFY data, this makes
+ata_dev_configure() tries to configure a PMP device using an invalid
+data. For the most part, it wasn't too harmful and went unnoticed but
+this ends up clearing dev->flags which may have ATA_DFLAG_AN set by
+sata_pmp_attach(). This means that SATA_PMP_FEAT_NOTIFY ends up being
+disabled on PMPs and on PMPs which honor the flag breaks hotplug
+support.
+
+This problem was discovered and reported by Ethan Hsiao.
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: Ethan Hsiao <ethanhsiao@jmicron.com>
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/libata-eh.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/libata-eh.c
++++ b/drivers/ata/libata-eh.c
+@@ -2849,12 +2849,14 @@ static int ata_eh_revalidate_and_attach(
+ * device detection messages backwards.
+ */
+ ata_for_each_dev(dev, link, ALL) {
+- if (!(new_mask & (1 << dev->devno)) ||
+- dev->class == ATA_DEV_PMP)
++ if (!(new_mask & (1 << dev->devno)))
+ continue;
+
+ dev->class = ehc->classes[dev->devno];
+
++ if (dev->class == ATA_DEV_PMP)
++ continue;
++
+ ehc->i.flags |= ATA_EHI_PRINTINFO;
+ rc = ata_dev_configure(dev);
+ ehc->i.flags &= ~ATA_EHI_PRINTINFO;
--- /dev/null
+From ab8a3e14e6f8e567560f664bbd29aefb306a274e Mon Sep 17 00:00:00 2001
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Date: Mon, 26 Oct 2009 16:49:58 -0700
+Subject: mbind(): fix leak of never putback pages
+
+From: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+
+commit ab8a3e14e6f8e567560f664bbd29aefb306a274e upstream.
+
+If mbind() receives an invalid address, do_mbind leaks a page. The
+following test program detects this leak.
+
+This patch fixes it.
+
+migrate_efault.c
+=======================================
+ #include <numaif.h>
+ #include <numa.h>
+ #include <sys/mman.h>
+ #include <stdio.h>
+ #include <unistd.h>
+ #include <stdlib.h>
+ #include <string.h>
+
+static unsigned long pagesize;
+
+static void* make_hole_mapping(void)
+{
+
+ void* addr;
+
+ addr = mmap(NULL, pagesize*3, PROT_READ|PROT_WRITE,
+ MAP_ANON|MAP_PRIVATE, 0, 0);
+ if (addr == MAP_FAILED)
+ return NULL;
+
+ /* make page populate */
+ memset(addr, 0, pagesize*3);
+
+ /* make memory hole */
+ munmap(addr+pagesize, pagesize);
+
+ return addr;
+}
+
+int main(int argc, char** argv)
+{
+ void* addr;
+ int ch;
+ int node;
+ struct bitmask *nmask = numa_allocate_nodemask();
+ int err;
+ int node_set = 0;
+
+ while ((ch = getopt(argc, argv, "n:")) != -1){
+ switch (ch){
+ case 'n':
+ node = strtol(optarg, NULL, 0);
+ numa_bitmask_setbit(nmask, node);
+ node_set = 1;
+ break;
+ default:
+ ;
+ }
+ }
+ argc -= optind;
+ argv += optind;
+
+ if (!node_set)
+ numa_bitmask_setbit(nmask, 0);
+
+ pagesize = getpagesize();
+
+ addr = make_hole_mapping();
+
+ err = mbind(addr, pagesize*3, MPOL_BIND, nmask->maskp, nmask->size, MPOL_MF_MOVE_ALL);
+ if (err)
+ perror("mbind ");
+
+ return 0;
+}
+=======================================
+
+Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
+Acked-by: Christoph Lameter <cl@linux-foundation.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ mm/mempolicy.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -1058,7 +1058,8 @@ static long do_mbind(unsigned long start
+
+ if (!err && nr_failed && (flags & MPOL_MF_STRICT))
+ err = -EIO;
+- }
++ } else
++ putback_lru_pages(&pagelist);
+
+ up_write(&mm->mmap_sem);
+ mpol_put(new);
--- /dev/null
+From 4223a4a155f245d41c350ed9eba4fc32e965c4da Mon Sep 17 00:00:00 2001
+From: Yinghai Lu <yinghai@kernel.org>
+Date: Tue, 20 Oct 2009 14:13:46 +0900
+Subject: nfs: Fix nfs_parse_mount_options() kfree() leak
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit 4223a4a155f245d41c350ed9eba4fc32e965c4da upstream.
+
+Fix a (small) memory leak in one of the error paths of the NFS mount
+options parsing code.
+
+Regression introduced in 2.6.30 by commit a67d18f (NFS: load the
+rpc/rdma transport module automatically).
+
+Reported-by: Yinghai Lu <yinghai@kernel.org>
+Reported-by: Pekka Enberg <penberg@cs.helsinki.fi>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/nfs/super.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/fs/nfs/super.c
++++ b/fs/nfs/super.c
+@@ -1323,6 +1323,7 @@ static int nfs_parse_mount_options(char
+ default:
+ dfprintk(MOUNT, "NFS: unrecognized "
+ "transport protocol\n");
++ kfree(string);
+ return 0;
+ }
+ break;
--- /dev/null
+From 15b812f1d0a5ca8f5efe7f5882f468af10682ca8 Mon Sep 17 00:00:00 2001
+From: Yinghai Lu <yinghai@kernel.org>
+Date: Sun, 11 Oct 2009 14:17:16 -0700
+Subject: pci: increase alignment to make more space for hidden code
+
+From: Yinghai Lu <yinghai@kernel.org>
+
+commit 15b812f1d0a5ca8f5efe7f5882f468af10682ca8 upstream.
+
+As reported in
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=13940
+
+on some system when acpi are enabled, acpi clears some BAR for some
+devices without reason, and kernel will need to allocate devices for
+them. It then apparently hits some undocumented resource conflict,
+resulting in non-working devices.
+
+Try to increase alignment to get more safe range for unassigned devices.
+
+Signed-off-by: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+
+---
+ arch/x86/kernel/e820.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/x86/kernel/e820.c
++++ b/arch/x86/kernel/e820.c
+@@ -1378,8 +1378,8 @@ static unsigned long ram_alignment(resou
+ if (mb < 16)
+ return 1024*1024;
+
+- /* To 32MB for anything above that */
+- return 32*1024*1024;
++ /* To 64MB for anything above that */
++ return 64*1024*1024;
+ }
+
+ #define MAX_RESOURCE_SIZE ((resource_size_t)-1)
--- /dev/null
+From 575c9ed7798218dc923f319c0d78f0c25ca506b9 Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Tue, 27 Oct 2009 15:35:55 +0000
+Subject: ray_cs: Fix copy_from_user handling
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit 575c9ed7798218dc923f319c0d78f0c25ca506b9 upstream.
+
+I've not touched the other stuff here but the word "locking" comes to mind.
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ray_cs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/wireless/ray_cs.c
++++ b/drivers/net/wireless/ray_cs.c
+@@ -2878,7 +2878,7 @@ static int write_essid(struct file *file
+ unsigned long count, void *data)
+ {
+ static char proc_essid[33];
+- int len = count;
++ unsigned int len = count;
+
+ if (len > 32)
+ len = 32;
--- /dev/null
+From 6489e3262e6b188a1a009b65e8a94b7aa17645b7 Mon Sep 17 00:00:00 2001
+From: Tejun Heo <tj@kernel.org>
+Date: Wed, 14 Oct 2009 11:18:28 +0900
+Subject: sata_nv: make sure link is brough up online when skipping hardreset
+
+From: Tejun Heo <tj@kernel.org>
+
+commit 6489e3262e6b188a1a009b65e8a94b7aa17645b7 upstream.
+
+prereset doesn't bring link online if hardreset is about to happen and
+nv_hardreset() may skip if conditions are not right so softreset may
+be entered with non-working link status if the system firmware didn't
+bring it up before entering OS code which can happen during resume.
+This patch makes nv_hardreset() to bring up the link if it's skipping
+reset.
+
+This bug was reported by frodone@gmail.com in the following bug entry.
+
+ http://bugzilla.kernel.org/show_bug.cgi?id=14329
+
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Reported-by: frodone@gmail.com
+Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ata/sata_nv.c | 18 +++++++++++++++---
+ 1 file changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/ata/sata_nv.c
++++ b/drivers/ata/sata_nv.c
+@@ -1594,9 +1594,21 @@ static int nv_hardreset(struct ata_link
+ !ata_dev_enabled(link->device))
+ sata_link_hardreset(link, sata_deb_timing_hotplug, deadline,
+ NULL, NULL);
+- else if (!(ehc->i.flags & ATA_EHI_QUIET))
+- ata_link_printk(link, KERN_INFO,
+- "nv: skipping hardreset on occupied port\n");
++ else {
++ const unsigned long *timing = sata_ehc_deb_timing(ehc);
++ int rc;
++
++ if (!(ehc->i.flags & ATA_EHI_QUIET))
++ ata_link_printk(link, KERN_INFO, "nv: skipping "
++ "hardreset on occupied port\n");
++
++ /* make sure the link is online */
++ rc = sata_link_resume(link, timing, deadline);
++ /* whine about phy resume failure but proceed */
++ if (rc && rc != -EOPNOTSUPP)
++ ata_link_printk(link, KERN_WARNING, "failed to resume "
++ "link (errno=%d)\n", rc);
++ }
+
+ /* device signature acquisition is unreliable */
+ return -EAGAIN;
--- /dev/null
+fs-pipe.c-null-pointer-dereference.patch
+pci-increase-alignment-to-make-more-space-for-hidden-code.patch
+libata-fix-internal-command-failure-handling.patch
+libata-fix-pmp-initialization.patch
+sata_nv-make-sure-link-is-brough-up-online-when-skipping-hardreset.patch
+nfs-fix-nfs_parse_mount_options-kfree-leak.patch
+kvm-use-proper-hrtimer-function-to-retrieve-expiration-time.patch
+kvm-ignore-reads-from-amds-c1e-enabled-msr.patch
+futex-handle-spurious-wake-up.patch
+futex-check-for-null-keys-in-match_futex.patch
+futex-move-drop_futex_key_refs-out-of-spinlock-ed-region.patch
+futex-fix-spurious-wakeup-for-requeue_pi-really.patch
+ahci-revert-restore-sb600-sata-controller-64-bit-dma.patch
+sparc64-set-irqf_disabled-on-ldc-channel-irqs.patch
+sparc-kill-prom-console-driver.patch
+watchdog-fix-rio-watchdog-probe-function.patch
+input-synaptics-add-another-protege-m300-to-rate-blacklist.patch
+dm-snapshot-free-exception-store-on-init-failure.patch
+dm-snapshot-sort-by-chunk-size-to-fix-race.patch
+dm-log-userspace-fix-incorrect-luid-cast-in-userspace_ctr.patch
+dm-add-missing-del_gendisk-to-alloc_dev-error-path.patch
+dm-dec_pending-needs-locking-to-save-error-value.patch
+dm-exception-store-fix-failed-set_chunk_size-error-path.patch
+dm-snapshot-lock-snapshot-while-supplying-status.patch
+dm-snapshot-require-non-zero-chunk-size-by-end-of-ctr.patch
+dm-snapshot-use-unsigned-integer-chunk-size.patch
+ray_cs-fix-copy_from_user-handling.patch
+mbind-fix-leak-of-never-putback-pages.patch
+do_mbind-fix-memory-leak.patch
+8250_pci-add-ibm-saturn-serial-card.patch
+dpt_i2o-fix-up-copy-user.patch
+dpt_i2o-fix-typo-of-einval.patch
+hfsplus-refuse-to-mount-volumes-larger-than-2tb.patch
+driver-core-fix-driver_register-return-value.patch
+tty-mark-generic_serial-users-as-broken.patch
--- /dev/null
+From bd89468f0c36c1e6022332d81eae214c0173452c Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Tue, 15 Sep 2009 17:04:38 -0700
+Subject: sparc: Kill PROM console driver.
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit 09d3f3f0e02c8a900d076c302c5c02227f33572d ]
+
+Many years ago when this driver was written, it had a use, but these
+days it's nothing but trouble and distributions should not enable it
+in any situation.
+
+Pretty much every console device a sparc machine could see has a
+bonafide real driver, making the PROM console hack unnecessary.
+
+If any new device shows up, we should write a driver instead of
+depending upon this crutch to save us. We've been able to take care
+of this even when no chip documentation exists (sunxvr500, sunxvr2500)
+so there are no excuses.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ Documentation/dontdiff | 1
+ arch/sparc/kernel/setup_32.c | 2
+ arch/sparc/kernel/setup_64.c | 2
+ drivers/char/vt.c | 3
+ drivers/video/console/.gitignore | 2
+ drivers/video/console/Kconfig | 9
+ drivers/video/console/Makefile | 12
+ drivers/video/console/prom.uni | 11
+ drivers/video/console/promcon.c | 598 ---------------------------------------
+ scripts/Makefile | 1
+ 10 files changed, 1 insertion(+), 640 deletions(-)
+
+--- a/arch/sparc/kernel/setup_32.c
++++ b/arch/sparc/kernel/setup_32.c
+@@ -263,8 +263,6 @@ void __init setup_arch(char **cmdline_p)
+
+ #ifdef CONFIG_DUMMY_CONSOLE
+ conswitchp = &dummy_con;
+-#elif defined(CONFIG_PROM_CONSOLE)
+- conswitchp = &prom_con;
+ #endif
+ boot_flags_init(*cmdline_p);
+
+--- a/arch/sparc/kernel/setup_64.c
++++ b/arch/sparc/kernel/setup_64.c
+@@ -295,8 +295,6 @@ void __init setup_arch(char **cmdline_p)
+
+ #ifdef CONFIG_DUMMY_CONSOLE
+ conswitchp = &dummy_con;
+-#elif defined(CONFIG_PROM_CONSOLE)
+- conswitchp = &prom_con;
+ #endif
+
+ idprom_init();
+--- a/Documentation/dontdiff
++++ b/Documentation/dontdiff
+@@ -152,7 +152,6 @@ piggy.gz
+ piggyback
+ pnmtologo
+ ppc_defs.h*
+-promcon_tbl.c
+ pss_boot.h
+ qconf
+ raid6altivec*.c
+--- a/drivers/char/vt.c
++++ b/drivers/char/vt.c
+@@ -2948,9 +2948,6 @@ int __init vty_init(const struct file_op
+ panic("Couldn't register console driver\n");
+ kbd_init();
+ console_map_init();
+-#ifdef CONFIG_PROM_CONSOLE
+- prom_con_init();
+-#endif
+ #ifdef CONFIG_MDA_CONSOLE
+ mda_console_init();
+ #endif
+--- a/drivers/video/console/.gitignore
++++ /dev/null
+@@ -1,2 +0,0 @@
+-# conmakehash generated file
+-promcon_tbl.c
+--- a/drivers/video/console/Kconfig
++++ b/drivers/video/console/Kconfig
+@@ -67,16 +67,9 @@ config SGI_NEWPORT_CONSOLE
+
+ # bool 'IODC console' CONFIG_IODC_CONSOLE
+
+-config PROM_CONSOLE
+- bool "PROM console"
+- depends on SPARC
+- help
+- Say Y to build a console driver for Sun machines that uses the
+- terminal emulation built into their console PROMS.
+-
+ config DUMMY_CONSOLE
+ bool
+- depends on PROM_CONSOLE!=y || VGA_CONSOLE!=y || SGI_NEWPORT_CONSOLE!=y
++ depends on VGA_CONSOLE!=y || SGI_NEWPORT_CONSOLE!=y
+ default y
+
+ config DUMMY_CONSOLE_COLUMNS
+--- a/drivers/video/console/Makefile
++++ b/drivers/video/console/Makefile
+@@ -22,7 +22,6 @@ font-objs += $(font-objs-y)
+
+ obj-$(CONFIG_DUMMY_CONSOLE) += dummycon.o
+ obj-$(CONFIG_SGI_NEWPORT_CONSOLE) += newport_con.o font.o
+-obj-$(CONFIG_PROM_CONSOLE) += promcon.o promcon_tbl.o
+ obj-$(CONFIG_STI_CONSOLE) += sticon.o sticore.o font.o
+ obj-$(CONFIG_VGA_CONSOLE) += vgacon.o
+ obj-$(CONFIG_MDA_CONSOLE) += mdacon.o
+@@ -40,14 +39,3 @@ obj-$(CONFIG_FB_STI) += sti
+ ifeq ($(CONFIG_USB_SISUSBVGA_CON),y)
+ obj-$(CONFIG_USB_SISUSBVGA) += font.o
+ endif
+-
+-# Targets that kbuild needs to know about
+-targets := promcon_tbl.c
+-
+-quiet_cmd_conmakehash = CNMKHSH $@
+- cmd_conmakehash = scripts/conmakehash $< | \
+- sed -e '/\#include <[^>]*>/p' -e 's/types/init/' \
+- -e 's/dfont\(_uni.*\]\)/promfont\1 /' > $@
+-
+-$(obj)/promcon_tbl.c: $(src)/prom.uni
+- $(call cmd,conmakehash)
+--- a/drivers/video/console/promcon.c
++++ /dev/null
+@@ -1,598 +0,0 @@
+-/* $Id: promcon.c,v 1.17 2000/07/26 23:02:52 davem Exp $
+- * Console driver utilizing PROM sun terminal emulation
+- *
+- * Copyright (C) 1998 Eddie C. Dost (ecd@skynet.be)
+- * Copyright (C) 1998 Jakub Jelinek (jj@ultra.linux.cz)
+- */
+-
+-#include <linux/module.h>
+-#include <linux/kernel.h>
+-#include <linux/errno.h>
+-#include <linux/string.h>
+-#include <linux/mm.h>
+-#include <linux/slab.h>
+-#include <linux/delay.h>
+-#include <linux/console.h>
+-#include <linux/vt_kern.h>
+-#include <linux/selection.h>
+-#include <linux/fb.h>
+-#include <linux/init.h>
+-#include <linux/kd.h>
+-
+-#include <asm/oplib.h>
+-#include <asm/uaccess.h>
+-
+-static short pw = 80 - 1, ph = 34 - 1;
+-static short px, py;
+-static unsigned long promcon_uni_pagedir[2];
+-
+-extern u8 promfont_unicount[];
+-extern u16 promfont_unitable[];
+-
+-#define PROMCON_COLOR 0
+-
+-#if PROMCON_COLOR
+-#define inverted(s) ((((s) & 0x7700) == 0x0700) ? 0 : 1)
+-#else
+-#define inverted(s) (((s) & 0x0800) ? 1 : 0)
+-#endif
+-
+-static __inline__ void
+-promcon_puts(char *buf, int cnt)
+-{
+- prom_printf("%*.*s", cnt, cnt, buf);
+-}
+-
+-static int
+-promcon_start(struct vc_data *conp, char *b)
+-{
+- unsigned short *s = (unsigned short *)
+- (conp->vc_origin + py * conp->vc_size_row + (px << 1));
+- u16 cs;
+-
+- cs = scr_readw(s);
+- if (px == pw) {
+- unsigned short *t = s - 1;
+- u16 ct = scr_readw(t);
+-
+- if (inverted(cs) && inverted(ct))
+- return sprintf(b, "\b\033[7m%c\b\033[@%c\033[m", cs,
+- ct);
+- else if (inverted(cs))
+- return sprintf(b, "\b\033[7m%c\033[m\b\033[@%c", cs,
+- ct);
+- else if (inverted(ct))
+- return sprintf(b, "\b%c\b\033[@\033[7m%c\033[m", cs,
+- ct);
+- else
+- return sprintf(b, "\b%c\b\033[@%c", cs, ct);
+- }
+-
+- if (inverted(cs))
+- return sprintf(b, "\033[7m%c\033[m\b", cs);
+- else
+- return sprintf(b, "%c\b", cs);
+-}
+-
+-static int
+-promcon_end(struct vc_data *conp, char *b)
+-{
+- unsigned short *s = (unsigned short *)
+- (conp->vc_origin + py * conp->vc_size_row + (px << 1));
+- char *p = b;
+- u16 cs;
+-
+- b += sprintf(b, "\033[%d;%dH", py + 1, px + 1);
+-
+- cs = scr_readw(s);
+- if (px == pw) {
+- unsigned short *t = s - 1;
+- u16 ct = scr_readw(t);
+-
+- if (inverted(cs) && inverted(ct))
+- b += sprintf(b, "\b%c\b\033[@\033[7m%c\033[m", cs, ct);
+- else if (inverted(cs))
+- b += sprintf(b, "\b%c\b\033[@%c", cs, ct);
+- else if (inverted(ct))
+- b += sprintf(b, "\b\033[7m%c\b\033[@%c\033[m", cs, ct);
+- else
+- b += sprintf(b, "\b\033[7m%c\033[m\b\033[@%c", cs, ct);
+- return b - p;
+- }
+-
+- if (inverted(cs))
+- b += sprintf(b, "%c\b", cs);
+- else
+- b += sprintf(b, "\033[7m%c\033[m\b", cs);
+- return b - p;
+-}
+-
+-const char *promcon_startup(void)
+-{
+- const char *display_desc = "PROM";
+- int node;
+- char buf[40];
+-
+- node = prom_getchild(prom_root_node);
+- node = prom_searchsiblings(node, "options");
+- if (prom_getproperty(node, "screen-#columns", buf, 40) != -1) {
+- pw = simple_strtoul(buf, NULL, 0);
+- if (pw < 10 || pw > 256)
+- pw = 80;
+- pw--;
+- }
+- if (prom_getproperty(node, "screen-#rows", buf, 40) != -1) {
+- ph = simple_strtoul(buf, NULL, 0);
+- if (ph < 10 || ph > 256)
+- ph = 34;
+- ph--;
+- }
+- promcon_puts("\033[H\033[J", 6);
+- return display_desc;
+-}
+-
+-static void
+-promcon_init_unimap(struct vc_data *conp)
+-{
+- mm_segment_t old_fs = get_fs();
+- struct unipair *p, *p1;
+- u16 *q;
+- int i, j, k;
+-
+- p = kmalloc(256*sizeof(struct unipair), GFP_KERNEL);
+- if (!p) return;
+-
+- q = promfont_unitable;
+- p1 = p;
+- k = 0;
+- for (i = 0; i < 256; i++)
+- for (j = promfont_unicount[i]; j; j--) {
+- p1->unicode = *q++;
+- p1->fontpos = i;
+- p1++;
+- k++;
+- }
+- set_fs(KERNEL_DS);
+- con_clear_unimap(conp, NULL);
+- con_set_unimap(conp, k, p);
+- con_protect_unimap(conp, 1);
+- set_fs(old_fs);
+- kfree(p);
+-}
+-
+-static void
+-promcon_init(struct vc_data *conp, int init)
+-{
+- unsigned long p;
+-
+- conp->vc_can_do_color = PROMCON_COLOR;
+- if (init) {
+- conp->vc_cols = pw + 1;
+- conp->vc_rows = ph + 1;
+- }
+- p = *conp->vc_uni_pagedir_loc;
+- if (conp->vc_uni_pagedir_loc == &conp->vc_uni_pagedir ||
+- !--conp->vc_uni_pagedir_loc[1])
+- con_free_unimap(conp);
+- conp->vc_uni_pagedir_loc = promcon_uni_pagedir;
+- promcon_uni_pagedir[1]++;
+- if (!promcon_uni_pagedir[0] && p) {
+- promcon_init_unimap(conp);
+- }
+- if (!init) {
+- if (conp->vc_cols != pw + 1 || conp->vc_rows != ph + 1)
+- vc_resize(conp, pw + 1, ph + 1);
+- }
+-}
+-
+-static void
+-promcon_deinit(struct vc_data *conp)
+-{
+- /* When closing the last console, reset video origin */
+- if (!--promcon_uni_pagedir[1])
+- con_free_unimap(conp);
+- conp->vc_uni_pagedir_loc = &conp->vc_uni_pagedir;
+- con_set_default_unimap(conp);
+-}
+-
+-static int
+-promcon_switch(struct vc_data *conp)
+-{
+- return 1;
+-}
+-
+-static unsigned short *
+-promcon_repaint_line(unsigned short *s, unsigned char *buf, unsigned char **bp)
+-{
+- int cnt = pw + 1;
+- int attr = -1;
+- unsigned char *b = *bp;
+-
+- while (cnt--) {
+- u16 c = scr_readw(s);
+- if (attr != inverted(c)) {
+- attr = inverted(c);
+- if (attr) {
+- strcpy (b, "\033[7m");
+- b += 4;
+- } else {
+- strcpy (b, "\033[m");
+- b += 3;
+- }
+- }
+- *b++ = c;
+- s++;
+- if (b - buf >= 224) {
+- promcon_puts(buf, b - buf);
+- b = buf;
+- }
+- }
+- *bp = b;
+- return s;
+-}
+-
+-static void
+-promcon_putcs(struct vc_data *conp, const unsigned short *s,
+- int count, int y, int x)
+-{
+- unsigned char buf[256], *b = buf;
+- unsigned short attr = scr_readw(s);
+- unsigned char save;
+- int i, last = 0;
+-
+- if (console_blanked)
+- return;
+-
+- if (count <= 0)
+- return;
+-
+- b += promcon_start(conp, b);
+-
+- if (x + count >= pw + 1) {
+- if (count == 1) {
+- x -= 1;
+- save = scr_readw((unsigned short *)(conp->vc_origin
+- + y * conp->vc_size_row
+- + (x << 1)));
+-
+- if (px != x || py != y) {
+- b += sprintf(b, "\033[%d;%dH", y + 1, x + 1);
+- px = x;
+- py = y;
+- }
+-
+- if (inverted(attr))
+- b += sprintf(b, "\033[7m%c\033[m", scr_readw(s++));
+- else
+- b += sprintf(b, "%c", scr_readw(s++));
+-
+- strcpy(b, "\b\033[@");
+- b += 4;
+-
+- if (inverted(save))
+- b += sprintf(b, "\033[7m%c\033[m", save);
+- else
+- b += sprintf(b, "%c", save);
+-
+- px++;
+-
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+- return;
+- } else {
+- last = 1;
+- count = pw - x - 1;
+- }
+- }
+-
+- if (inverted(attr)) {
+- strcpy(b, "\033[7m");
+- b += 4;
+- }
+-
+- if (px != x || py != y) {
+- b += sprintf(b, "\033[%d;%dH", y + 1, x + 1);
+- px = x;
+- py = y;
+- }
+-
+- for (i = 0; i < count; i++) {
+- if (b - buf >= 224) {
+- promcon_puts(buf, b - buf);
+- b = buf;
+- }
+- *b++ = scr_readw(s++);
+- }
+-
+- px += count;
+-
+- if (last) {
+- save = scr_readw(s++);
+- b += sprintf(b, "%c\b\033[@%c", scr_readw(s++), save);
+- px++;
+- }
+-
+- if (inverted(attr)) {
+- strcpy(b, "\033[m");
+- b += 3;
+- }
+-
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+-}
+-
+-static void
+-promcon_putc(struct vc_data *conp, int c, int y, int x)
+-{
+- unsigned short s;
+-
+- if (console_blanked)
+- return;
+-
+- scr_writew(c, &s);
+- promcon_putcs(conp, &s, 1, y, x);
+-}
+-
+-static void
+-promcon_clear(struct vc_data *conp, int sy, int sx, int height, int width)
+-{
+- unsigned char buf[256], *b = buf;
+- int i, j;
+-
+- if (console_blanked)
+- return;
+-
+- b += promcon_start(conp, b);
+-
+- if (!sx && width == pw + 1) {
+-
+- if (!sy && height == ph + 1) {
+- strcpy(b, "\033[H\033[J");
+- b += 6;
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+- return;
+- } else if (sy + height == ph + 1) {
+- b += sprintf(b, "\033[%dH\033[J", sy + 1);
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+- return;
+- }
+-
+- b += sprintf(b, "\033[%dH", sy + 1);
+- for (i = 1; i < height; i++) {
+- strcpy(b, "\033[K\n");
+- b += 4;
+- }
+-
+- strcpy(b, "\033[K");
+- b += 3;
+-
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+- return;
+-
+- } else if (sx + width == pw + 1) {
+-
+- b += sprintf(b, "\033[%d;%dH", sy + 1, sx + 1);
+- for (i = 1; i < height; i++) {
+- strcpy(b, "\033[K\n");
+- b += 4;
+- }
+-
+- strcpy(b, "\033[K");
+- b += 3;
+-
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+- return;
+- }
+-
+- for (i = sy + 1; i <= sy + height; i++) {
+- b += sprintf(b, "\033[%d;%dH", i, sx + 1);
+- for (j = 0; j < width; j++)
+- *b++ = ' ';
+- if (b - buf + width >= 224) {
+- promcon_puts(buf, b - buf);
+- b = buf;
+- }
+- }
+-
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+-}
+-
+-static void
+-promcon_bmove(struct vc_data *conp, int sy, int sx, int dy, int dx,
+- int height, int width)
+-{
+- char buf[256], *b = buf;
+-
+- if (console_blanked)
+- return;
+-
+- b += promcon_start(conp, b);
+- if (sy == dy && height == 1) {
+- if (dx > sx && dx + width == conp->vc_cols)
+- b += sprintf(b, "\033[%d;%dH\033[%d@\033[%d;%dH",
+- sy + 1, sx + 1, dx - sx, py + 1, px + 1);
+- else if (dx < sx && sx + width == conp->vc_cols)
+- b += sprintf(b, "\033[%d;%dH\033[%dP\033[%d;%dH",
+- dy + 1, dx + 1, sx - dx, py + 1, px + 1);
+-
+- b += promcon_end(conp, b);
+- promcon_puts(buf, b - buf);
+- return;
+- }
+-
+- /*
+- * FIXME: What to do here???
+- * Current console.c should not call it like that ever.
+- */
+- prom_printf("\033[7mFIXME: bmove not handled\033[m\n");
+-}
+-
+-static void
+-promcon_cursor(struct vc_data *conp, int mode)
+-{
+- char buf[32], *b = buf;
+-
+- switch (mode) {
+- case CM_ERASE:
+- break;
+-
+- case CM_MOVE:
+- case CM_DRAW:
+- b += promcon_start(conp, b);
+- if (px != conp->vc_x || py != conp->vc_y) {
+- px = conp->vc_x;
+- py = conp->vc_y;
+- b += sprintf(b, "\033[%d;%dH", py + 1, px + 1);
+- }
+- promcon_puts(buf, b - buf);
+- break;
+- }
+-}
+-
+-static int
+-promcon_blank(struct vc_data *conp, int blank, int mode_switch)
+-{
+- if (blank) {
+- promcon_puts("\033[H\033[J\033[7m \033[m\b", 15);
+- return 0;
+- } else {
+- /* Let console.c redraw */
+- return 1;
+- }
+-}
+-
+-static int
+-promcon_scroll(struct vc_data *conp, int t, int b, int dir, int count)
+-{
+- unsigned char buf[256], *p = buf;
+- unsigned short *s;
+- int i;
+-
+- if (console_blanked)
+- return 0;
+-
+- p += promcon_start(conp, p);
+-
+- switch (dir) {
+- case SM_UP:
+- if (b == ph + 1) {
+- p += sprintf(p, "\033[%dH\033[%dM", t + 1, count);
+- px = 0;
+- py = t;
+- p += promcon_end(conp, p);
+- promcon_puts(buf, p - buf);
+- break;
+- }
+-
+- s = (unsigned short *)(conp->vc_origin
+- + (t + count) * conp->vc_size_row);
+-
+- p += sprintf(p, "\033[%dH", t + 1);
+-
+- for (i = t; i < b - count; i++)
+- s = promcon_repaint_line(s, buf, &p);
+-
+- for (; i < b - 1; i++) {
+- strcpy(p, "\033[K\n");
+- p += 4;
+- if (p - buf >= 224) {
+- promcon_puts(buf, p - buf);
+- p = buf;
+- }
+- }
+-
+- strcpy(p, "\033[K");
+- p += 3;
+-
+- p += promcon_end(conp, p);
+- promcon_puts(buf, p - buf);
+- break;
+-
+- case SM_DOWN:
+- if (b == ph + 1) {
+- p += sprintf(p, "\033[%dH\033[%dL", t + 1, count);
+- px = 0;
+- py = t;
+- p += promcon_end(conp, p);
+- promcon_puts(buf, p - buf);
+- break;
+- }
+-
+- s = (unsigned short *)(conp->vc_origin + t * conp->vc_size_row);
+-
+- p += sprintf(p, "\033[%dH", t + 1);
+-
+- for (i = t; i < t + count; i++) {
+- strcpy(p, "\033[K\n");
+- p += 4;
+- if (p - buf >= 224) {
+- promcon_puts(buf, p - buf);
+- p = buf;
+- }
+- }
+-
+- for (; i < b; i++)
+- s = promcon_repaint_line(s, buf, &p);
+-
+- p += promcon_end(conp, p);
+- promcon_puts(buf, p - buf);
+- break;
+- }
+-
+- return 0;
+-}
+-
+-#if !(PROMCON_COLOR)
+-static u8 promcon_build_attr(struct vc_data *conp, u8 _color, u8 _intensity,
+- u8 _blink, u8 _underline, u8 _reverse, u8 _italic)
+-{
+- return (_reverse) ? 0xf : 0x7;
+-}
+-#endif
+-
+-/*
+- * The console 'switch' structure for the VGA based console
+- */
+-
+-static int promcon_dummy(void)
+-{
+- return 0;
+-}
+-
+-#define DUMMY (void *) promcon_dummy
+-
+-const struct consw prom_con = {
+- .owner = THIS_MODULE,
+- .con_startup = promcon_startup,
+- .con_init = promcon_init,
+- .con_deinit = promcon_deinit,
+- .con_clear = promcon_clear,
+- .con_putc = promcon_putc,
+- .con_putcs = promcon_putcs,
+- .con_cursor = promcon_cursor,
+- .con_scroll = promcon_scroll,
+- .con_bmove = promcon_bmove,
+- .con_switch = promcon_switch,
+- .con_blank = promcon_blank,
+- .con_set_palette = DUMMY,
+- .con_scrolldelta = DUMMY,
+-#if !(PROMCON_COLOR)
+- .con_build_attr = promcon_build_attr,
+-#endif
+-};
+-
+-void __init prom_con_init(void)
+-{
+-#ifdef CONFIG_DUMMY_CONSOLE
+- if (conswitchp == &dummy_con)
+- take_over_console(&prom_con, 0, MAX_NR_CONSOLES-1, 1);
+- else
+-#endif
+- if (conswitchp == &prom_con)
+- promcon_init_unimap(vc_cons[fg_console].d);
+-}
+--- a/drivers/video/console/prom.uni
++++ /dev/null
+@@ -1,11 +0,0 @@
+-#
+-# Unicode mapping table for font in Sun PROM
+-#
+-#
+-0x20-0x7e idem
+-0xa0-0xff idem
+-#
+-0x7c U+2502
+-0x2d U+2500
+-0x2b U+250c U+2510 U+2514 U+2518 U+251c U+2524 U+252c U+2534 U+253c
+-0xa4 U+fffd
+--- a/scripts/Makefile
++++ b/scripts/Makefile
+@@ -10,7 +10,6 @@
+ hostprogs-$(CONFIG_KALLSYMS) += kallsyms
+ hostprogs-$(CONFIG_LOGO) += pnmtologo
+ hostprogs-$(CONFIG_VT) += conmakehash
+-hostprogs-$(CONFIG_PROM_CONSOLE) += conmakehash
+ hostprogs-$(CONFIG_IKCONFIG) += bin2c
+
+ always := $(hostprogs-y) $(hostprogs-m)
--- /dev/null
+From 750663bb2efbcb409eefa1c817b56f9ff7a06e6f Mon Sep 17 00:00:00 2001
+From: David S. Miller <davem@davemloft.net>
+Date: Tue, 13 Oct 2009 00:49:09 -0700
+Subject: sparc64: Set IRQF_DISABLED on LDC channel IRQs.
+
+From: David S. Miller <davem@davemloft.net>
+
+[ Upstream commit c58543c869606532c2382f027d6466f4672ea756 ]
+
+With lots of virtual devices it's easy to generate a lot of
+events and chew up the kernel IRQ stack.
+
+Reported-by: hyl <heyongli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/sparc/kernel/ldc.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/sparc/kernel/ldc.c
++++ b/arch/sparc/kernel/ldc.c
+@@ -1242,13 +1242,13 @@ int ldc_bind(struct ldc_channel *lp, con
+ snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name);
+
+ err = request_irq(lp->cfg.rx_irq, ldc_rx,
+- IRQF_SAMPLE_RANDOM | IRQF_SHARED,
++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED,
+ lp->rx_irq_name, lp);
+ if (err)
+ return err;
+
+ err = request_irq(lp->cfg.tx_irq, ldc_tx,
+- IRQF_SAMPLE_RANDOM | IRQF_SHARED,
++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED,
+ lp->tx_irq_name, lp);
+ if (err) {
+ free_irq(lp->cfg.rx_irq, lp);
--- /dev/null
+From 412145947adfca60a4b5b4893fbae82dffa25edd Mon Sep 17 00:00:00 2001
+From: Alan Cox <alan@linux.intel.com>
+Date: Thu, 29 Oct 2009 12:16:22 +0000
+Subject: tty: Mark generic_serial users as BROKEN
+
+From: Alan Cox <alan@linux.intel.com>
+
+commit 412145947adfca60a4b5b4893fbae82dffa25edd upstream.
+
+There isn't much else I can do with these. I can find no hardware for any
+of them and no users. The code is broken.
+
+Signed-off-by: Alan Cox <alan@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/m68k/Kconfig | 6 +++---
+ drivers/char/Kconfig | 6 +++---
+ 2 files changed, 6 insertions(+), 6 deletions(-)
+
+--- a/arch/m68k/Kconfig
++++ b/arch/m68k/Kconfig
+@@ -555,7 +555,7 @@ config HPAPCI
+
+ config MVME147_SCC
+ bool "SCC support for MVME147 serial ports"
+- depends on MVME147
++ depends on MVME147 && BROKEN
+ help
+ This is the driver for the serial ports on the Motorola MVME147
+ boards. Everyone using one of these boards should say Y here.
+@@ -570,14 +570,14 @@ config SERIAL167
+
+ config MVME162_SCC
+ bool "SCC support for MVME162 serial ports"
+- depends on MVME16x
++ depends on MVME16x && BROKEN
+ help
+ This is the driver for the serial ports on the Motorola MVME162 and
+ 172 boards. Everyone using one of these boards should say Y here.
+
+ config BVME6000_SCC
+ bool "SCC support for BVME6000 serial ports"
+- depends on BVME6000
++ depends on BVME6000 && BROKEN
+ help
+ This is the driver for the serial ports on the BVME4000 and BVME6000
+ boards from BVM Ltd. Everyone using one of these boards should say
+--- a/drivers/char/Kconfig
++++ b/drivers/char/Kconfig
+@@ -323,7 +323,7 @@ config SPECIALIX
+
+ config SX
+ tristate "Specialix SX (and SI) card support"
+- depends on SERIAL_NONSTANDARD && (PCI || EISA || ISA)
++ depends on SERIAL_NONSTANDARD && (PCI || EISA || ISA) && BROKEN
+ help
+ This is a driver for the SX and SI multiport serial cards.
+ Please read the file <file:Documentation/serial/sx.txt> for details.
+@@ -334,7 +334,7 @@ config SX
+
+ config RIO
+ tristate "Specialix RIO system support"
+- depends on SERIAL_NONSTANDARD
++ depends on SERIAL_NONSTANDARD && BROKEN
+ help
+ This is a driver for the Specialix RIO, a smart serial card which
+ drives an outboard box that can support up to 128 ports. Product
+@@ -395,7 +395,7 @@ config NOZOMI
+
+ config A2232
+ tristate "Commodore A2232 serial support (EXPERIMENTAL)"
+- depends on EXPERIMENTAL && ZORRO && BROKEN_ON_SMP
++ depends on EXPERIMENTAL && ZORRO && BROKEN
+ ---help---
+ This option supports the 2232 7-port serial card shipped with the
+ Amiga 2000 and other Zorro-bus machines, dating from 1989. At
--- /dev/null
+From 366863a7ef5744ac7c4ab02e82c91cfd93782518 Mon Sep 17 00:00:00 2001
+From: Thomas Gleixner <tglx@linutronix.de>
+Date: Wed, 14 Oct 2009 01:18:26 -0700
+Subject: watchdog: Fix rio watchdog probe function
+
+From: Thomas Gleixner <tglx@linutronix.de>
+
+[ Upstream commit 03717e3d12b625268848414e39beda25e4515692 ]
+
+After sucessfully registering the misc device the driver iounmaps the
+hardware registers and kfree's the device data structure. Ouch !
+
+This was introduced with commit e42311d75 (riowatchdog: Convert to
+pure OF driver) and went unnoticed for more than a year :)
+
+Return success instead of dropping into the error cleanup code path.
+
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/watchdog/riowd.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/watchdog/riowd.c
++++ b/drivers/watchdog/riowd.c
+@@ -206,7 +206,7 @@ static int __devinit riowd_probe(struct
+
+ dev_set_drvdata(&op->dev, p);
+ riowd_device = p;
+- err = 0;
++ return 0;
+
+ out_iounmap:
+ of_iounmap(&op->resource[0], p->regs, 2);
projects / thirdparty / kernel / stable-queue.git / commitdiff
