--- /dev/null
+From 4367216a099b4df3fa2c4f2b086cda1a1e9afc4e Mon Sep 17 00:00:00 2001
+From: Dennis O'Brien <dennis.obrien@eqware.net>
+Date: Sat, 10 Oct 2009 15:08:52 +0800
+Subject: ARM: pxa: workaround errata #37 by not using half turbo switching
+
+From: Dennis O'Brien <dennis.obrien@eqware.net>
+
+commit 4367216a099b4df3fa2c4f2b086cda1a1e9afc4e upstream.
+
+PXA27x Errata #37 implies system will hang when switching into or out of
+half turbo (HT bit in CLKCFG) mode, workaround this by not using it.
+
+Signed-off-by: Dennis O'Brien <dennis.obrien@eqware.net>
+Signed-off-by: Eric Miao <eric.y.miao@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/arm/mach-pxa/cpufreq-pxa2xx.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm/mach-pxa/cpufreq-pxa2xx.c
++++ b/arch/arm/mach-pxa/cpufreq-pxa2xx.c
+@@ -155,7 +155,7 @@ MODULE_PARM_DESC(pxa255_turbo_table, "Se
+
+ static pxa_freqs_t pxa27x_freqs[] = {
+ {104000, 104000, PXA27x_CCCR(1, 8, 2), 0, CCLKCFG2(1, 0, 1), 900000, 1705000 },
+- {156000, 104000, PXA27x_CCCR(1, 8, 6), 0, CCLKCFG2(1, 1, 1), 1000000, 1705000 },
++ {156000, 104000, PXA27x_CCCR(1, 8, 3), 0, CCLKCFG2(1, 0, 1), 1000000, 1705000 },
+ {208000, 208000, PXA27x_CCCR(0, 16, 2), 1, CCLKCFG2(0, 0, 1), 1180000, 1705000 },
+ {312000, 208000, PXA27x_CCCR(1, 16, 3), 1, CCLKCFG2(1, 0, 1), 1250000, 1705000 },
+ {416000, 208000, PXA27x_CCCR(1, 16, 4), 1, CCLKCFG2(1, 0, 1), 1350000, 1705000 },
--- /dev/null
+From b4c2554d40ceac130a8d062eaa8838ed22158c45 Mon Sep 17 00:00:00 2001
+From: Martin K. Petersen <martin.petersen@oracle.com>
+Date: Fri, 18 Sep 2009 17:33:01 -0400
+Subject: SCSI: Fix protection scsi_data_buffer leak
+
+From: Martin K. Petersen <martin.petersen@oracle.com>
+
+commit b4c2554d40ceac130a8d062eaa8838ed22158c45 upstream.
+
+We would leak a scsi_data_buffer if the free_list command was of the
+protected variety.
+
+Reported-by: Boaz Harrosh <bharrosh@panasas.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi.c | 11 +++++++----
+ 1 file changed, 7 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/scsi.c
++++ b/drivers/scsi/scsi.c
+@@ -241,10 +241,7 @@ scsi_host_alloc_command(struct Scsi_Host
+ */
+ struct scsi_cmnd *__scsi_get_command(struct Scsi_Host *shost, gfp_t gfp_mask)
+ {
+- struct scsi_cmnd *cmd;
+- unsigned char *buf;
+-
+- cmd = scsi_host_alloc_command(shost, gfp_mask);
++ struct scsi_cmnd *cmd = scsi_host_alloc_command(shost, gfp_mask);
+
+ if (unlikely(!cmd)) {
+ unsigned long flags;
+@@ -258,9 +255,15 @@ struct scsi_cmnd *__scsi_get_command(str
+ spin_unlock_irqrestore(&shost->free_list_lock, flags);
+
+ if (cmd) {
++ void *buf, *prot;
++
+ buf = cmd->sense_buffer;
++ prot = cmd->prot_sdb;
++
+ memset(cmd, 0, sizeof(*cmd));
++
+ cmd->sense_buffer = buf;
++ cmd->prot_sdb = prot;
+ }
+ }
+
--- /dev/null
+From 6e883b0e42739aa560133cfaf41be1138c51a500 Mon Sep 17 00:00:00 2001
+From: Hannes Reinecke <hare@suse.de>
+Date: Thu, 17 Sep 2009 17:00:26 +0200
+Subject: SCSI: Retry ADD_TO_MLQUEUE return value for EH commands
+
+From: Hannes Reinecke <hare@suse.de>
+
+commit 6e883b0e42739aa560133cfaf41be1138c51a500 upstream.
+
+A target reset when I/O is ongoing might result
+an eventual device offline, as scsi_eh_completed_normally()
+might return ADD_TO_MLQUEUE in addition to the
+advertised SUCCESS, FAILED, and NEEDS_RETRY.
+
+Which is unfortunate as scsi_send_eh_cmnd() will
+therefore map ADD_TO_MLQUEUE to FAILED instead of
+the more appropriate NEEDS_RETRY.
+
+Signed-off-by: Hannes Reinecke <hare@suse.de>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/scsi_error.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/scsi/scsi_error.c
++++ b/drivers/scsi/scsi_error.c
+@@ -721,6 +721,9 @@ static int scsi_send_eh_cmnd(struct scsi
+ case NEEDS_RETRY:
+ case FAILED:
+ break;
++ case ADD_TO_MLQUEUE:
++ rtn = NEEDS_RETRY;
++ break;
+ default:
+ rtn = FAILED;
+ break;
--- /dev/null
+From e27168f8c337b12b8aa8d59c3123c79d2f83603d Mon Sep 17 00:00:00 2001
+From: Christof Schmitt <christof.schmitt@de.ibm.com>
+Date: Thu, 17 Sep 2009 09:10:14 +0200
+Subject: SCSI: sg: Free data buffers after calling blk_rq_unmap_user
+
+From: Christof Schmitt <christof.schmitt@de.ibm.com>
+
+commit e27168f8c337b12b8aa8d59c3123c79d2f83603d upstream.
+
+Running sg_luns on s390x with CONFIG_DEBUG_PAGEALLOC enabled fails
+with EFAULT from the SG_IO ioctl. The EFAULT is the result from
+copy_to_user failing in this call chain:
+
+sg_ioctl
+sg_new_read
+sg_finish_rem_req
+blk_rq_unmap_user
+__blk_rq_unmap_user
+bio_uncopy_user
+__bio_copy_iov
+copy_to_user
+
+The sg driver calls sg_remove_scat to free the memory pages before
+calling blk_rq_unmap_user that tries to copy the data back to
+userspace. Change the order to first call blk_rq_unmap_user before
+freeing the pages in sg_remove_scat.
+
+Acked-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
+Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
+Acked-by: Douglas Gilbert <dgilbert@interlog.com>
+Signed-off-by: James Bottomley <James.Bottomley@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/scsi/sg.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/scsi/sg.c
++++ b/drivers/scsi/sg.c
+@@ -1708,11 +1708,6 @@ static int sg_finish_rem_req(Sg_request
+ Sg_scatter_hold *req_schp = &srp->data;
+
+ SCSI_LOG_TIMEOUT(4, printk("sg_finish_rem_req: res_used=%d\n", (int) srp->res_used));
+- if (srp->res_used)
+- sg_unlink_reserve(sfp, srp);
+- else
+- sg_remove_scat(req_schp);
+-
+ if (srp->rq) {
+ if (srp->bio)
+ ret = blk_rq_unmap_user(srp->bio);
+@@ -1720,6 +1715,11 @@ static int sg_finish_rem_req(Sg_request
+ blk_put_request(srp->rq);
+ }
+
++ if (srp->res_used)
++ sg_unlink_reserve(sfp, srp);
++ else
++ sg_remove_scat(req_schp);
++
+ sg_remove_request(sfp, srp);
+
+ return ret;
--- /dev/null
+scsi-retry-add_to_mlqueue-return-value-for-eh-commands.patch
+scsi-fix-protection-scsi_data_buffer-leak.patch
+scsi-sg-free-data-buffers-after-calling-blk_rq_unmap_user.patch
+arm-pxa-workaround-errata-37-by-not-using-half-turbo-switching.patch
+tracing-filters-fix-memory-leak-when-setting-a-filter.patch
+x86-paravirt-use-normal-calling-sequences-for-irq-enable-disable.patch
+usb-ftdi_sio-remove-tty-low_latency.patch
+usb-ftdi_sio-remove-unused-rx_byte-counter.patch
--- /dev/null
+From 8ad807318fcd62aba0e18c7c7fbfcc1af3fcdbab Mon Sep 17 00:00:00 2001
+From: Li Zefan <lizf@cn.fujitsu.com>
+Date: Tue, 13 Oct 2009 09:28:57 +0800
+Subject: tracing/filters: Fix memory leak when setting a filter
+
+From: Li Zefan <lizf@cn.fujitsu.com>
+
+commit 8ad807318fcd62aba0e18c7c7fbfcc1af3fcdbab upstream.
+
+Every time we set a filter, we leak memory allocated by
+postfix_append_operand() and postfix_append_op().
+
+Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Tom Zanussi <tzanussi@gmail.com>
+LKML-Reference: <4AD3D7D9.4070400@cn.fujitsu.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/trace/trace_events_filter.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -844,8 +844,9 @@ static void postfix_clear(struct filter_
+
+ while (!list_empty(&ps->postfix)) {
+ elt = list_first_entry(&ps->postfix, struct postfix_elt, list);
+- kfree(elt->operand);
+ list_del(&elt->list);
++ kfree(elt->operand);
++ kfree(elt);
+ }
+ }
+
--- /dev/null
+From 0cbd81a9f6bac734ac3266687bf027af1e395270 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Wed, 7 Oct 2009 20:05:04 +0200
+Subject: USB: ftdi_sio: remove tty->low_latency
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 0cbd81a9f6bac734ac3266687bf027af1e395270 upstream.
+
+Fixes tty_flip_buffer_push being called from hard interrupt context with
+low_latency set.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 4 ----
+ 1 file changed, 4 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -1235,7 +1235,6 @@ static int set_serial_info(struct tty_st
+ (new_serial.flags & ASYNC_FLAGS));
+ priv->custom_divisor = new_serial.custom_divisor;
+
+- tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
+ write_latency_timer(port);
+
+ check_and_exit:
+@@ -1706,9 +1705,6 @@ static int ftdi_open(struct tty_struct *
+ priv->rx_bytes = 0;
+ spin_unlock_irqrestore(&priv->rx_lock, flags);
+
+- if (tty)
+- tty->low_latency = (priv->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
+-
+ write_latency_timer(port);
+
+ /* No error checking for this (will get errors later anyway) */
--- /dev/null
+From 63b0061246b54b849da8f189ae048e8110d8ce7d Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Wed, 7 Oct 2009 20:05:05 +0200
+Subject: USB: ftdi_sio: remove unused rx_byte counter
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 63b0061246b54b849da8f189ae048e8110d8ce7d upstream.
+
+Remove unused rx_byte counter which is never exposed as noted by Alan
+Cox.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/serial/ftdi_sio.c | 13 -------------
+ 1 file changed, 13 deletions(-)
+
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -81,7 +81,6 @@ struct ftdi_private {
+ struct delayed_work rx_work;
+ struct usb_serial_port *port;
+ int rx_processed;
+- unsigned long rx_bytes;
+
+ __u16 interface; /* FT2232C, FT2232H or FT4232H port interface
+ (0 for FT232/245) */
+@@ -1701,9 +1700,6 @@ static int ftdi_open(struct tty_struct *
+ spin_lock_irqsave(&priv->tx_lock, flags);
+ priv->tx_bytes = 0;
+ spin_unlock_irqrestore(&priv->tx_lock, flags);
+- spin_lock_irqsave(&priv->rx_lock, flags);
+- priv->rx_bytes = 0;
+- spin_unlock_irqrestore(&priv->rx_lock, flags);
+
+ write_latency_timer(port);
+
+@@ -2016,8 +2012,6 @@ static void ftdi_read_bulk_callback(stru
+ struct usb_serial_port *port = urb->context;
+ struct tty_struct *tty;
+ struct ftdi_private *priv;
+- unsigned long countread;
+- unsigned long flags;
+ int status = urb->status;
+
+ if (urb->number_of_packets > 0) {
+@@ -2056,13 +2050,6 @@ static void ftdi_read_bulk_callback(stru
+ goto out;
+ }
+
+- /* count data bytes, but not status bytes */
+- countread = urb->actual_length;
+- countread -= 2 * DIV_ROUND_UP(countread, priv->max_packet_size);
+- spin_lock_irqsave(&priv->rx_lock, flags);
+- priv->rx_bytes += countread;
+- spin_unlock_irqrestore(&priv->rx_lock, flags);
+-
+ ftdi_process_read(&priv->rx_work.work);
+ out:
+ tty_kref_put(tty);
--- /dev/null
+From 71999d9862e667f1fd14f8fbfa0cce6d855bad3f Mon Sep 17 00:00:00 2001
+From: Jeremy Fitzhardinge <jeremy@goop.org>
+Date: Mon, 12 Oct 2009 16:32:43 -0700
+Subject: x86/paravirt: Use normal calling sequences for irq enable/disable
+
+From: Jeremy Fitzhardinge <jeremy@goop.org>
+
+commit 71999d9862e667f1fd14f8fbfa0cce6d855bad3f upstream.
+
+Bastian Blank reported a boot crash with stackprotector enabled,
+and debugged it back to edx register corruption.
+
+For historical reasons irq enable/disable/save/restore had special
+calling sequences to make them more efficient. With the more
+recent introduction of higher-level and more general optimisations
+this is no longer necessary so we can just use the normal PVOP_
+macros.
+
+This fixes some residual bugs in the old implementations which left
+edx liable to inadvertent clobbering. Also, fix some bugs in
+__PVOP_VCALLEESAVE which were revealed by actual use.
+
+Reported-by: Bastian Blank <bastian@waldi.eu.org>
+Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
+Cc: Xen-devel <xen-devel@lists.xensource.com>
+LKML-Reference: <4AD3BC9B.7040501@goop.org>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/include/asm/paravirt.h | 38 ++++++++++----------------------------
+ 1 file changed, 10 insertions(+), 28 deletions(-)
+
+--- a/arch/x86/include/asm/paravirt.h
++++ b/arch/x86/include/asm/paravirt.h
+@@ -528,10 +528,11 @@ int paravirt_disable_iospace(void);
+ #define EXTRA_CLOBBERS
+ #define VEXTRA_CLOBBERS
+ #else /* CONFIG_X86_64 */
++/* [re]ax isn't an arg, but the return val */
+ #define PVOP_VCALL_ARGS \
+ unsigned long __edi = __edi, __esi = __esi, \
+- __edx = __edx, __ecx = __ecx
+-#define PVOP_CALL_ARGS PVOP_VCALL_ARGS, __eax
++ __edx = __edx, __ecx = __ecx, __eax = __eax
++#define PVOP_CALL_ARGS PVOP_VCALL_ARGS
+
+ #define PVOP_CALL_ARG1(x) "D" ((unsigned long)(x))
+ #define PVOP_CALL_ARG2(x) "S" ((unsigned long)(x))
+@@ -543,6 +544,7 @@ int paravirt_disable_iospace(void);
+ "=c" (__ecx)
+ #define PVOP_CALL_CLOBBERS PVOP_VCALL_CLOBBERS, "=a" (__eax)
+
++/* void functions are still allowed [re]ax for scratch */
+ #define PVOP_VCALLEE_CLOBBERS "=a" (__eax)
+ #define PVOP_CALLEE_CLOBBERS PVOP_VCALLEE_CLOBBERS
+
+@@ -617,8 +619,8 @@ int paravirt_disable_iospace(void);
+ VEXTRA_CLOBBERS, \
+ pre, post, ##__VA_ARGS__)
+
+-#define __PVOP_VCALLEESAVE(rettype, op, pre, post, ...) \
+- ____PVOP_CALL(rettype, op.func, CLBR_RET_REG, \
++#define __PVOP_VCALLEESAVE(op, pre, post, ...) \
++ ____PVOP_VCALL(op.func, CLBR_RET_REG, \
+ PVOP_VCALLEE_CLOBBERS, , \
+ pre, post, ##__VA_ARGS__)
+
+@@ -1565,42 +1567,22 @@ extern struct paravirt_patch_site __para
+
+ static inline unsigned long __raw_local_save_flags(void)
+ {
+- unsigned long f;
+-
+- asm volatile(paravirt_alt(PARAVIRT_CALL)
+- : "=a"(f)
+- : paravirt_type(pv_irq_ops.save_fl),
+- paravirt_clobber(CLBR_EAX)
+- : "memory", "cc");
+- return f;
++ return PVOP_CALLEE0(unsigned long, pv_irq_ops.save_fl);
+ }
+
+ static inline void raw_local_irq_restore(unsigned long f)
+ {
+- asm volatile(paravirt_alt(PARAVIRT_CALL)
+- : "=a"(f)
+- : PV_FLAGS_ARG(f),
+- paravirt_type(pv_irq_ops.restore_fl),
+- paravirt_clobber(CLBR_EAX)
+- : "memory", "cc");
++ PVOP_VCALLEE1(pv_irq_ops.restore_fl, f);
+ }
+
+ static inline void raw_local_irq_disable(void)
+ {
+- asm volatile(paravirt_alt(PARAVIRT_CALL)
+- :
+- : paravirt_type(pv_irq_ops.irq_disable),
+- paravirt_clobber(CLBR_EAX)
+- : "memory", "eax", "cc");
++ PVOP_VCALLEE0(pv_irq_ops.irq_disable);
+ }
+
+ static inline void raw_local_irq_enable(void)
+ {
+- asm volatile(paravirt_alt(PARAVIRT_CALL)
+- :
+- : paravirt_type(pv_irq_ops.irq_enable),
+- paravirt_clobber(CLBR_EAX)
+- : "memory", "eax", "cc");
++ PVOP_VCALLEE0(pv_irq_ops.irq_enable);
+ }
+
+ static inline unsigned long __raw_local_irq_save(void)
projects / thirdparty / kernel / stable-queue.git / commitdiff
