--- /dev/null
+From 9f132652d94c96476b0b0a8caf0c10e96ab10fa8 Mon Sep 17 00:00:00 2001
+From: Pavel Vasilyev <pavel@pavlinux.ru>
+Date: Tue, 5 Jun 2012 00:02:05 -0400
+Subject: ACPI sysfs.c strlen fix
+
+From: Pavel Vasilyev <pavel@pavlinux.ru>
+
+commit 9f132652d94c96476b0b0a8caf0c10e96ab10fa8 upstream.
+
+Current code is ignoring the last character of "enable" and "disable"
+in comparisons.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=33732
+
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/acpi/sysfs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/acpi/sysfs.c
++++ b/drivers/acpi/sysfs.c
+@@ -173,7 +173,7 @@ static int param_set_trace_state(const c
+ {
+ int result = 0;
+
+- if (!strncmp(val, "enable", strlen("enable") - 1)) {
++ if (!strncmp(val, "enable", strlen("enable"))) {
+ result = acpi_debug_trace(trace_method_name, trace_debug_level,
+ trace_debug_layer, 0);
+ if (result)
+@@ -181,7 +181,7 @@ static int param_set_trace_state(const c
+ goto exit;
+ }
+
+- if (!strncmp(val, "disable", strlen("disable") - 1)) {
++ if (!strncmp(val, "disable", strlen("disable"))) {
+ int name = 0;
+ result = acpi_debug_trace((char *)&name, trace_debug_level,
+ trace_debug_layer, 0);
--- /dev/null
+From 76eb9a30db4bc8fd172f9155247264b5f2686d7b Mon Sep 17 00:00:00 2001
+From: Zhang Rui <rui.zhang@intel.com>
+Date: Mon, 20 Feb 2012 14:20:06 +0800
+Subject: ACPI, x86: fix Dell M6600 ACPI reboot regression via DMI
+
+From: Zhang Rui <rui.zhang@intel.com>
+
+commit 76eb9a30db4bc8fd172f9155247264b5f2686d7b upstream.
+
+Dell Precision M6600 is known to require PCI reboot, so add it to
+the reboot blacklist in pci_reboot_dmi_table[].
+
+https://bugzilla.kernel.org/show_bug.cgi?id=42749
+
+cc: x86@kernel.org
+Signed-off-by: Zhang Rui <rui.zhang@intel.com>
+Signed-off-by: Len Brown <len.brown@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/reboot.c | 8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -471,6 +471,14 @@ static struct dmi_system_id __initdata p
+ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 990"),
+ },
+ },
++ { /* Handle problems with rebooting on the Precision M6600. */
++ .callback = set_pci_reboot,
++ .ident = "Dell OptiPlex 990",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Precision M6600"),
++ },
++ },
+ { }
+ };
+
--- /dev/null
+From 0fa1f0609a0c1fe8b2be3c0089a2cb48f7fda521 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Fri, 22 Jun 2012 08:54:02 +0200
+Subject: ARM: Orion: Fix Virtual/Physical mixup with watchdog
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+commit 0fa1f0609a0c1fe8b2be3c0089a2cb48f7fda521 upstream.
+
+The orion watchdog is expecting to be passed the physcial address of
+the hardware, and will ioremap() it to give a virtual address it will
+use as the base address for the hardware. However, when creating the
+platform resource record, a virtual address was being used.
+
+Add the necassary #define's so we can pass the physical address as
+expected.
+
+Tested on Kirkwood and Orion5x.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-kirkwood/include/mach/bridge-regs.h | 1 +
+ arch/arm/mach-kirkwood/include/mach/kirkwood.h | 1 +
+ arch/arm/mach-orion5x/include/mach/bridge-regs.h | 2 +-
+ arch/arm/mach-orion5x/include/mach/orion5x.h | 1 +
+ arch/arm/plat-orion/common.c | 2 +-
+ 5 files changed, 5 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/mach-kirkwood/include/mach/bridge-regs.h
++++ b/arch/arm/mach-kirkwood/include/mach/bridge-regs.h
+@@ -38,6 +38,7 @@
+ #define IRQ_MASK_HIGH_OFF 0x0014
+
+ #define TIMER_VIRT_BASE (BRIDGE_VIRT_BASE | 0x0300)
++#define TIMER_PHYS_BASE (BRIDGE_PHYS_BASE | 0x0300)
+
+ #define L2_CONFIG_REG (BRIDGE_VIRT_BASE | 0x0128)
+ #define L2_WRITETHROUGH 0x00000010
+--- a/arch/arm/mach-kirkwood/include/mach/kirkwood.h
++++ b/arch/arm/mach-kirkwood/include/mach/kirkwood.h
+@@ -80,6 +80,7 @@
+ #define UART1_VIRT_BASE (DEV_BUS_VIRT_BASE | 0x2100)
+
+ #define BRIDGE_VIRT_BASE (KIRKWOOD_REGS_VIRT_BASE | 0x20000)
++#define BRIDGE_PHYS_BASE (KIRKWOOD_REGS_PHYS_BASE | 0x20000)
+
+ #define CRYPTO_PHYS_BASE (KIRKWOOD_REGS_PHYS_BASE | 0x30000)
+
+--- a/arch/arm/mach-orion5x/include/mach/bridge-regs.h
++++ b/arch/arm/mach-orion5x/include/mach/bridge-regs.h
+@@ -35,5 +35,5 @@
+ #define MAIN_IRQ_MASK (ORION5X_BRIDGE_VIRT_BASE | 0x204)
+
+ #define TIMER_VIRT_BASE (ORION5X_BRIDGE_VIRT_BASE | 0x300)
+-
++#define TIMER_PHYS_BASE (ORION5X_BRIDGE_PHYS_BASE | 0x300)
+ #endif
+--- a/arch/arm/mach-orion5x/include/mach/orion5x.h
++++ b/arch/arm/mach-orion5x/include/mach/orion5x.h
+@@ -82,6 +82,7 @@
+ #define UART1_VIRT_BASE (ORION5X_DEV_BUS_VIRT_BASE | 0x2100)
+
+ #define ORION5X_BRIDGE_VIRT_BASE (ORION5X_REGS_VIRT_BASE | 0x20000)
++#define ORION5X_BRIDGE_PHYS_BASE (ORION5X_REGS_PHYS_BASE | 0x20000)
+
+ #define ORION5X_PCI_VIRT_BASE (ORION5X_REGS_VIRT_BASE | 0x30000)
+
+--- a/arch/arm/plat-orion/common.c
++++ b/arch/arm/plat-orion/common.c
+@@ -570,7 +570,7 @@ void __init orion_spi_1_init(unsigned lo
+ static struct orion_wdt_platform_data orion_wdt_data;
+
+ static struct resource orion_wdt_resource =
+- DEFINE_RES_MEM(TIMER_VIRT_BASE, 0x28);
++ DEFINE_RES_MEM(TIMER_PHYS_BASE, 0x28);
+
+ static struct platform_device orion_wdt_device = {
+ .name = "orion_wdt",
--- /dev/null
+From 1e0c1ce00d83834d03f4d8d039734ca4703298df Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Fri, 29 Jun 2012 09:25:58 +0200
+Subject: ARM: Orion: Fix WDT compile for Dove and MV78xx0
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+commit 1e0c1ce00d83834d03f4d8d039734ca4703298df upstream.
+
+Commit 0fa1f0609a0c1fe8b2be3c0089a2cb48f7fda521 (ARM: Orion: Fix
+Virtual/Physical mixup with watchdog) broke the Dove & MV78xx0
+build. Although these two SoC don't use the watchdog, the shared
+platform code still needs to build. Add the necessary defines.
+
+Reported-by: Nicolas Pitre <nico@fluxnic.net>
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Tested-by: Nicolas Pitre <nico@fluxnic.net>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-dove/include/mach/bridge-regs.h | 1 +
+ arch/arm/mach-dove/include/mach/dove.h | 1 +
+ arch/arm/mach-mv78xx0/include/mach/bridge-regs.h | 1 +
+ arch/arm/mach-mv78xx0/include/mach/mv78xx0.h | 2 ++
+ 4 files changed, 5 insertions(+)
+
+--- a/arch/arm/mach-dove/include/mach/bridge-regs.h
++++ b/arch/arm/mach-dove/include/mach/bridge-regs.h
+@@ -50,5 +50,6 @@
+ #define POWER_MANAGEMENT (BRIDGE_VIRT_BASE | 0x011c)
+
+ #define TIMER_VIRT_BASE (BRIDGE_VIRT_BASE | 0x0300)
++#define TIMER_PHYS_BASE (BRIDGE_PHYS_BASE | 0x0300)
+
+ #endif
+--- a/arch/arm/mach-dove/include/mach/dove.h
++++ b/arch/arm/mach-dove/include/mach/dove.h
+@@ -78,6 +78,7 @@
+
+ /* North-South Bridge */
+ #define BRIDGE_VIRT_BASE (DOVE_SB_REGS_VIRT_BASE | 0x20000)
++#define BRIDGE_PHYS_BASE (DOVE_SB_REGS_PHYS_BASE | 0x20000)
+
+ /* Cryptographic Engine */
+ #define DOVE_CRYPT_PHYS_BASE (DOVE_SB_REGS_PHYS_BASE | 0x30000)
+--- a/arch/arm/mach-mv78xx0/include/mach/bridge-regs.h
++++ b/arch/arm/mach-mv78xx0/include/mach/bridge-regs.h
+@@ -31,5 +31,6 @@
+ #define IRQ_MASK_HIGH_OFF 0x0014
+
+ #define TIMER_VIRT_BASE (BRIDGE_VIRT_BASE | 0x0300)
++#define TIMER_PHYS_BASE (BRIDGE_PHYS_BASE | 0x0300)
+
+ #endif
+--- a/arch/arm/mach-mv78xx0/include/mach/mv78xx0.h
++++ b/arch/arm/mach-mv78xx0/include/mach/mv78xx0.h
+@@ -42,6 +42,7 @@
+ #define MV78XX0_CORE0_REGS_PHYS_BASE 0xf1020000
+ #define MV78XX0_CORE1_REGS_PHYS_BASE 0xf1024000
+ #define MV78XX0_CORE_REGS_VIRT_BASE 0xfe400000
++#define MV78XX0_CORE_REGS_PHYS_BASE 0xfe400000
+ #define MV78XX0_CORE_REGS_SIZE SZ_16K
+
+ #define MV78XX0_PCIE_IO_PHYS_BASE(i) (0xf0800000 + ((i) << 20))
+@@ -59,6 +60,7 @@
+ * Core-specific peripheral registers.
+ */
+ #define BRIDGE_VIRT_BASE (MV78XX0_CORE_REGS_VIRT_BASE)
++#define BRIDGE_PHYS_BASE (MV78XX0_CORE_REGS_PHYS_BASE)
+
+ /*
+ * Register Map
--- /dev/null
+From 30c1dc0ff30b5552e8af555265dbeac5637cbb48 Mon Sep 17 00:00:00 2001
+From: Tushar Behera <tushar.behera@linaro.org>
+Date: Wed, 23 May 2012 16:47:31 +0530
+Subject: dmaengine: pl330: dont complete descriptor for cyclic dma
+
+From: Tushar Behera <tushar.behera@linaro.org>
+
+commit 30c1dc0ff30b5552e8af555265dbeac5637cbb48 upstream.
+
+Commit eab215855803 ("dmaengine: pl330: dont complete descriptor for
+cyclic dma") wrongly completes descriptor for cyclic dma, hence following
+BUG_ON is still hit with cyclic DMA operations.
+
+kernel BUG at drivers/dma/dmaengine.h:53!
+
+Signed-off-by: Tushar Behera <tushar.behera@linaro.org>
+Acked-by: Jassi Brar <jaswinder.singh@linaro.org>
+Signed-off-by: Vinod Koul <vinod.koul@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/dma/pl330.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2322,7 +2322,7 @@ static void pl330_tasklet(unsigned long
+ /* Pick up ripe tomatoes */
+ list_for_each_entry_safe(desc, _dt, &pch->work_list, node)
+ if (desc->status == DONE) {
+- if (pch->cyclic)
++ if (!pch->cyclic)
+ dma_cookie_complete(&desc->txd);
+ list_move_tail(&desc->node, &list);
+ }
--- /dev/null
+From 4fe7efdbdfb1c7e7a7f31decfd831c0f31d37091 Mon Sep 17 00:00:00 2001
+From: Konstantin Khlebnikov <khlebnikov@openvz.org>
+Date: Wed, 20 Jun 2012 12:53:01 -0700
+Subject: mm: correctly synchronize rss-counters at exit/exec
+
+From: Konstantin Khlebnikov <khlebnikov@openvz.org>
+
+commit 4fe7efdbdfb1c7e7a7f31decfd831c0f31d37091 upstream.
+
+do_exit() and exec_mmap() call sync_mm_rss() before mm_release() does
+put_user(clear_child_tid) which can update task->rss_stat and thus make
+mm->rss_stat inconsistent. This triggers the "BUG:" printk in check_mm().
+
+Let's fix this bug in the safest way, and optimize/cleanup this later.
+
+Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@openvz.org>
+Cc: Oleg Nesterov <oleg@redhat.com>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Cc: Hugh Dickins <hughd@google.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/exec.c | 2 +-
+ kernel/exit.c | 1 +
+ 2 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/fs/exec.c
++++ b/fs/exec.c
+@@ -823,10 +823,10 @@ static int exec_mmap(struct mm_struct *m
+ /* Notify parent that we're no longer interested in the old VM */
+ tsk = current;
+ old_mm = current->mm;
+- sync_mm_rss(old_mm);
+ mm_release(tsk, old_mm);
+
+ if (old_mm) {
++ sync_mm_rss(old_mm);
+ /*
+ * Make sure that if there is a core dump in progress
+ * for the old mm, we get out and die instead of going
+--- a/kernel/exit.c
++++ b/kernel/exit.c
+@@ -643,6 +643,7 @@ static void exit_mm(struct task_struct *
+ mm_release(tsk, mm);
+ if (!mm)
+ return;
++ sync_mm_rss(mm);
+ /*
+ * Serialize with any possible pending coredump.
+ * We must hold mmap_sem around checking core_state
--- /dev/null
+From b1027439dff844675f6c0df97a1b1d190791a699 Mon Sep 17 00:00:00 2001
+From: Bryan Schumaker <bjschuma@netapp.com>
+Date: Wed, 20 Jun 2012 14:35:28 -0400
+Subject: NFS: Force the legacy idmapper to be single threaded
+
+From: Bryan Schumaker <bjschuma@netapp.com>
+
+commit b1027439dff844675f6c0df97a1b1d190791a699 upstream.
+
+It was initially coded under the assumption that there would only be one
+request at a time, so use a lock to enforce this requirement..
+
+Signed-off-by: Bryan Schumaker <bjschuma@netapp.com>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/idmap.c | 13 ++++++++-----
+ 1 file changed, 8 insertions(+), 5 deletions(-)
+
+--- a/fs/nfs/idmap.c
++++ b/fs/nfs/idmap.c
+@@ -57,6 +57,11 @@ unsigned int nfs_idmap_cache_timeout = 6
+ static const struct cred *id_resolver_cache;
+ static struct key_type key_type_id_resolver_legacy;
+
++struct idmap {
++ struct rpc_pipe *idmap_pipe;
++ struct key_construction *idmap_key_cons;
++ struct mutex idmap_mutex;
++};
+
+ /**
+ * nfs_fattr_init_names - initialise the nfs_fattr owner_name/group_name fields
+@@ -310,9 +315,11 @@ static ssize_t nfs_idmap_get_key(const c
+ name, namelen, type, data,
+ data_size, NULL);
+ if (ret < 0) {
++ mutex_lock(&idmap->idmap_mutex);
+ ret = nfs_idmap_request_key(&key_type_id_resolver_legacy,
+ name, namelen, type, data,
+ data_size, idmap);
++ mutex_unlock(&idmap->idmap_mutex);
+ }
+ return ret;
+ }
+@@ -354,11 +361,6 @@ static int nfs_idmap_lookup_id(const cha
+ /* idmap classic begins here */
+ module_param(nfs_idmap_cache_timeout, int, 0644);
+
+-struct idmap {
+- struct rpc_pipe *idmap_pipe;
+- struct key_construction *idmap_key_cons;
+-};
+-
+ enum {
+ Opt_find_uid, Opt_find_gid, Opt_find_user, Opt_find_group, Opt_find_err
+ };
+@@ -469,6 +471,7 @@ nfs_idmap_new(struct nfs_client *clp)
+ return error;
+ }
+ idmap->idmap_pipe = pipe;
++ mutex_init(&idmap->idmap_mutex);
+
+ clp->cl_idmap = idmap;
+ return 0;
--- /dev/null
+From 1f758b23177d588a71b96ad02990e715949bb82f Mon Sep 17 00:00:00 2001
+From: Mandeep Singh Baines <msb@chromium.org>
+Date: Sun, 24 Jun 2012 23:31:09 +0200
+Subject: PM / Sleep: Prevent waiting forever on asynchronous suspend after abort
+
+From: Mandeep Singh Baines <msb@chromium.org>
+
+commit 1f758b23177d588a71b96ad02990e715949bb82f upstream.
+
+__device_suspend() must always send a completion. Otherwise, parent
+devices will wait forever.
+
+Commit 1e2ef05b, "PM: Limit race conditions between runtime PM and
+system sleep (v2)", introduced a regression by short-circuiting the
+complete_all() for certain error cases.
+
+This patch fixes the bug by always signalling a completion.
+
+Addresses http://crosbug.com/31972
+
+Tested by injecting an abort.
+
+Signed-off-by: Mandeep Singh Baines <msb@chromium.org>
+Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/power/main.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/base/power/main.c
++++ b/drivers/base/power/main.c
+@@ -1021,7 +1021,7 @@ static int __device_suspend(struct devic
+ dpm_wait_for_children(dev, async);
+
+ if (async_error)
+- return 0;
++ goto Complete;
+
+ pm_runtime_get_noresume(dev);
+ if (pm_runtime_barrier(dev) && device_may_wakeup(dev))
+@@ -1030,7 +1030,7 @@ static int __device_suspend(struct devic
+ if (pm_wakeup_pending()) {
+ pm_runtime_put_sync(dev);
+ async_error = -EBUSY;
+- return 0;
++ goto Complete;
+ }
+
+ device_lock(dev);
+@@ -1087,6 +1087,8 @@ static int __device_suspend(struct devic
+ }
+
+ device_unlock(dev);
++
++ Complete:
+ complete_all(&dev->power.completion);
+
+ if (error) {
acpi_pad-fix-power_saving-thread-deadlock.patch
acpi-apei-avoid-too-much-error-reporting-in-runtime.patch
acpi-add-a-quirk-for-amilo-pro-v2030-to-ignore-the-timer-overriding.patch
+acpi-x86-fix-dell-m6600-acpi-reboot-regression-via-dmi.patch
+acpi-sysfs.c-strlen-fix.patch
+arm-orion-fix-virtual-physical-mixup-with-watchdog.patch
+arm-orion-fix-wdt-compile-for-dove-and-mv78xx0.patch
+xen-blkback-copy-id-field-when-doing-blkif_discard.patch
+umem-fix-up-unplugging.patch
+stable-allow-merging-of-backports-for-serious-user-visible-performance-issues.patch
+mm-correctly-synchronize-rss-counters-at-exit-exec.patch
+pm-sleep-prevent-waiting-forever-on-asynchronous-suspend-after-abort.patch
+dmaengine-pl330-dont-complete-descriptor-for-cyclic-dma.patch
+nfs-force-the-legacy-idmapper-to-be-single-threaded.patch
--- /dev/null
+From eb3979f64d25120d60b9e761a4c58f70b1a02f86 Mon Sep 17 00:00:00 2001
+From: Mel Gorman <mgorman@suse.de>
+Date: Thu, 21 Jun 2012 11:36:50 +0100
+Subject: stable: Allow merging of backports for serious user-visible performance issues
+
+From: Mel Gorman <mgorman@suse.de>
+
+commit eb3979f64d25120d60b9e761a4c58f70b1a02f86 upstream.
+
+Distribution kernel maintainers routinely backport fixes for users that
+were deemed important but not "something critical" as defined by the
+rules. To users of these kernels they are very serious and failing to fix
+them reduces the value of -stable.
+
+The problem is that the patches fixing these issues are often subtle and
+prone to regressions in other ways and need greater care and attention.
+To combat this, these "serious" backports should have a higher barrier
+to entry.
+
+This patch relaxes the rules to allow a distribution maintainer to merge
+to -stable a backported patch or small series that fixes a "serious"
+user-visible performance issue. They should include additional information on
+the user-visible bug affected and a link to the bugzilla entry if available.
+The same rules about the patch being already in mainline still apply.
+
+Signed-off-by: Mel Gorman <mgorman@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/stable_kernel_rules.txt | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/Documentation/stable_kernel_rules.txt
++++ b/Documentation/stable_kernel_rules.txt
+@@ -12,6 +12,12 @@ Rules on what kind of patches are accept
+ marked CONFIG_BROKEN), an oops, a hang, data corruption, a real
+ security issue, or some "oh, that's not good" issue. In short, something
+ critical.
++ - Serious issues as reported by a user of a distribution kernel may also
++ be considered if they fix a notable performance or interactivity issue.
++ As these fixes are not as obvious and have a higher risk of a subtle
++ regression they should only be submitted by a distribution kernel
++ maintainer and include an addendum linking to a bugzilla entry if it
++ exists and additional information on the user-visible impact.
+ - New device IDs and quirks are also accepted.
+ - No "theoretical race condition" issues, unless an explanation of how the
+ race can be exploited is also provided.
--- /dev/null
+From 32587371ad3db2f9d335de10dbd8cffd4fff5669 Mon Sep 17 00:00:00 2001
+From: Tao Guo <glorioustao@gmail.com>
+Date: Wed, 13 Jun 2012 21:17:21 +0200
+Subject: umem: fix up unplugging
+
+From: Tao Guo <glorioustao@gmail.com>
+
+commit 32587371ad3db2f9d335de10dbd8cffd4fff5669 upstream.
+
+Fix a regression introduced by 7eaceaccab5f40 ("block: remove per-queue
+plugging"). In that patch, Jens removed the whole mm_unplug_device()
+function, which used to be the trigger to make umem start to work.
+
+We need to implement unplugging to make umem start to work, or I/O will
+never be triggered.
+
+Signed-off-by: Tao Guo <Tao.Guo@emc.com>
+Cc: Neil Brown <neilb@suse.de>
+Cc: Jens Axboe <axboe@kernel.dk>
+Cc: Shaohua Li <shli@kernel.org>
+Acked-by: NeilBrown <neilb@suse.de>
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/umem.c | 40 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 40 insertions(+)
+
+--- a/drivers/block/umem.c
++++ b/drivers/block/umem.c
+@@ -513,6 +513,44 @@ static void process_page(unsigned long d
+ }
+ }
+
++struct mm_plug_cb {
++ struct blk_plug_cb cb;
++ struct cardinfo *card;
++};
++
++static void mm_unplug(struct blk_plug_cb *cb)
++{
++ struct mm_plug_cb *mmcb = container_of(cb, struct mm_plug_cb, cb);
++
++ spin_lock_irq(&mmcb->card->lock);
++ activate(mmcb->card);
++ spin_unlock_irq(&mmcb->card->lock);
++ kfree(mmcb);
++}
++
++static int mm_check_plugged(struct cardinfo *card)
++{
++ struct blk_plug *plug = current->plug;
++ struct mm_plug_cb *mmcb;
++
++ if (!plug)
++ return 0;
++
++ list_for_each_entry(mmcb, &plug->cb_list, cb.list) {
++ if (mmcb->cb.callback == mm_unplug && mmcb->card == card)
++ return 1;
++ }
++ /* Not currently on the callback list */
++ mmcb = kmalloc(sizeof(*mmcb), GFP_ATOMIC);
++ if (!mmcb)
++ return 0;
++
++ mmcb->card = card;
++ mmcb->cb.callback = mm_unplug;
++ list_add(&mmcb->cb.list, &plug->cb_list);
++ return 1;
++}
++
+ static void mm_make_request(struct request_queue *q, struct bio *bio)
+ {
+ struct cardinfo *card = q->queuedata;
+@@ -523,6 +561,8 @@ static void mm_make_request(struct reque
+ *card->biotail = bio;
+ bio->bi_next = NULL;
+ card->biotail = &bio->bi_next;
++ if (bio->bi_rw & REQ_SYNC || !mm_check_plugged(card))
++ activate(card);
+ spin_unlock_irq(&card->lock);
+
+ return;
--- /dev/null
+From 8c9ce606a60e4a0cb447bdc082ce383b96b227b4 Mon Sep 17 00:00:00 2001
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Date: Fri, 25 May 2012 16:11:09 -0400
+Subject: xen/blkback: Copy id field when doing BLKIF_DISCARD.
+
+From: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+
+commit 8c9ce606a60e4a0cb447bdc082ce383b96b227b4 upstream.
+
+We weren't copying the id field so when we sent the response
+back to the frontend (especially with a 64-bit host and 32-bit
+guest), we ended up using a random value. This lead to the
+frontend crashing as it would try to pass to __blk_end_request_all
+a NULL 'struct request' (b/c it would use the 'id' to find the
+proper 'struct request' in its shadow array) and end up crashing:
+
+BUG: unable to handle kernel NULL pointer dereference at 000000e4
+IP: [<c0646d4c>] __blk_end_request_all+0xc/0x40
+.. snip..
+EIP is at __blk_end_request_all+0xc/0x40
+.. snip..
+ [<ed95db72>] blkif_interrupt+0x172/0x330 [xen_blkfront]
+
+This fixes the bug by passing in the proper id for the response.
+
+Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=824641
+
+Tested-by: William Dauchy <wdauchy@gmail.com>
+Acked-by: Stefano Stabellini <stefano.stabellini@eu.citrix.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/xen-blkback/common.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/block/xen-blkback/common.h
++++ b/drivers/block/xen-blkback/common.h
+@@ -257,6 +257,7 @@ static inline void blkif_get_x86_32_req(
+ break;
+ case BLKIF_OP_DISCARD:
+ dst->u.discard.flag = src->u.discard.flag;
++ dst->u.discard.id = src->u.discard.id;
+ dst->u.discard.sector_number = src->u.discard.sector_number;
+ dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
+ break;
+@@ -287,6 +288,7 @@ static inline void blkif_get_x86_64_req(
+ break;
+ case BLKIF_OP_DISCARD:
+ dst->u.discard.flag = src->u.discard.flag;
++ dst->u.discard.id = src->u.discard.id;
+ dst->u.discard.sector_number = src->u.discard.sector_number;
+ dst->u.discard.nr_sectors = src->u.discard.nr_sectors;
+ break;
projects / thirdparty / kernel / stable-queue.git / commitdiff
