From: Greg Kroah-Hartman Date: Thu, 5 Nov 2009 20:23:30 +0000 (-0800) Subject: start .31 queue back up X-Git-Tag: v2.6.31.6~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=36e97dec52821f76536a25b763e320eb7434c2a5;p=thirdparty%2Fkernel%2Fstable-queue.git start .31 queue back up --- diff --git a/queue-2.6.31/8250_pci-add-ibm-saturn-serial-card.patch b/queue-2.6.31/8250_pci-add-ibm-saturn-serial-card.patch new file mode 100644 index 00000000000..8b4d2bd8f85 --- /dev/null +++ b/queue-2.6.31/8250_pci-add-ibm-saturn-serial-card.patch @@ -0,0 +1,73 @@ +From c68d2b1594548cda7f6dbac6a4d9d30a9b01558c Mon Sep 17 00:00:00 2001 +From: Benjamin Herrenschmidt +Date: Mon, 26 Oct 2009 16:50:05 -0700 +Subject: 8250_pci: add IBM Saturn serial card + +From: Benjamin Herrenschmidt + +commit c68d2b1594548cda7f6dbac6a4d9d30a9b01558c upstream. + +The IBM Saturn serial card has only one port. Without that fixup, +the kernel thinks it has two, which confuses userland setup and +admin tools as well. + +[akpm@linux-foundation.org: fix pci-ids.h layout] +Signed-off-by: Benjamin Herrenschmidt +Acked-by: Alan Cox +Cc: Michael Reed +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Acked-by: Alan Cox +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/serial/8250_pci.c | 11 +++++++++++ + include/linux/pci_ids.h | 3 +++ + 2 files changed, 14 insertions(+) + +--- a/drivers/serial/8250_pci.c ++++ b/drivers/serial/8250_pci.c +@@ -1561,6 +1561,7 @@ enum pci_board_num_t { + pbn_exar_XR17C152, + pbn_exar_XR17C154, + pbn_exar_XR17C158, ++ pbn_exar_ibm_saturn, + pbn_pasemi_1682M, + pbn_ni8430_2, + pbn_ni8430_4, +@@ -2146,6 +2147,13 @@ static struct pciserial_board pci_boards + .base_baud = 921600, + .uart_offset = 0x200, + }, ++ [pbn_exar_ibm_saturn] = { ++ .flags = FL_BASE0, ++ .num_ports = 1, ++ .base_baud = 921600, ++ .uart_offset = 0x200, ++ }, ++ + /* + * PA Semi PWRficient PA6T-1682M on-chip UART + */ +@@ -2649,6 +2657,9 @@ static struct pci_device_id serial_pci_t + PCI_SUBVENDOR_ID_CONNECT_TECH, + PCI_SUBDEVICE_ID_CONNECT_TECH_PCI_UART_8_485, 0, 0, + pbn_b0_8_1843200_200 }, ++ { PCI_VENDOR_ID_EXAR, PCI_DEVICE_ID_EXAR_XR17C152, ++ PCI_VENDOR_ID_IBM, PCI_SUBDEVICE_ID_IBM_SATURN_SERIAL_ONE_PORT, ++ 0, 0, pbn_exar_ibm_saturn }, + + { PCI_VENDOR_ID_SEALEVEL, PCI_DEVICE_ID_SEALEVEL_U530, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -479,6 +479,9 @@ + #define PCI_DEVICE_ID_IBM_ICOM_V2_ONE_PORT_RVX_ONE_PORT_MDM_PCIE 0x0361 + #define PCI_DEVICE_ID_IBM_ICOM_FOUR_PORT_MODEL 0x252 + ++#define PCI_SUBVENDOR_ID_IBM 0x1014 ++#define PCI_SUBDEVICE_ID_IBM_SATURN_SERIAL_ONE_PORT 0x03d4 ++ + #define PCI_VENDOR_ID_UNISYS 0x1018 + #define PCI_DEVICE_ID_UNISYS_DMA_DIRECTOR 0x001C + diff --git a/queue-2.6.31/ahci-revert-restore-sb600-sata-controller-64-bit-dma.patch b/queue-2.6.31/ahci-revert-restore-sb600-sata-controller-64-bit-dma.patch new file mode 100644 index 00000000000..4f7c57f395c --- /dev/null +++ b/queue-2.6.31/ahci-revert-restore-sb600-sata-controller-64-bit-dma.patch @@ -0,0 +1,108 @@ +From cebbert@redhat.com Thu Nov 5 11:58:54 2009 +From: Chuck Ebbert +Date: Mon, 26 Oct 2009 15:27:53 -0400 +Subject: ahci: revert "Restore SB600 sata controller 64 bit DMA" +To: stable@kernel.org +Cc: Tejun Heo +Message-ID: <20091026152753.0be8dc32@katamari.usersys.redhat.com> + +From: Chuck Ebbert + +revert commit 58a09b38cfcd700b796ea07ae3d2e0efbb28b561 +("[libata] ahci: Restore SB600 SATA controller 64 bit DMA") + +Upstream commit 58a09b38cfcd700b796ea07ae3d2e0efbb28b561 does +nearly the same thing but this patch is simplified for 2.6.31 + +Disables 64-bit DMA for _all_ boards, unlike 2.6.32 which adds a +whitelist. (The whitelist function requires a fairly large patch +that touches unrelated code.) + +Doesn't revert the DMI part as other backported patches might need +the exported symbol. + +Applies to 2.6.31.4 + +Signed-off-by: Chuck Ebbert +Acked-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci.c | 52 ++-------------------------------------------------- + 1 file changed, 2 insertions(+), 50 deletions(-) + +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -433,7 +433,8 @@ static const struct ata_port_info ahci_p + [board_ahci_sb600] = + { + AHCI_HFLAGS (AHCI_HFLAG_IGN_SERR_INTERNAL | +- AHCI_HFLAG_NO_MSI | AHCI_HFLAG_SECT255), ++ AHCI_HFLAG_32BIT_ONLY | AHCI_HFLAG_NO_MSI | ++ AHCI_HFLAG_SECT255), + .flags = AHCI_FLAG_COMMON, + .pio_mask = ATA_PIO4, + .udma_mask = ATA_UDMA6, +@@ -2602,51 +2603,6 @@ static void ahci_p5wdh_workaround(struct + } + } + +-/* +- * SB600 ahci controller on ASUS M2A-VM can't do 64bit DMA with older +- * BIOS. The oldest version known to be broken is 0901 and working is +- * 1501 which was released on 2007-10-26. Force 32bit DMA on anything +- * older than 1501. Please read bko#9412 for more info. +- */ +-static bool ahci_asus_m2a_vm_32bit_only(struct pci_dev *pdev) +-{ +- static const struct dmi_system_id sysids[] = { +- { +- .ident = "ASUS M2A-VM", +- .matches = { +- DMI_MATCH(DMI_BOARD_VENDOR, +- "ASUSTeK Computer INC."), +- DMI_MATCH(DMI_BOARD_NAME, "M2A-VM"), +- }, +- }, +- { } +- }; +- const char *cutoff_mmdd = "10/26"; +- const char *date; +- int year; +- +- if (pdev->bus->number != 0 || pdev->devfn != PCI_DEVFN(0x12, 0) || +- !dmi_check_system(sysids)) +- return false; +- +- /* +- * Argh.... both version and date are free form strings. +- * Let's hope they're using the same date format across +- * different versions. +- */ +- date = dmi_get_system_info(DMI_BIOS_DATE); +- year = dmi_get_year(DMI_BIOS_DATE); +- if (date && strlen(date) >= 10 && date[2] == '/' && date[5] == '/' && +- (year > 2007 || +- (year == 2007 && strncmp(date, cutoff_mmdd, 5) >= 0))) +- return false; +- +- dev_printk(KERN_WARNING, &pdev->dev, "ASUS M2A-VM: BIOS too old, " +- "forcing 32bit DMA, update BIOS\n"); +- +- return true; +-} +- + static bool ahci_broken_system_poweroff(struct pci_dev *pdev) + { + static const struct dmi_system_id broken_systems[] = { +@@ -2857,10 +2813,6 @@ static int ahci_init_one(struct pci_dev + if (board_id == board_ahci_sb700 && pdev->revision >= 0x40) + hpriv->flags &= ~AHCI_HFLAG_IGN_SERR_INTERNAL; + +- /* apply ASUS M2A_VM quirk */ +- if (ahci_asus_m2a_vm_32bit_only(pdev)) +- hpriv->flags |= AHCI_HFLAG_32BIT_ONLY; +- + if ((hpriv->flags & AHCI_HFLAG_NO_MSI) || pci_enable_msi(pdev)) + pci_intx(pdev, 1); + diff --git a/queue-2.6.31/dm-add-missing-del_gendisk-to-alloc_dev-error-path.patch b/queue-2.6.31/dm-add-missing-del_gendisk-to-alloc_dev-error-path.patch new file mode 100644 index 00000000000..4d441b3f962 --- /dev/null +++ b/queue-2.6.31/dm-add-missing-del_gendisk-to-alloc_dev-error-path.patch @@ -0,0 +1,34 @@ +From 03022c54b9725026c0370a810168975c387ad04c Mon Sep 17 00:00:00 2001 +From: Zdenek Kabelac +Date: Fri, 16 Oct 2009 23:18:15 +0100 +Subject: dm: add missing del_gendisk to alloc_dev error path + +From: Zdenek Kabelac + +commit 03022c54b9725026c0370a810168975c387ad04c upstream. + +Add missing del_gendisk() to error path when creation of workqueue fails. +Otherwice there is a resource leak and following warning is shown: + +WARNING: at fs/sysfs/dir.c:487 sysfs_add_one+0xc5/0x160() +sysfs: cannot create duplicate filename '/devices/virtual/block/dm-0' + +Signed-off-by: Zdenek Kabelac +Reviewed-by: Jonathan Brassow +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1819,6 +1819,7 @@ static struct mapped_device *alloc_dev(i + bad_bdev: + destroy_workqueue(md->wq); + bad_thread: ++ del_gendisk(md->disk); + put_disk(md->disk); + bad_disk: + blk_cleanup_queue(md->queue); diff --git a/queue-2.6.31/dm-dec_pending-needs-locking-to-save-error-value.patch b/queue-2.6.31/dm-dec_pending-needs-locking-to-save-error-value.patch new file mode 100644 index 00000000000..543fea1b9a0 --- /dev/null +++ b/queue-2.6.31/dm-dec_pending-needs-locking-to-save-error-value.patch @@ -0,0 +1,61 @@ +From f88fb981183e71daf40bbd84bc8251bbf7b59e19 Mon Sep 17 00:00:00 2001 +From: Kiyoshi Ueda +Date: Fri, 16 Oct 2009 23:18:15 +0100 +Subject: dm: dec_pending needs locking to save error value + +From: Kiyoshi Ueda + +commit f88fb981183e71daf40bbd84bc8251bbf7b59e19 upstream. + +Multiple instances of dec_pending() can run concurrently so a lock is +needed when it saves the first error code. + +I have never experienced actual problem without locking and just found +this during code inspection while implementing the barrier support +patch for request-based dm. + +This patch adds the locking. +I've done compile, boot and basic I/O testings. + +Signed-off-by: Kiyoshi Ueda +Signed-off-by: Jun'ichi Nomura +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -47,6 +47,7 @@ struct dm_io { + atomic_t io_count; + struct bio *bio; + unsigned long start_time; ++ spinlock_t endio_lock; + }; + + /* +@@ -576,8 +577,12 @@ static void dec_pending(struct dm_io *io + struct mapped_device *md = io->md; + + /* Push-back supersedes any I/O errors */ +- if (error && !(io->error > 0 && __noflush_suspending(md))) +- io->error = error; ++ if (unlikely(error)) { ++ spin_lock_irqsave(&io->endio_lock, flags); ++ if (!(io->error > 0 && __noflush_suspending(md))) ++ io->error = error; ++ spin_unlock_irqrestore(&io->endio_lock, flags); ++ } + + if (atomic_dec_and_test(&io->io_count)) { + if (io->error == DM_ENDIO_REQUEUE) { +@@ -1224,6 +1229,7 @@ static void __split_and_process_bio(stru + atomic_set(&ci.io->io_count, 1); + ci.io->bio = bio; + ci.io->md = md; ++ spin_lock_init(&ci.io->endio_lock); + ci.sector = bio->bi_sector; + ci.sector_count = bio_sectors(bio); + if (unlikely(bio_empty_barrier(bio))) diff --git a/queue-2.6.31/dm-exception-store-fix-failed-set_chunk_size-error-path.patch b/queue-2.6.31/dm-exception-store-fix-failed-set_chunk_size-error-path.patch new file mode 100644 index 00000000000..ccd8c2902b1 --- /dev/null +++ b/queue-2.6.31/dm-exception-store-fix-failed-set_chunk_size-error-path.patch @@ -0,0 +1,30 @@ +From 0e8c4e4e3ebb15756ddc4170a88149a2cd323cfe Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Fri, 16 Oct 2009 23:18:16 +0100 +Subject: dm exception store: fix failed set_chunk_size error path + +From: Mikulas Patocka + +commit 0e8c4e4e3ebb15756ddc4170a88149a2cd323cfe upstream. + +Properly close the device if failing because of an invalid chunk size. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-exception-store.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-exception-store.c ++++ b/drivers/md/dm-exception-store.c +@@ -251,7 +251,7 @@ int dm_exception_store_create(struct dm_ + + r = set_chunk_size(tmp_store, argv[2], &ti->error); + if (r) +- goto bad_cow; ++ goto bad_ctr; + + r = type->ctr(tmp_store, 0, NULL); + if (r) { diff --git a/queue-2.6.31/dm-log-userspace-fix-incorrect-luid-cast-in-userspace_ctr.patch b/queue-2.6.31/dm-log-userspace-fix-incorrect-luid-cast-in-userspace_ctr.patch new file mode 100644 index 00000000000..f761aa48c89 --- /dev/null +++ b/queue-2.6.31/dm-log-userspace-fix-incorrect-luid-cast-in-userspace_ctr.patch @@ -0,0 +1,34 @@ +From bca915aae803cf01fde4461fc9c093cf5a86d7fc Mon Sep 17 00:00:00 2001 +From: Andrew Morton +Date: Fri, 16 Oct 2009 23:18:15 +0100 +Subject: dm log: userspace fix incorrect luid cast in userspace_ctr + +From: Andrew Morton + +commit bca915aae803cf01fde4461fc9c093cf5a86d7fc upstream. + +mips: + +drivers/md/dm-log-userspace-base.c: In function `userspace_ctr': +drivers/md/dm-log-userspace-base.c:159: warning: cast from pointer to integer of different size + +Cc: Jonathan Brassow +Signed-off-by: Andrew Morton +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-log-userspace-base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/dm-log-userspace-base.c ++++ b/drivers/md/dm-log-userspace-base.c +@@ -156,7 +156,7 @@ static int userspace_ctr(struct dm_dirty + } + + /* The ptr value is sufficient for local unique id */ +- lc->luid = (uint64_t)lc; ++ lc->luid = (unsigned long)lc; + + lc->ti = ti; + diff --git a/queue-2.6.31/dm-snapshot-free-exception-store-on-init-failure.patch b/queue-2.6.31/dm-snapshot-free-exception-store-on-init-failure.patch new file mode 100644 index 00000000000..4fe58b31cf0 --- /dev/null +++ b/queue-2.6.31/dm-snapshot-free-exception-store-on-init-failure.patch @@ -0,0 +1,44 @@ +From 034a186d29dbcef099e57ab23ec39440596be911 Mon Sep 17 00:00:00 2001 +From: Jonathan Brassow +Date: Fri, 16 Oct 2009 23:18:14 +0100 +Subject: dm snapshot: free exception store on init failure + +From: Jonathan Brassow + +commit 034a186d29dbcef099e57ab23ec39440596be911 upstream. + +While initializing the snapshot module, if we fail to register +the snapshot target then we must back-out the exception store +module initialization. + +Signed-off-by: Jonathan Brassow +Reviewed-by: Mikulas Patocka +Reviewed-by: Mike Snitzer +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-snap.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -1465,7 +1465,7 @@ static int __init dm_snapshot_init(void) + r = dm_register_target(&snapshot_target); + if (r) { + DMERR("snapshot target register failed %d", r); +- return r; ++ goto bad_register_snapshot_target; + } + + r = dm_register_target(&origin_target); +@@ -1522,6 +1522,9 @@ bad2: + dm_unregister_target(&origin_target); + bad1: + dm_unregister_target(&snapshot_target); ++ ++bad_register_snapshot_target: ++ dm_exception_store_exit(); + return r; + } + diff --git a/queue-2.6.31/dm-snapshot-lock-snapshot-while-supplying-status.patch b/queue-2.6.31/dm-snapshot-lock-snapshot-while-supplying-status.patch new file mode 100644 index 00000000000..e6d7364f990 --- /dev/null +++ b/queue-2.6.31/dm-snapshot-lock-snapshot-while-supplying-status.patch @@ -0,0 +1,41 @@ +From 4c6fff445d7aa753957856278d4d93bcad6e2c14 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Fri, 16 Oct 2009 23:18:16 +0100 +Subject: dm snapshot: lock snapshot while supplying status + +From: Mikulas Patocka + +commit 4c6fff445d7aa753957856278d4d93bcad6e2c14 upstream. + +This patch locks the snapshot when returning status. It fixes a race +when it could return an invalid number of free chunks if someone +was simultaneously modifying it. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-snap.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -1147,6 +1147,8 @@ static int snapshot_status(struct dm_tar + unsigned sz = 0; + struct dm_snapshot *snap = ti->private; + ++ down_write(&snap->lock); ++ + switch (type) { + case STATUSTYPE_INFO: + if (!snap->valid) +@@ -1178,6 +1180,8 @@ static int snapshot_status(struct dm_tar + break; + } + ++ up_write(&snap->lock); ++ + return 0; + } + diff --git a/queue-2.6.31/dm-snapshot-require-non-zero-chunk-size-by-end-of-ctr.patch b/queue-2.6.31/dm-snapshot-require-non-zero-chunk-size-by-end-of-ctr.patch new file mode 100644 index 00000000000..91c0afa99ac --- /dev/null +++ b/queue-2.6.31/dm-snapshot-require-non-zero-chunk-size-by-end-of-ctr.patch @@ -0,0 +1,37 @@ +From 3f2412dc85260e5aae7ebb03bf50d5b1407e3083 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Fri, 16 Oct 2009 23:18:16 +0100 +Subject: dm snapshot: require non zero chunk size by end of ctr + +From: Mikulas Patocka + +commit 3f2412dc85260e5aae7ebb03bf50d5b1407e3083 upstream. + +If we are creating snapshot with memory-stored exception store, fail if +the user didn't specify chunk size. Zero chunk size would probably crash +a lot of places in the rest of snapshot code. + +Signed-off-by: Mikulas Patocka +Reviewed-by: Jonathan Brassow +Reviewed-by: Mike Snitzer +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-snap.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -673,6 +673,11 @@ static int snapshot_ctr(struct dm_target + bio_list_init(&s->queued_bios); + INIT_WORK(&s->queued_bios_work, flush_queued_bios); + ++ if (!s->store->chunk_size) { ++ ti->error = "Chunk size not set"; ++ goto bad_load_and_register; ++ } ++ + /* Add snapshot to the list of snapshots for this origin */ + /* Exceptions aren't triggered till snapshot_resume() is called */ + if (register_snapshot(s)) { diff --git a/queue-2.6.31/dm-snapshot-sort-by-chunk-size-to-fix-race.patch b/queue-2.6.31/dm-snapshot-sort-by-chunk-size-to-fix-race.patch new file mode 100644 index 00000000000..e79382dc363 --- /dev/null +++ b/queue-2.6.31/dm-snapshot-sort-by-chunk-size-to-fix-race.patch @@ -0,0 +1,72 @@ +From 6d45d93ead319423099b82a4efd775bc0f159121 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Fri, 16 Oct 2009 23:18:14 +0100 +Subject: dm snapshot: sort by chunk size to fix race + +From: Mikulas Patocka + +commit 6d45d93ead319423099b82a4efd775bc0f159121 upstream. + +Avoid a race causing corruption when snapshots of the same origin have +different chunk sizes by sorting the internal list of snapshots by chunk +size, largest first. + https://bugzilla.redhat.com/show_bug.cgi?id=182659 + +For example, let's have two snapshots with different chunk sizes. The +first snapshot (1) has small chunk size and the second snapshot (2) has +large chunk size. Let's have chunks A, B, C in these snapshots: +snapshot1: ====A==== ====B==== +snapshot2: ==========C========== + +(Chunk size is a power of 2. Chunks are aligned.) + +A write to the origin at a position within A and C comes along. It +triggers reallocation of A, then reallocation of C and links them +together using A as the 'primary' exception. + +Then another write to the origin comes along at a position within B and +C. It creates pending exception for B. C already has a reallocation in +progress and it already has a primary exception (A), so nothing is done +to it: B and C are not linked. + +If the reallocation of B finishes before the reallocation of C, because +there is no link with the pending exception for C it does not know to +wait for it and, the second write is dispatched to the origin and causes +data corruption in the chunk C in snapshot2. + +To avoid this situation, we maintain snapshots sorted in descending +order of chunk size. This leads to a guaranteed ordering on the links +between the pending exceptions and avoids the problem explained above - +both A and B now get linked to C. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-snap.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -296,6 +296,7 @@ static void __insert_origin(struct origi + */ + static int register_snapshot(struct dm_snapshot *snap) + { ++ struct dm_snapshot *l; + struct origin *o, *new_o; + struct block_device *bdev = snap->origin->bdev; + +@@ -319,7 +320,11 @@ static int register_snapshot(struct dm_s + __insert_origin(o); + } + +- list_add_tail(&snap->list, &o->snapshots); ++ /* Sort the list according to chunk size, largest-first smallest-last */ ++ list_for_each_entry(l, &o->snapshots, list) ++ if (l->store->chunk_size < snap->store->chunk_size) ++ break; ++ list_add_tail(&snap->list, &l->list); + + up_write(&_origins_lock); + return 0; diff --git a/queue-2.6.31/dm-snapshot-use-unsigned-integer-chunk-size.patch b/queue-2.6.31/dm-snapshot-use-unsigned-integer-chunk-size.patch new file mode 100644 index 00000000000..3ce449fddaa --- /dev/null +++ b/queue-2.6.31/dm-snapshot-use-unsigned-integer-chunk-size.patch @@ -0,0 +1,171 @@ +From df96eee679ba28c98cf722fa7c9f4286ee1ed0bd Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Fri, 16 Oct 2009 23:18:17 +0100 +Subject: dm snapshot: use unsigned integer chunk size + +From: Mikulas Patocka + +commit df96eee679ba28c98cf722fa7c9f4286ee1ed0bd upstream. + +Use unsigned integer chunk size. + +Maximum chunk size is 512kB, there won't ever be need to use 4GB chunk size, +so the number can be 32-bit. This fixes compiler failure on 32-bit systems +with large block devices. + +Signed-off-by: Mikulas Patocka +Signed-off-by: Mike Snitzer +Reviewed-by: Jonathan Brassow +Signed-off-by: Alasdair G Kergon +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/dm-exception-store.c | 20 +++++++++++--------- + drivers/md/dm-exception-store.h | 8 ++++---- + drivers/md/dm-snap-persistent.c | 16 ++++++++-------- + drivers/md/dm-snap.c | 4 ++-- + 4 files changed, 25 insertions(+), 23 deletions(-) + +--- a/drivers/md/dm-exception-store.c ++++ b/drivers/md/dm-exception-store.c +@@ -155,7 +155,8 @@ static int set_chunk_size(struct dm_exce + char *value; + + chunk_size_ulong = simple_strtoul(chunk_size_arg, &value, 10); +- if (*chunk_size_arg == '\0' || *value != '\0') { ++ if (*chunk_size_arg == '\0' || *value != '\0' || ++ chunk_size_ulong > UINT_MAX) { + *error = "Invalid chunk size"; + return -EINVAL; + } +@@ -171,34 +172,35 @@ static int set_chunk_size(struct dm_exce + */ + chunk_size_ulong = round_up(chunk_size_ulong, PAGE_SIZE >> 9); + +- return dm_exception_store_set_chunk_size(store, chunk_size_ulong, ++ return dm_exception_store_set_chunk_size(store, ++ (unsigned) chunk_size_ulong, + error); + } + + int dm_exception_store_set_chunk_size(struct dm_exception_store *store, +- unsigned long chunk_size_ulong, ++ unsigned chunk_size, + char **error) + { + /* Check chunk_size is a power of 2 */ +- if (!is_power_of_2(chunk_size_ulong)) { ++ if (!is_power_of_2(chunk_size)) { + *error = "Chunk size is not a power of 2"; + return -EINVAL; + } + + /* Validate the chunk size against the device block size */ +- if (chunk_size_ulong % (bdev_logical_block_size(store->cow->bdev) >> 9)) { ++ if (chunk_size % (bdev_logical_block_size(store->cow->bdev) >> 9)) { + *error = "Chunk size is not a multiple of device blocksize"; + return -EINVAL; + } + +- if (chunk_size_ulong > INT_MAX >> SECTOR_SHIFT) { ++ if (chunk_size > INT_MAX >> SECTOR_SHIFT) { + *error = "Chunk size is too high"; + return -EINVAL; + } + +- store->chunk_size = chunk_size_ulong; +- store->chunk_mask = chunk_size_ulong - 1; +- store->chunk_shift = ffs(chunk_size_ulong) - 1; ++ store->chunk_size = chunk_size; ++ store->chunk_mask = chunk_size - 1; ++ store->chunk_shift = ffs(chunk_size) - 1; + + return 0; + } +--- a/drivers/md/dm-exception-store.h ++++ b/drivers/md/dm-exception-store.h +@@ -101,9 +101,9 @@ struct dm_exception_store { + struct dm_dev *cow; + + /* Size of data blocks saved - must be a power of 2 */ +- chunk_t chunk_size; +- chunk_t chunk_mask; +- chunk_t chunk_shift; ++ unsigned chunk_size; ++ unsigned chunk_mask; ++ unsigned chunk_shift; + + void *context; + }; +@@ -169,7 +169,7 @@ int dm_exception_store_type_register(str + int dm_exception_store_type_unregister(struct dm_exception_store_type *type); + + int dm_exception_store_set_chunk_size(struct dm_exception_store *store, +- unsigned long chunk_size_ulong, ++ unsigned chunk_size, + char **error); + + int dm_exception_store_create(struct dm_target *ti, int argc, char **argv, +--- a/drivers/md/dm-snap.c ++++ b/drivers/md/dm-snap.c +@@ -961,7 +961,7 @@ static void start_copy(struct dm_snap_pe + + src.bdev = bdev; + src.sector = chunk_to_sector(s->store, pe->e.old_chunk); +- src.count = min(s->store->chunk_size, dev_size - src.sector); ++ src.count = min((sector_t)s->store->chunk_size, dev_size - src.sector); + + dest.bdev = s->store->cow->bdev; + dest.sector = chunk_to_sector(s->store, pe->e.new_chunk); +@@ -1402,7 +1402,7 @@ static void origin_resume(struct dm_targ + struct dm_dev *dev = ti->private; + struct dm_snapshot *snap; + struct origin *o; +- chunk_t chunk_size = 0; ++ unsigned chunk_size = 0; + + down_read(&_origins_lock); + o = __lookup_origin(dev->bdev); +--- a/drivers/md/dm-snap-persistent.c ++++ b/drivers/md/dm-snap-persistent.c +@@ -284,12 +284,13 @@ static int read_header(struct pstore *ps + { + int r; + struct disk_header *dh; +- chunk_t chunk_size; ++ unsigned chunk_size; + int chunk_size_supplied = 1; + char *chunk_err; + + /* +- * Use default chunk size (or hardsect_size, if larger) if none supplied ++ * Use default chunk size (or logical_block_size, if larger) ++ * if none supplied + */ + if (!ps->store->chunk_size) { + ps->store->chunk_size = max(DM_CHUNK_SIZE_DEFAULT_SECTORS, +@@ -334,10 +335,9 @@ static int read_header(struct pstore *ps + return 0; + + if (chunk_size_supplied) +- DMWARN("chunk size %llu in device metadata overrides " +- "table chunk size of %llu.", +- (unsigned long long)chunk_size, +- (unsigned long long)ps->store->chunk_size); ++ DMWARN("chunk size %u in device metadata overrides " ++ "table chunk size of %u.", ++ chunk_size, ps->store->chunk_size); + + /* We had a bogus chunk_size. Fix stuff up. */ + free_area(ps); +@@ -345,8 +345,8 @@ static int read_header(struct pstore *ps + r = dm_exception_store_set_chunk_size(ps->store, chunk_size, + &chunk_err); + if (r) { +- DMERR("invalid on-disk chunk size %llu: %s.", +- (unsigned long long)chunk_size, chunk_err); ++ DMERR("invalid on-disk chunk size %u: %s.", ++ chunk_size, chunk_err); + return r; + } + diff --git a/queue-2.6.31/do_mbind-fix-memory-leak.patch b/queue-2.6.31/do_mbind-fix-memory-leak.patch new file mode 100644 index 00000000000..24466a89fb1 --- /dev/null +++ b/queue-2.6.31/do_mbind-fix-memory-leak.patch @@ -0,0 +1,54 @@ +From b05ca7385a2848abdc72051f832722641daed8b0 Mon Sep 17 00:00:00 2001 +From: KOSAKI Motohiro +Date: Mon, 26 Oct 2009 16:49:59 -0700 +Subject: do_mbind(): fix memory leak + +From: KOSAKI Motohiro + +commit b05ca7385a2848abdc72051f832722641daed8b0 upstream. + +If migrate_prep is failed, new variable is leaked. This patch fixes it. + +Signed-off-by: KOSAKI Motohiro +Acked-by: Christoph Lameter +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/mempolicy.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -1024,7 +1024,7 @@ static long do_mbind(unsigned long start + + err = migrate_prep(); + if (err) +- return err; ++ goto mpol_out; + } + { + NODEMASK_SCRATCH(scratch); +@@ -1039,10 +1039,9 @@ static long do_mbind(unsigned long start + err = -ENOMEM; + NODEMASK_SCRATCH_FREE(scratch); + } +- if (err) { +- mpol_put(new); +- return err; +- } ++ if (err) ++ goto mpol_out; ++ + vma = check_range(mm, start, end, nmask, + flags | MPOL_MF_INVERT, &pagelist); + +@@ -1062,6 +1061,7 @@ static long do_mbind(unsigned long start + putback_lru_pages(&pagelist); + + up_write(&mm->mmap_sem); ++ mpol_out: + mpol_put(new); + return err; + } diff --git a/queue-2.6.31/dpt_i2o-fix-typo-of-einval.patch b/queue-2.6.31/dpt_i2o-fix-typo-of-einval.patch new file mode 100644 index 00000000000..423a9d8428a --- /dev/null +++ b/queue-2.6.31/dpt_i2o-fix-typo-of-einval.patch @@ -0,0 +1,32 @@ +From aefba418bfecd1985a08f50a95bd854a119f0153 Mon Sep 17 00:00:00 2001 +From: OGAWA Hirofumi +Date: Fri, 30 Oct 2009 17:02:31 +0900 +Subject: dpt_i2o: Fix typo of EINVAL + +From: OGAWA Hirofumi + +commit aefba418bfecd1985a08f50a95bd854a119f0153 upstream. + +Commit ef7562b7f28319e6dd1f85dc1af87df2a7a84832 ("dpt_i2o: Fix up +copy*user") had a silly typo: EINVAL should be -EINVAL. + +Signed-off-by: OGAWA Hirofumi +Cc: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/dpt_i2o.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/scsi/dpt_i2o.c ++++ b/drivers/scsi/dpt_i2o.c +@@ -1919,7 +1919,7 @@ static int adpt_i2o_passthru(adpt_hba* p + size = size>>16; + size *= 4; + if (size > MAX_MESSAGE_SIZE) { +- rcode = EINVAL; ++ rcode = -EINVAL; + goto cleanup; + } + /* Copy in the user's I2O command */ diff --git a/queue-2.6.31/dpt_i2o-fix-up-copy-user.patch b/queue-2.6.31/dpt_i2o-fix-up-copy-user.patch new file mode 100644 index 00000000000..ec0bad7a1cf --- /dev/null +++ b/queue-2.6.31/dpt_i2o-fix-up-copy-user.patch @@ -0,0 +1,30 @@ +From ef7562b7f28319e6dd1f85dc1af87df2a7a84832 Mon Sep 17 00:00:00 2001 +From: Alan Cox +Date: Tue, 27 Oct 2009 15:35:35 +0000 +Subject: dpt_i2o: Fix up copy*user + +From: Alan Cox + +commit ef7562b7f28319e6dd1f85dc1af87df2a7a84832 upstream. + +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/dpt_i2o.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/scsi/dpt_i2o.c ++++ b/drivers/scsi/dpt_i2o.c +@@ -1918,6 +1918,10 @@ static int adpt_i2o_passthru(adpt_hba* p + } + size = size>>16; + size *= 4; ++ if (size > MAX_MESSAGE_SIZE) { ++ rcode = EINVAL; ++ goto cleanup; ++ } + /* Copy in the user's I2O command */ + if (copy_from_user (msg, user_msg, size)) { + rcode = -EFAULT; diff --git a/queue-2.6.31/driver-core-fix-driver_register-return-value.patch b/queue-2.6.31/driver-core-fix-driver_register-return-value.patch new file mode 100644 index 00000000000..017770bdd4f --- /dev/null +++ b/queue-2.6.31/driver-core-fix-driver_register-return-value.patch @@ -0,0 +1,35 @@ +From 39acbc12affcaa23ef1d887ba3d197baca8e6e47 Mon Sep 17 00:00:00 2001 +From: Stas Sergeev +Date: Sun, 18 Oct 2009 00:31:38 +0400 +Subject: Driver core: fix driver_register() return value + +From: Stas Sergeev + +commit 39acbc12affcaa23ef1d887ba3d197baca8e6e47 upstream. + +In this patch: +http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=16dc42e018c2868211b4928f20a957c0c216126c +the check was added for another driver to already claim the same device +on the same bus. But the returned error code was wrong: to modprobe, the +-EEXIST means that _this_ driver is already installed. It therefore +doesn't produce the needed error message when _another_ driver is trying +to register for the same device. Returning -EBUSY fixes the problem. + +Signed-off-by: Stas Sergeev +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/driver.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/driver.c ++++ b/drivers/base/driver.c +@@ -236,7 +236,7 @@ int driver_register(struct device_driver + put_driver(other); + printk(KERN_ERR "Error: Driver '%s' is already registered, " + "aborting...\n", drv->name); +- return -EEXIST; ++ return -EBUSY; + } + + ret = bus_add_driver(drv); diff --git a/queue-2.6.31/fs-pipe.c-null-pointer-dereference.patch b/queue-2.6.31/fs-pipe.c-null-pointer-dereference.patch new file mode 100644 index 00000000000..5378492ad11 --- /dev/null +++ b/queue-2.6.31/fs-pipe.c-null-pointer-dereference.patch @@ -0,0 +1,135 @@ +From ad3960243e55320d74195fb85c975e0a8cc4466c Mon Sep 17 00:00:00 2001 +From: Earl Chew +Date: Mon, 19 Oct 2009 15:55:41 -0700 +Subject: fs: pipe.c null pointer dereference + +From: Earl Chew + +commit ad3960243e55320d74195fb85c975e0a8cc4466c upstream. + +This patch fixes a null pointer exception in pipe_rdwr_open() which +generates the stack trace: + +> Unable to handle kernel NULL pointer dereference at 0000000000000028 RIP: +> [] pipe_rdwr_open+0x35/0x70 +> [] __dentry_open+0x13c/0x230 +> [] do_filp_open+0x2d/0x40 +> [] do_sys_open+0x5a/0x100 +> [] sysenter_do_call+0x1b/0x67 + +The failure mode is triggered by an attempt to open an anonymous +pipe via /proc/pid/fd/* as exemplified by this script: + +============================================================= +while : ; do + { echo y ; sleep 1 ; } | { while read ; do echo z$REPLY; done ; } & + PID=$! + OUT=$(ps -efl | grep 'sleep 1' | grep -v grep | + { read PID REST ; echo $PID; } ) + OUT="${OUT%% *}" + DELAY=$((RANDOM * 1000 / 32768)) + usleep $((DELAY * 1000 + RANDOM % 1000 )) + echo n > /proc/$OUT/fd/1 # Trigger defect +done +============================================================= + +Note that the failure window is quite small and I could only +reliably reproduce the defect by inserting a small delay +in pipe_rdwr_open(). For example: + + static int + pipe_rdwr_open(struct inode *inode, struct file *filp) + { + msleep(100); + mutex_lock(&inode->i_mutex); + +Although the defect was observed in pipe_rdwr_open(), I think it +makes sense to replicate the change through all the pipe_*_open() +functions. + +The core of the change is to verify that inode->i_pipe has not +been released before attempting to manipulate it. If inode->i_pipe +is no longer present, return ENOENT to indicate so. + +The comment about potentially using atomic_t for i_pipe->readers +and i_pipe->writers has also been removed because it is no longer +relevant in this context. The inode->i_mutex lock must be used so +that inode->i_pipe can be dealt with correctly. + +Signed-off-by: Earl Chew +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/pipe.c | 41 ++++++++++++++++++++++++++++++----------- + 1 file changed, 30 insertions(+), 11 deletions(-) + +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -777,36 +777,55 @@ pipe_rdwr_release(struct inode *inode, s + static int + pipe_read_open(struct inode *inode, struct file *filp) + { +- /* We could have perhaps used atomic_t, but this and friends +- below are the only places. So it doesn't seem worthwhile. */ ++ int ret = -ENOENT; ++ + mutex_lock(&inode->i_mutex); +- inode->i_pipe->readers++; ++ ++ if (inode->i_pipe) { ++ ret = 0; ++ inode->i_pipe->readers++; ++ } ++ + mutex_unlock(&inode->i_mutex); + +- return 0; ++ return ret; + } + + static int + pipe_write_open(struct inode *inode, struct file *filp) + { ++ int ret = -ENOENT; ++ + mutex_lock(&inode->i_mutex); +- inode->i_pipe->writers++; ++ ++ if (inode->i_pipe) { ++ ret = 0; ++ inode->i_pipe->writers++; ++ } ++ + mutex_unlock(&inode->i_mutex); + +- return 0; ++ return ret; + } + + static int + pipe_rdwr_open(struct inode *inode, struct file *filp) + { ++ int ret = -ENOENT; ++ + mutex_lock(&inode->i_mutex); +- if (filp->f_mode & FMODE_READ) +- inode->i_pipe->readers++; +- if (filp->f_mode & FMODE_WRITE) +- inode->i_pipe->writers++; ++ ++ if (inode->i_pipe) { ++ ret = 0; ++ if (filp->f_mode & FMODE_READ) ++ inode->i_pipe->readers++; ++ if (filp->f_mode & FMODE_WRITE) ++ inode->i_pipe->writers++; ++ } ++ + mutex_unlock(&inode->i_mutex); + +- return 0; ++ return ret; + } + + /* diff --git a/queue-2.6.31/futex-check-for-null-keys-in-match_futex.patch b/queue-2.6.31/futex-check-for-null-keys-in-match_futex.patch new file mode 100644 index 00000000000..c562492efb2 --- /dev/null +++ b/queue-2.6.31/futex-check-for-null-keys-in-match_futex.patch @@ -0,0 +1,43 @@ +From 2bc872036e1c5948b5b02942810bbdd8dbdb9812 Mon Sep 17 00:00:00 2001 +From: Darren Hart +Date: Wed, 14 Oct 2009 10:12:39 -0700 +Subject: futex: Check for NULL keys in match_futex + +From: Darren Hart + +commit 2bc872036e1c5948b5b02942810bbdd8dbdb9812 upstream. + +If userspace tries to perform a requeue_pi on a non-requeue_pi waiter, +it will find the futex_q->requeue_pi_key to be NULL and OOPS. + +Check for NULL in match_futex() instead of doing explicit NULL pointer +checks on all call sites. While match_futex(NULL, NULL) returning +false is a little odd, it's still correct as we expect valid key +references. + +Signed-off-by: Darren Hart +Cc: Peter Zijlstra +Cc: Ingo Molnar +CC: Eric Dumazet +CC: Dinakar Guniguntala +CC: John Stultz +LKML-Reference: <4AD60687.10306@us.ibm.com> +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -150,7 +150,8 @@ static struct futex_hash_bucket *hash_fu + */ + static inline int match_futex(union futex_key *key1, union futex_key *key2) + { +- return (key1->both.word == key2->both.word ++ return (key1 && key2 ++ && key1->both.word == key2->both.word + && key1->both.ptr == key2->both.ptr + && key1->both.offset == key2->both.offset); + } diff --git a/queue-2.6.31/futex-fix-spurious-wakeup-for-requeue_pi-really.patch b/queue-2.6.31/futex-fix-spurious-wakeup-for-requeue_pi-really.patch new file mode 100644 index 00000000000..a1ac03781c8 --- /dev/null +++ b/queue-2.6.31/futex-fix-spurious-wakeup-for-requeue_pi-really.patch @@ -0,0 +1,67 @@ +From 11df6dddcbc38affb7473aad3d962baf8414a947 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Wed, 28 Oct 2009 20:26:48 +0100 +Subject: futex: Fix spurious wakeup for requeue_pi really + +From: Thomas Gleixner + +commit 11df6dddcbc38affb7473aad3d962baf8414a947 upstream. + +The requeue_pi path doesn't use unqueue_me() (and the racy lock_ptr == +NULL test) nor does it use the wake_list of futex_wake() which where +the reason for commit 41890f2 (futex: Handle spurious wake up) + +See debugging discussing on LKML Message-ID: <4AD4080C.20703@us.ibm.com> + +The changes in this fix to the wait_requeue_pi path were considered to +be a likely unecessary, but harmless safety net. But it turns out that +due to the fact that for unknown $@#!*( reasons EWOULDBLOCK is defined +as EAGAIN we built an endless loop in the code path which returns +correctly EWOULDBLOCK. + +Spurious wakeups in wait_requeue_pi code path are unlikely so we do +the easy solution and return EWOULDBLOCK^WEAGAIN to user space and let +it deal with the spurious wakeup. + +Cc: Darren Hart +Cc: Peter Zijlstra +Cc: Eric Dumazet +Cc: John Stultz +Cc: Dinakar Guniguntala +LKML-Reference: <4AE23C74.1090502@us.ibm.com> +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -2103,7 +2103,7 @@ int handle_early_requeue_pi_wakeup(struc + plist_del(&q->list, &q->list.plist); + + /* Handle spurious wakeups gracefully */ +- ret = -EAGAIN; ++ ret = -EWOULDBLOCK; + if (timeout && !timeout->task) + ret = -ETIMEDOUT; + else if (signal_pending(current)) +@@ -2184,7 +2184,6 @@ static int futex_wait_requeue_pi(u32 __u + debug_rt_mutex_init_waiter(&rt_waiter); + rt_waiter.task = NULL; + +-retry: + key2 = FUTEX_KEY_INIT; + ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE); + if (unlikely(ret != 0)) +@@ -2282,9 +2281,6 @@ out_put_keys: + out_key2: + put_futex_key(fshared, &key2); + +- /* Spurious wakeup ? */ +- if (ret == -EAGAIN) +- goto retry; + out: + if (to) { + hrtimer_cancel(&to->timer); diff --git a/queue-2.6.31/futex-handle-spurious-wake-up.patch b/queue-2.6.31/futex-handle-spurious-wake-up.patch new file mode 100644 index 00000000000..d7d7f09c274 --- /dev/null +++ b/queue-2.6.31/futex-handle-spurious-wake-up.patch @@ -0,0 +1,94 @@ +From d58e6576b0deec6f0b9ff8450fe282da18c50883 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Tue, 13 Oct 2009 20:40:43 +0200 +Subject: futex: Handle spurious wake up + +From: Thomas Gleixner + +commit d58e6576b0deec6f0b9ff8450fe282da18c50883 upstream. + +The futex code does not handle spurious wake up in futex_wait and +futex_wait_requeue_pi. + +The code assumes that any wake up which was not caused by futex_wake / +requeue or by a timeout was caused by a signal wake up and returns one +of the syscall restart error codes. + +In case of a spurious wake up the signal delivery code which deals +with the restart error codes is not invoked and we return that error +code to user space. That causes applications which actually check the +return codes to fail. Blaise reported that on preempt-rt a python test +program run into a exception trap. -rt exposed that due to a built in +spurious wake up accelerator :) + +Solve this by checking signal_pending(current) in the wake up path and +handle the spurious wake up case w/o returning to user space. + +Reported-by: Blaise Gassend +Debugged-by: Darren Hart +Signed-off-by: Thomas Gleixner +Cc: Peter Zijlstra +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1767,6 +1767,7 @@ static int futex_wait(u32 __user *uaddr, + current->timer_slack_ns); + } + ++retry: + /* Prepare to wait on uaddr. */ + ret = futex_wait_setup(uaddr, val, fshared, &q, &hb); + if (ret) +@@ -1784,9 +1785,14 @@ static int futex_wait(u32 __user *uaddr, + goto out_put_key; + + /* +- * We expect signal_pending(current), but another thread may +- * have handled it for us already. ++ * We expect signal_pending(current), but we might be the ++ * victim of a spurious wakeup as well. + */ ++ if (!signal_pending(current)) { ++ put_futex_key(fshared, &q.key); ++ goto retry; ++ } ++ + ret = -ERESTARTSYS; + if (!abs_time) + goto out_put_key; +@@ -2094,9 +2100,11 @@ int handle_early_requeue_pi_wakeup(struc + */ + plist_del(&q->list, &q->list.plist); + ++ /* Handle spurious wakeups gracefully */ ++ ret = -EAGAIN; + if (timeout && !timeout->task) + ret = -ETIMEDOUT; +- else ++ else if (signal_pending(current)) + ret = -ERESTARTNOINTR; + } + return ret; +@@ -2174,6 +2182,7 @@ static int futex_wait_requeue_pi(u32 __u + debug_rt_mutex_init_waiter(&rt_waiter); + rt_waiter.task = NULL; + ++retry: + key2 = FUTEX_KEY_INIT; + ret = get_futex_key(uaddr2, fshared, &key2, VERIFY_WRITE); + if (unlikely(ret != 0)) +@@ -2271,6 +2280,9 @@ out_put_keys: + out_key2: + put_futex_key(fshared, &key2); + ++ /* Spurious wakeup ? */ ++ if (ret == -EAGAIN) ++ goto retry; + out: + if (to) { + hrtimer_cancel(&to->timer); diff --git a/queue-2.6.31/futex-move-drop_futex_key_refs-out-of-spinlock-ed-region.patch b/queue-2.6.31/futex-move-drop_futex_key_refs-out-of-spinlock-ed-region.patch new file mode 100644 index 00000000000..8e4aee5eda3 --- /dev/null +++ b/queue-2.6.31/futex-move-drop_futex_key_refs-out-of-spinlock-ed-region.patch @@ -0,0 +1,62 @@ +From 89061d3d58e1f0742139605dc6a7950aa1ecc019 Mon Sep 17 00:00:00 2001 +From: Darren Hart +Date: Thu, 15 Oct 2009 15:30:48 -0700 +Subject: futex: Move drop_futex_key_refs out of spinlock'ed region + +From: Darren Hart + +commit 89061d3d58e1f0742139605dc6a7950aa1ecc019 upstream. + +When requeuing tasks from one futex to another, the reference held +by the requeued task to the original futex location needs to be +dropped eventually. + +Dropping the reference may ultimately lead to a call to +"iput_final" and subsequently call into filesystem- specific code - +which may be non-atomic. + +It is therefore safer to defer this drop operation until after the +futex_hash_bucket spinlock has been dropped. + +Originally-From: Helge Bahmann +Signed-off-by: Darren Hart +Cc: Peter Zijlstra +Cc: Eric Dumazet +Cc: Dinakar Guniguntala +Cc: John Stultz +Cc: Sven-Thorsten Dietrich +Cc: John Kacur +LKML-Reference: <4AD7A298.5040802@us.ibm.com> +Signed-off-by: Ingo Molnar +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/futex.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -1028,7 +1028,6 @@ static inline + void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key, + struct futex_hash_bucket *hb) + { +- drop_futex_key_refs(&q->key); + get_futex_key_refs(key); + q->key = *key; + +@@ -1226,6 +1225,7 @@ retry_private: + */ + if (ret == 1) { + WARN_ON(pi_state); ++ drop_count++; + task_count++; + ret = get_futex_value_locked(&curval2, uaddr2); + if (!ret) +@@ -1304,6 +1304,7 @@ retry_private: + if (ret == 1) { + /* We got the lock. */ + requeue_pi_wake_futex(this, &key2, hb2); ++ drop_count++; + continue; + } else if (ret) { + /* -EDEADLK */ diff --git a/queue-2.6.31/hfsplus-refuse-to-mount-volumes-larger-than-2tb.patch b/queue-2.6.31/hfsplus-refuse-to-mount-volumes-larger-than-2tb.patch new file mode 100644 index 00000000000..1ea38eb292f --- /dev/null +++ b/queue-2.6.31/hfsplus-refuse-to-mount-volumes-larger-than-2tb.patch @@ -0,0 +1,47 @@ +From 5c36fe3d87b3f0c85894a49193c66096a3d6b26f Mon Sep 17 00:00:00 2001 +From: Ben Hutchings +Date: Mon, 26 Oct 2009 16:49:51 -0700 +Subject: hfsplus: refuse to mount volumes larger than 2TB + +From: Ben Hutchings + +commit 5c36fe3d87b3f0c85894a49193c66096a3d6b26f upstream. + +As found in , hfsplus is using type u32 +rather than sector_t for some sector number calculations. + +In particular, hfsplus_get_block() does: + + u32 ablock, dblock, mask; +... + map_bh(bh_result, sb, (dblock << HFSPLUS_SB(sb).fs_shift) + HFSPLUS_SB(sb).blockoffset + (iblock & mask)); + +I am not confident that I can find and fix all cases where a sector number +may be truncated. For now, avoid data loss by refusing to mount HFS+ +volumes with more than 2^32 sectors (2TB). + +[akpm@linux-foundation.org: fix 32 and 64-bit issues] +Signed-off-by: Ben Hutchings +Cc: Eric Sesterhenn +Cc: Roman Zippel +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/hfsplus/wrapper.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/hfsplus/wrapper.c ++++ b/fs/hfsplus/wrapper.c +@@ -99,6 +99,10 @@ int hfsplus_read_wrapper(struct super_bl + + if (hfsplus_get_last_session(sb, &part_start, &part_size)) + return -EINVAL; ++ if ((u64)part_start + part_size > 0x100000000ULL) { ++ pr_err("hfs: volumes larger than 2TB are not supported yet\n"); ++ return -EINVAL; ++ } + while (1) { + bh = sb_bread512(sb, part_start + HFSPLUS_VOLHEAD_SECTOR, vhdr); + if (!bh) diff --git a/queue-2.6.31/input-synaptics-add-another-protege-m300-to-rate-blacklist.patch b/queue-2.6.31/input-synaptics-add-another-protege-m300-to-rate-blacklist.patch new file mode 100644 index 00000000000..071504537f8 --- /dev/null +++ b/queue-2.6.31/input-synaptics-add-another-protege-m300-to-rate-blacklist.patch @@ -0,0 +1,42 @@ +From 5f5eeff4c93256ee93435a3bf08cf18c45e9a994 Mon Sep 17 00:00:00 2001 +From: Dmitry Torokhov +Date: Mon, 12 Oct 2009 21:35:00 -0700 +Subject: Input: synaptics - add another Protege M300 to rate blacklist + +From: Dmitry Torokhov + +commit 5f5eeff4c93256ee93435a3bf08cf18c45e9a994 upstream. + +Apparently some of Toshiba Protege M300 identify themselves as +"Portable PC" in DMI so we need to add that to the DMI table as +well. We need DMI data so we can automatically lower Synaptics +reporting rate from 80 to 40 pps to avoid over-taxing their +keyboard controllers. + +Tested-by: Rod Davison +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/input/mouse/synaptics.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -652,6 +652,16 @@ static const struct dmi_system_id toshib + DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), + DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"), + }, ++ ++ }, ++ { ++ .ident = "Toshiba Portege M300", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"), ++ }, ++ + }, + { } + }; diff --git a/queue-2.6.31/kvm-ignore-reads-from-amds-c1e-enabled-msr.patch b/queue-2.6.31/kvm-ignore-reads-from-amds-c1e-enabled-msr.patch new file mode 100644 index 00000000000..2d29ce49613 --- /dev/null +++ b/queue-2.6.31/kvm-ignore-reads-from-amds-c1e-enabled-msr.patch @@ -0,0 +1,32 @@ +From 1fdbd48c242db996107f72ae4140ffe8163e26a8 Mon Sep 17 00:00:00 2001 +From: Andre Przywara +Date: Wed, 24 Jun 2009 12:44:34 +0200 +Subject: KVM: ignore reads from AMDs C1E enabled MSR + +From: Andre Przywara + +commit 1fdbd48c242db996107f72ae4140ffe8163e26a8 upstream. + +If the Linux kernel detects an C1E capable AMD processor (K8 RevF and +higher), it will access a certain MSR on every attempt to go to halt. +Explicitly handle this read and return 0 to let KVM run a Linux guest +with the native AMD host CPU propagated to the guest. + +Signed-off-by: Andre Przywara +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/x86.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -949,6 +949,7 @@ int kvm_get_msr_common(struct kvm_vcpu * + case MSR_P6_EVNTSEL0: + case MSR_P6_EVNTSEL1: + case MSR_K7_EVNTSEL0: ++ case MSR_K8_INT_PENDING_MSG: + data = 0; + break; + case MSR_MTRRcap: diff --git a/queue-2.6.31/kvm-use-proper-hrtimer-function-to-retrieve-expiration-time.patch b/queue-2.6.31/kvm-use-proper-hrtimer-function-to-retrieve-expiration-time.patch new file mode 100644 index 00000000000..7e92a29bc6a --- /dev/null +++ b/queue-2.6.31/kvm-use-proper-hrtimer-function-to-retrieve-expiration-time.patch @@ -0,0 +1,45 @@ +From ace1546487a0fe4634e3251067f8a32cb2cdc099 Mon Sep 17 00:00:00 2001 +From: Marcelo Tosatti +Date: Thu, 8 Oct 2009 10:55:03 -0300 +Subject: KVM: use proper hrtimer function to retrieve expiration time + +From: Marcelo Tosatti + +commit ace1546487a0fe4634e3251067f8a32cb2cdc099 upstream. + +hrtimer->base can be temporarily NULL due to racing hrtimer_start. +See switch_hrtimer_base/lock_hrtimer_base. + +Use hrtimer_get_remaining which is robust against it. + +Signed-off-by: Marcelo Tosatti +Signed-off-by: Avi Kivity +Signed-off-by: Greg Kroah-Hartman + +--- + arch/x86/kvm/i8254.c | 2 +- + arch/x86/kvm/lapic.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kvm/i8254.c ++++ b/arch/x86/kvm/i8254.c +@@ -116,7 +116,7 @@ static s64 __kpit_elapsed(struct kvm *kv + * itself with the initial count and continues counting + * from there. + */ +- remaining = hrtimer_expires_remaining(&ps->pit_timer.timer); ++ remaining = hrtimer_get_remaining(&ps->pit_timer.timer); + elapsed = ps->pit_timer.period - ktime_to_ns(remaining); + elapsed = mod_64(elapsed, ps->pit_timer.period); + +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -464,7 +464,7 @@ static u32 apic_get_tmcct(struct kvm_lap + if (apic_get_reg(apic, APIC_TMICT) == 0) + return 0; + +- remaining = hrtimer_expires_remaining(&apic->lapic_timer.timer); ++ remaining = hrtimer_get_remaining(&apic->lapic_timer.timer); + if (ktime_to_ns(remaining) < 0) + remaining = ktime_set(0, 0); + diff --git a/queue-2.6.31/libata-fix-internal-command-failure-handling.patch b/queue-2.6.31/libata-fix-internal-command-failure-handling.patch new file mode 100644 index 00000000000..fc416b15517 --- /dev/null +++ b/queue-2.6.31/libata-fix-internal-command-failure-handling.patch @@ -0,0 +1,51 @@ +From f4b31db92d163df8a639f5a8c8633bdeb6e8432d Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Fri, 16 Oct 2009 13:00:51 +0900 +Subject: libata: fix internal command failure handling + +From: Tejun Heo + +commit f4b31db92d163df8a639f5a8c8633bdeb6e8432d upstream. + +When an internal command fails, it should be failed directly without +invoking EH. In the original implemetation, this was accomplished by +letting internal command bypass failure handling in ata_qc_complete(). +However, later changes added post-successful-completion handling to +that code path and the success path is no longer adequate as internal +command failure path. One of the visible problems is that internal +command failure due to timeout or other freeze conditions would +spuriously trigger WARN_ON_ONCE() in the success path. + +This patch updates failure path such that internal command failure +handling is contained there. + +Signed-off-by: Tejun Heo +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-core.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -5008,12 +5008,14 @@ void ata_qc_complete(struct ata_queued_c + qc->flags |= ATA_QCFLAG_FAILED; + + if (unlikely(qc->flags & ATA_QCFLAG_FAILED)) { +- if (!ata_tag_internal(qc->tag)) { +- /* always fill result TF for failed qc */ +- fill_result_tf(qc); ++ /* always fill result TF for failed qc */ ++ fill_result_tf(qc); ++ ++ if (!ata_tag_internal(qc->tag)) + ata_qc_schedule_eh(qc); +- return; +- } ++ else ++ __ata_qc_complete(qc); ++ return; + } + + /* read result TF if requested */ diff --git a/queue-2.6.31/libata-fix-pmp-initialization.patch b/queue-2.6.31/libata-fix-pmp-initialization.patch new file mode 100644 index 00000000000..8b42d8310e3 --- /dev/null +++ b/queue-2.6.31/libata-fix-pmp-initialization.patch @@ -0,0 +1,53 @@ +From 4f7c2874995ac48a4622755b8bd159eb2fb6d8f4 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Thu, 15 Oct 2009 23:37:32 +0900 +Subject: libata: fix PMP initialization + +From: Tejun Heo + +commit 4f7c2874995ac48a4622755b8bd159eb2fb6d8f4 upstream. + +Commit 842faa6c1a1d6faddf3377948e5cf214812c6c90 fixed error handling +during attach by not committing detected device class to dev->class +while attaching a new device. However, this change missed the PMP +class check in the configuration loop causing a new PMP device to go +through ata_dev_configure() as if it were an ATA or ATAPI device. + +As PMP device doesn't have a regular IDENTIFY data, this makes +ata_dev_configure() tries to configure a PMP device using an invalid +data. For the most part, it wasn't too harmful and went unnoticed but +this ends up clearing dev->flags which may have ATA_DFLAG_AN set by +sata_pmp_attach(). This means that SATA_PMP_FEAT_NOTIFY ends up being +disabled on PMPs and on PMPs which honor the flag breaks hotplug +support. + +This problem was discovered and reported by Ethan Hsiao. + +Signed-off-by: Tejun Heo +Reported-by: Ethan Hsiao +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/libata-eh.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -2849,12 +2849,14 @@ static int ata_eh_revalidate_and_attach( + * device detection messages backwards. + */ + ata_for_each_dev(dev, link, ALL) { +- if (!(new_mask & (1 << dev->devno)) || +- dev->class == ATA_DEV_PMP) ++ if (!(new_mask & (1 << dev->devno))) + continue; + + dev->class = ehc->classes[dev->devno]; + ++ if (dev->class == ATA_DEV_PMP) ++ continue; ++ + ehc->i.flags |= ATA_EHI_PRINTINFO; + rc = ata_dev_configure(dev); + ehc->i.flags &= ~ATA_EHI_PRINTINFO; diff --git a/queue-2.6.31/mbind-fix-leak-of-never-putback-pages.patch b/queue-2.6.31/mbind-fix-leak-of-never-putback-pages.patch new file mode 100644 index 00000000000..f7acaf7e375 --- /dev/null +++ b/queue-2.6.31/mbind-fix-leak-of-never-putback-pages.patch @@ -0,0 +1,105 @@ +From ab8a3e14e6f8e567560f664bbd29aefb306a274e Mon Sep 17 00:00:00 2001 +From: KOSAKI Motohiro +Date: Mon, 26 Oct 2009 16:49:58 -0700 +Subject: mbind(): fix leak of never putback pages + +From: KOSAKI Motohiro + +commit ab8a3e14e6f8e567560f664bbd29aefb306a274e upstream. + +If mbind() receives an invalid address, do_mbind leaks a page. The +following test program detects this leak. + +This patch fixes it. + +migrate_efault.c +======================================= + #include + #include + #include + #include + #include + #include + #include + +static unsigned long pagesize; + +static void* make_hole_mapping(void) +{ + + void* addr; + + addr = mmap(NULL, pagesize*3, PROT_READ|PROT_WRITE, + MAP_ANON|MAP_PRIVATE, 0, 0); + if (addr == MAP_FAILED) + return NULL; + + /* make page populate */ + memset(addr, 0, pagesize*3); + + /* make memory hole */ + munmap(addr+pagesize, pagesize); + + return addr; +} + +int main(int argc, char** argv) +{ + void* addr; + int ch; + int node; + struct bitmask *nmask = numa_allocate_nodemask(); + int err; + int node_set = 0; + + while ((ch = getopt(argc, argv, "n:")) != -1){ + switch (ch){ + case 'n': + node = strtol(optarg, NULL, 0); + numa_bitmask_setbit(nmask, node); + node_set = 1; + break; + default: + ; + } + } + argc -= optind; + argv += optind; + + if (!node_set) + numa_bitmask_setbit(nmask, 0); + + pagesize = getpagesize(); + + addr = make_hole_mapping(); + + err = mbind(addr, pagesize*3, MPOL_BIND, nmask->maskp, nmask->size, MPOL_MF_MOVE_ALL); + if (err) + perror("mbind "); + + return 0; +} +======================================= + +Signed-off-by: KOSAKI Motohiro +Acked-by: Christoph Lameter +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/mempolicy.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -1058,7 +1058,8 @@ static long do_mbind(unsigned long start + + if (!err && nr_failed && (flags & MPOL_MF_STRICT)) + err = -EIO; +- } ++ } else ++ putback_lru_pages(&pagelist); + + up_write(&mm->mmap_sem); + mpol_put(new); diff --git a/queue-2.6.31/nfs-fix-nfs_parse_mount_options-kfree-leak.patch b/queue-2.6.31/nfs-fix-nfs_parse_mount_options-kfree-leak.patch new file mode 100644 index 00000000000..d489bad727c --- /dev/null +++ b/queue-2.6.31/nfs-fix-nfs_parse_mount_options-kfree-leak.patch @@ -0,0 +1,36 @@ +From 4223a4a155f245d41c350ed9eba4fc32e965c4da Mon Sep 17 00:00:00 2001 +From: Yinghai Lu +Date: Tue, 20 Oct 2009 14:13:46 +0900 +Subject: nfs: Fix nfs_parse_mount_options() kfree() leak + +From: Yinghai Lu + +commit 4223a4a155f245d41c350ed9eba4fc32e965c4da upstream. + +Fix a (small) memory leak in one of the error paths of the NFS mount +options parsing code. + +Regression introduced in 2.6.30 by commit a67d18f (NFS: load the +rpc/rdma transport module automatically). + +Reported-by: Yinghai Lu +Reported-by: Pekka Enberg +Signed-off-by: Ingo Molnar +Signed-off-by: Trond Myklebust +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/nfs/super.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -1323,6 +1323,7 @@ static int nfs_parse_mount_options(char + default: + dfprintk(MOUNT, "NFS: unrecognized " + "transport protocol\n"); ++ kfree(string); + return 0; + } + break; diff --git a/queue-2.6.31/pci-increase-alignment-to-make-more-space-for-hidden-code.patch b/queue-2.6.31/pci-increase-alignment-to-make-more-space-for-hidden-code.patch new file mode 100644 index 00000000000..3fc9dee31e0 --- /dev/null +++ b/queue-2.6.31/pci-increase-alignment-to-make-more-space-for-hidden-code.patch @@ -0,0 +1,40 @@ +From 15b812f1d0a5ca8f5efe7f5882f468af10682ca8 Mon Sep 17 00:00:00 2001 +From: Yinghai Lu +Date: Sun, 11 Oct 2009 14:17:16 -0700 +Subject: pci: increase alignment to make more space for hidden code + +From: Yinghai Lu + +commit 15b812f1d0a5ca8f5efe7f5882f468af10682ca8 upstream. + +As reported in + + http://bugzilla.kernel.org/show_bug.cgi?id=13940 + +on some system when acpi are enabled, acpi clears some BAR for some +devices without reason, and kernel will need to allocate devices for +them. It then apparently hits some undocumented resource conflict, +resulting in non-working devices. + +Try to increase alignment to get more safe range for unassigned devices. + +Signed-off-by: Yinghai Lu +Signed-off-by: Linus Torvalds + +--- + arch/x86/kernel/e820.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/kernel/e820.c ++++ b/arch/x86/kernel/e820.c +@@ -1378,8 +1378,8 @@ static unsigned long ram_alignment(resou + if (mb < 16) + return 1024*1024; + +- /* To 32MB for anything above that */ +- return 32*1024*1024; ++ /* To 64MB for anything above that */ ++ return 64*1024*1024; + } + + #define MAX_RESOURCE_SIZE ((resource_size_t)-1) diff --git a/queue-2.6.31/ray_cs-fix-copy_from_user-handling.patch b/queue-2.6.31/ray_cs-fix-copy_from_user-handling.patch new file mode 100644 index 00000000000..66d029d15a1 --- /dev/null +++ b/queue-2.6.31/ray_cs-fix-copy_from_user-handling.patch @@ -0,0 +1,30 @@ +From 575c9ed7798218dc923f319c0d78f0c25ca506b9 Mon Sep 17 00:00:00 2001 +From: Alan Cox +Date: Tue, 27 Oct 2009 15:35:55 +0000 +Subject: ray_cs: Fix copy_from_user handling + +From: Alan Cox + +commit 575c9ed7798218dc923f319c0d78f0c25ca506b9 upstream. + +I've not touched the other stuff here but the word "locking" comes to mind. + +Signed-off-by: Alan Cox +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/ray_cs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/ray_cs.c ++++ b/drivers/net/wireless/ray_cs.c +@@ -2878,7 +2878,7 @@ static int write_essid(struct file *file + unsigned long count, void *data) + { + static char proc_essid[33]; +- int len = count; ++ unsigned int len = count; + + if (len > 32) + len = 32; diff --git a/queue-2.6.31/sata_nv-make-sure-link-is-brough-up-online-when-skipping-hardreset.patch b/queue-2.6.31/sata_nv-make-sure-link-is-brough-up-online-when-skipping-hardreset.patch new file mode 100644 index 00000000000..c7157a18b40 --- /dev/null +++ b/queue-2.6.31/sata_nv-make-sure-link-is-brough-up-online-when-skipping-hardreset.patch @@ -0,0 +1,56 @@ +From 6489e3262e6b188a1a009b65e8a94b7aa17645b7 Mon Sep 17 00:00:00 2001 +From: Tejun Heo +Date: Wed, 14 Oct 2009 11:18:28 +0900 +Subject: sata_nv: make sure link is brough up online when skipping hardreset + +From: Tejun Heo + +commit 6489e3262e6b188a1a009b65e8a94b7aa17645b7 upstream. + +prereset doesn't bring link online if hardreset is about to happen and +nv_hardreset() may skip if conditions are not right so softreset may +be entered with non-working link status if the system firmware didn't +bring it up before entering OS code which can happen during resume. +This patch makes nv_hardreset() to bring up the link if it's skipping +reset. + +This bug was reported by frodone@gmail.com in the following bug entry. + + http://bugzilla.kernel.org/show_bug.cgi?id=14329 + +Signed-off-by: Tejun Heo +Reported-by: frodone@gmail.com +Signed-off-by: Jeff Garzik +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/sata_nv.c | 18 +++++++++++++++--- + 1 file changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/ata/sata_nv.c ++++ b/drivers/ata/sata_nv.c +@@ -1594,9 +1594,21 @@ static int nv_hardreset(struct ata_link + !ata_dev_enabled(link->device)) + sata_link_hardreset(link, sata_deb_timing_hotplug, deadline, + NULL, NULL); +- else if (!(ehc->i.flags & ATA_EHI_QUIET)) +- ata_link_printk(link, KERN_INFO, +- "nv: skipping hardreset on occupied port\n"); ++ else { ++ const unsigned long *timing = sata_ehc_deb_timing(ehc); ++ int rc; ++ ++ if (!(ehc->i.flags & ATA_EHI_QUIET)) ++ ata_link_printk(link, KERN_INFO, "nv: skipping " ++ "hardreset on occupied port\n"); ++ ++ /* make sure the link is online */ ++ rc = sata_link_resume(link, timing, deadline); ++ /* whine about phy resume failure but proceed */ ++ if (rc && rc != -EOPNOTSUPP) ++ ata_link_printk(link, KERN_WARNING, "failed to resume " ++ "link (errno=%d)\n", rc); ++ } + + /* device signature acquisition is unreliable */ + return -EAGAIN; diff --git a/queue-2.6.31/series b/queue-2.6.31/series new file mode 100644 index 00000000000..acc1c22ff7b --- /dev/null +++ b/queue-2.6.31/series @@ -0,0 +1,35 @@ +fs-pipe.c-null-pointer-dereference.patch +pci-increase-alignment-to-make-more-space-for-hidden-code.patch +libata-fix-internal-command-failure-handling.patch +libata-fix-pmp-initialization.patch +sata_nv-make-sure-link-is-brough-up-online-when-skipping-hardreset.patch +nfs-fix-nfs_parse_mount_options-kfree-leak.patch +kvm-use-proper-hrtimer-function-to-retrieve-expiration-time.patch +kvm-ignore-reads-from-amds-c1e-enabled-msr.patch +futex-handle-spurious-wake-up.patch +futex-check-for-null-keys-in-match_futex.patch +futex-move-drop_futex_key_refs-out-of-spinlock-ed-region.patch +futex-fix-spurious-wakeup-for-requeue_pi-really.patch +ahci-revert-restore-sb600-sata-controller-64-bit-dma.patch +sparc64-set-irqf_disabled-on-ldc-channel-irqs.patch +sparc-kill-prom-console-driver.patch +watchdog-fix-rio-watchdog-probe-function.patch +input-synaptics-add-another-protege-m300-to-rate-blacklist.patch +dm-snapshot-free-exception-store-on-init-failure.patch +dm-snapshot-sort-by-chunk-size-to-fix-race.patch +dm-log-userspace-fix-incorrect-luid-cast-in-userspace_ctr.patch +dm-add-missing-del_gendisk-to-alloc_dev-error-path.patch +dm-dec_pending-needs-locking-to-save-error-value.patch +dm-exception-store-fix-failed-set_chunk_size-error-path.patch +dm-snapshot-lock-snapshot-while-supplying-status.patch +dm-snapshot-require-non-zero-chunk-size-by-end-of-ctr.patch +dm-snapshot-use-unsigned-integer-chunk-size.patch +ray_cs-fix-copy_from_user-handling.patch +mbind-fix-leak-of-never-putback-pages.patch +do_mbind-fix-memory-leak.patch +8250_pci-add-ibm-saturn-serial-card.patch +dpt_i2o-fix-up-copy-user.patch +dpt_i2o-fix-typo-of-einval.patch +hfsplus-refuse-to-mount-volumes-larger-than-2tb.patch +driver-core-fix-driver_register-return-value.patch +tty-mark-generic_serial-users-as-broken.patch diff --git a/queue-2.6.31/sparc-kill-prom-console-driver.patch b/queue-2.6.31/sparc-kill-prom-console-driver.patch new file mode 100644 index 00000000000..3dab2d74f98 --- /dev/null +++ b/queue-2.6.31/sparc-kill-prom-console-driver.patch @@ -0,0 +1,756 @@ +From bd89468f0c36c1e6022332d81eae214c0173452c Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Tue, 15 Sep 2009 17:04:38 -0700 +Subject: sparc: Kill PROM console driver. + +From: David S. Miller + +[ Upstream commit 09d3f3f0e02c8a900d076c302c5c02227f33572d ] + +Many years ago when this driver was written, it had a use, but these +days it's nothing but trouble and distributions should not enable it +in any situation. + +Pretty much every console device a sparc machine could see has a +bonafide real driver, making the PROM console hack unnecessary. + +If any new device shows up, we should write a driver instead of +depending upon this crutch to save us. We've been able to take care +of this even when no chip documentation exists (sunxvr500, sunxvr2500) +so there are no excuses. + +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/dontdiff | 1 + arch/sparc/kernel/setup_32.c | 2 + arch/sparc/kernel/setup_64.c | 2 + drivers/char/vt.c | 3 + drivers/video/console/.gitignore | 2 + drivers/video/console/Kconfig | 9 + drivers/video/console/Makefile | 12 + drivers/video/console/prom.uni | 11 + drivers/video/console/promcon.c | 598 --------------------------------------- + scripts/Makefile | 1 + 10 files changed, 1 insertion(+), 640 deletions(-) + +--- a/arch/sparc/kernel/setup_32.c ++++ b/arch/sparc/kernel/setup_32.c +@@ -263,8 +263,6 @@ void __init setup_arch(char **cmdline_p) + + #ifdef CONFIG_DUMMY_CONSOLE + conswitchp = &dummy_con; +-#elif defined(CONFIG_PROM_CONSOLE) +- conswitchp = &prom_con; + #endif + boot_flags_init(*cmdline_p); + +--- a/arch/sparc/kernel/setup_64.c ++++ b/arch/sparc/kernel/setup_64.c +@@ -295,8 +295,6 @@ void __init setup_arch(char **cmdline_p) + + #ifdef CONFIG_DUMMY_CONSOLE + conswitchp = &dummy_con; +-#elif defined(CONFIG_PROM_CONSOLE) +- conswitchp = &prom_con; + #endif + + idprom_init(); +--- a/Documentation/dontdiff ++++ b/Documentation/dontdiff +@@ -152,7 +152,6 @@ piggy.gz + piggyback + pnmtologo + ppc_defs.h* +-promcon_tbl.c + pss_boot.h + qconf + raid6altivec*.c +--- a/drivers/char/vt.c ++++ b/drivers/char/vt.c +@@ -2948,9 +2948,6 @@ int __init vty_init(const struct file_op + panic("Couldn't register console driver\n"); + kbd_init(); + console_map_init(); +-#ifdef CONFIG_PROM_CONSOLE +- prom_con_init(); +-#endif + #ifdef CONFIG_MDA_CONSOLE + mda_console_init(); + #endif +--- a/drivers/video/console/.gitignore ++++ /dev/null +@@ -1,2 +0,0 @@ +-# conmakehash generated file +-promcon_tbl.c +--- a/drivers/video/console/Kconfig ++++ b/drivers/video/console/Kconfig +@@ -67,16 +67,9 @@ config SGI_NEWPORT_CONSOLE + + # bool 'IODC console' CONFIG_IODC_CONSOLE + +-config PROM_CONSOLE +- bool "PROM console" +- depends on SPARC +- help +- Say Y to build a console driver for Sun machines that uses the +- terminal emulation built into their console PROMS. +- + config DUMMY_CONSOLE + bool +- depends on PROM_CONSOLE!=y || VGA_CONSOLE!=y || SGI_NEWPORT_CONSOLE!=y ++ depends on VGA_CONSOLE!=y || SGI_NEWPORT_CONSOLE!=y + default y + + config DUMMY_CONSOLE_COLUMNS +--- a/drivers/video/console/Makefile ++++ b/drivers/video/console/Makefile +@@ -22,7 +22,6 @@ font-objs += $(font-objs-y) + + obj-$(CONFIG_DUMMY_CONSOLE) += dummycon.o + obj-$(CONFIG_SGI_NEWPORT_CONSOLE) += newport_con.o font.o +-obj-$(CONFIG_PROM_CONSOLE) += promcon.o promcon_tbl.o + obj-$(CONFIG_STI_CONSOLE) += sticon.o sticore.o font.o + obj-$(CONFIG_VGA_CONSOLE) += vgacon.o + obj-$(CONFIG_MDA_CONSOLE) += mdacon.o +@@ -40,14 +39,3 @@ obj-$(CONFIG_FB_STI) += sti + ifeq ($(CONFIG_USB_SISUSBVGA_CON),y) + obj-$(CONFIG_USB_SISUSBVGA) += font.o + endif +- +-# Targets that kbuild needs to know about +-targets := promcon_tbl.c +- +-quiet_cmd_conmakehash = CNMKHSH $@ +- cmd_conmakehash = scripts/conmakehash $< | \ +- sed -e '/\#include <[^>]*>/p' -e 's/types/init/' \ +- -e 's/dfont\(_uni.*\]\)/promfont\1 /' > $@ +- +-$(obj)/promcon_tbl.c: $(src)/prom.uni +- $(call cmd,conmakehash) +--- a/drivers/video/console/promcon.c ++++ /dev/null +@@ -1,598 +0,0 @@ +-/* $Id: promcon.c,v 1.17 2000/07/26 23:02:52 davem Exp $ +- * Console driver utilizing PROM sun terminal emulation +- * +- * Copyright (C) 1998 Eddie C. Dost (ecd@skynet.be) +- * Copyright (C) 1998 Jakub Jelinek (jj@ultra.linux.cz) +- */ +- +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +- +-#include +-#include +- +-static short pw = 80 - 1, ph = 34 - 1; +-static short px, py; +-static unsigned long promcon_uni_pagedir[2]; +- +-extern u8 promfont_unicount[]; +-extern u16 promfont_unitable[]; +- +-#define PROMCON_COLOR 0 +- +-#if PROMCON_COLOR +-#define inverted(s) ((((s) & 0x7700) == 0x0700) ? 0 : 1) +-#else +-#define inverted(s) (((s) & 0x0800) ? 1 : 0) +-#endif +- +-static __inline__ void +-promcon_puts(char *buf, int cnt) +-{ +- prom_printf("%*.*s", cnt, cnt, buf); +-} +- +-static int +-promcon_start(struct vc_data *conp, char *b) +-{ +- unsigned short *s = (unsigned short *) +- (conp->vc_origin + py * conp->vc_size_row + (px << 1)); +- u16 cs; +- +- cs = scr_readw(s); +- if (px == pw) { +- unsigned short *t = s - 1; +- u16 ct = scr_readw(t); +- +- if (inverted(cs) && inverted(ct)) +- return sprintf(b, "\b\033[7m%c\b\033[@%c\033[m", cs, +- ct); +- else if (inverted(cs)) +- return sprintf(b, "\b\033[7m%c\033[m\b\033[@%c", cs, +- ct); +- else if (inverted(ct)) +- return sprintf(b, "\b%c\b\033[@\033[7m%c\033[m", cs, +- ct); +- else +- return sprintf(b, "\b%c\b\033[@%c", cs, ct); +- } +- +- if (inverted(cs)) +- return sprintf(b, "\033[7m%c\033[m\b", cs); +- else +- return sprintf(b, "%c\b", cs); +-} +- +-static int +-promcon_end(struct vc_data *conp, char *b) +-{ +- unsigned short *s = (unsigned short *) +- (conp->vc_origin + py * conp->vc_size_row + (px << 1)); +- char *p = b; +- u16 cs; +- +- b += sprintf(b, "\033[%d;%dH", py + 1, px + 1); +- +- cs = scr_readw(s); +- if (px == pw) { +- unsigned short *t = s - 1; +- u16 ct = scr_readw(t); +- +- if (inverted(cs) && inverted(ct)) +- b += sprintf(b, "\b%c\b\033[@\033[7m%c\033[m", cs, ct); +- else if (inverted(cs)) +- b += sprintf(b, "\b%c\b\033[@%c", cs, ct); +- else if (inverted(ct)) +- b += sprintf(b, "\b\033[7m%c\b\033[@%c\033[m", cs, ct); +- else +- b += sprintf(b, "\b\033[7m%c\033[m\b\033[@%c", cs, ct); +- return b - p; +- } +- +- if (inverted(cs)) +- b += sprintf(b, "%c\b", cs); +- else +- b += sprintf(b, "\033[7m%c\033[m\b", cs); +- return b - p; +-} +- +-const char *promcon_startup(void) +-{ +- const char *display_desc = "PROM"; +- int node; +- char buf[40]; +- +- node = prom_getchild(prom_root_node); +- node = prom_searchsiblings(node, "options"); +- if (prom_getproperty(node, "screen-#columns", buf, 40) != -1) { +- pw = simple_strtoul(buf, NULL, 0); +- if (pw < 10 || pw > 256) +- pw = 80; +- pw--; +- } +- if (prom_getproperty(node, "screen-#rows", buf, 40) != -1) { +- ph = simple_strtoul(buf, NULL, 0); +- if (ph < 10 || ph > 256) +- ph = 34; +- ph--; +- } +- promcon_puts("\033[H\033[J", 6); +- return display_desc; +-} +- +-static void +-promcon_init_unimap(struct vc_data *conp) +-{ +- mm_segment_t old_fs = get_fs(); +- struct unipair *p, *p1; +- u16 *q; +- int i, j, k; +- +- p = kmalloc(256*sizeof(struct unipair), GFP_KERNEL); +- if (!p) return; +- +- q = promfont_unitable; +- p1 = p; +- k = 0; +- for (i = 0; i < 256; i++) +- for (j = promfont_unicount[i]; j; j--) { +- p1->unicode = *q++; +- p1->fontpos = i; +- p1++; +- k++; +- } +- set_fs(KERNEL_DS); +- con_clear_unimap(conp, NULL); +- con_set_unimap(conp, k, p); +- con_protect_unimap(conp, 1); +- set_fs(old_fs); +- kfree(p); +-} +- +-static void +-promcon_init(struct vc_data *conp, int init) +-{ +- unsigned long p; +- +- conp->vc_can_do_color = PROMCON_COLOR; +- if (init) { +- conp->vc_cols = pw + 1; +- conp->vc_rows = ph + 1; +- } +- p = *conp->vc_uni_pagedir_loc; +- if (conp->vc_uni_pagedir_loc == &conp->vc_uni_pagedir || +- !--conp->vc_uni_pagedir_loc[1]) +- con_free_unimap(conp); +- conp->vc_uni_pagedir_loc = promcon_uni_pagedir; +- promcon_uni_pagedir[1]++; +- if (!promcon_uni_pagedir[0] && p) { +- promcon_init_unimap(conp); +- } +- if (!init) { +- if (conp->vc_cols != pw + 1 || conp->vc_rows != ph + 1) +- vc_resize(conp, pw + 1, ph + 1); +- } +-} +- +-static void +-promcon_deinit(struct vc_data *conp) +-{ +- /* When closing the last console, reset video origin */ +- if (!--promcon_uni_pagedir[1]) +- con_free_unimap(conp); +- conp->vc_uni_pagedir_loc = &conp->vc_uni_pagedir; +- con_set_default_unimap(conp); +-} +- +-static int +-promcon_switch(struct vc_data *conp) +-{ +- return 1; +-} +- +-static unsigned short * +-promcon_repaint_line(unsigned short *s, unsigned char *buf, unsigned char **bp) +-{ +- int cnt = pw + 1; +- int attr = -1; +- unsigned char *b = *bp; +- +- while (cnt--) { +- u16 c = scr_readw(s); +- if (attr != inverted(c)) { +- attr = inverted(c); +- if (attr) { +- strcpy (b, "\033[7m"); +- b += 4; +- } else { +- strcpy (b, "\033[m"); +- b += 3; +- } +- } +- *b++ = c; +- s++; +- if (b - buf >= 224) { +- promcon_puts(buf, b - buf); +- b = buf; +- } +- } +- *bp = b; +- return s; +-} +- +-static void +-promcon_putcs(struct vc_data *conp, const unsigned short *s, +- int count, int y, int x) +-{ +- unsigned char buf[256], *b = buf; +- unsigned short attr = scr_readw(s); +- unsigned char save; +- int i, last = 0; +- +- if (console_blanked) +- return; +- +- if (count <= 0) +- return; +- +- b += promcon_start(conp, b); +- +- if (x + count >= pw + 1) { +- if (count == 1) { +- x -= 1; +- save = scr_readw((unsigned short *)(conp->vc_origin +- + y * conp->vc_size_row +- + (x << 1))); +- +- if (px != x || py != y) { +- b += sprintf(b, "\033[%d;%dH", y + 1, x + 1); +- px = x; +- py = y; +- } +- +- if (inverted(attr)) +- b += sprintf(b, "\033[7m%c\033[m", scr_readw(s++)); +- else +- b += sprintf(b, "%c", scr_readw(s++)); +- +- strcpy(b, "\b\033[@"); +- b += 4; +- +- if (inverted(save)) +- b += sprintf(b, "\033[7m%c\033[m", save); +- else +- b += sprintf(b, "%c", save); +- +- px++; +- +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +- return; +- } else { +- last = 1; +- count = pw - x - 1; +- } +- } +- +- if (inverted(attr)) { +- strcpy(b, "\033[7m"); +- b += 4; +- } +- +- if (px != x || py != y) { +- b += sprintf(b, "\033[%d;%dH", y + 1, x + 1); +- px = x; +- py = y; +- } +- +- for (i = 0; i < count; i++) { +- if (b - buf >= 224) { +- promcon_puts(buf, b - buf); +- b = buf; +- } +- *b++ = scr_readw(s++); +- } +- +- px += count; +- +- if (last) { +- save = scr_readw(s++); +- b += sprintf(b, "%c\b\033[@%c", scr_readw(s++), save); +- px++; +- } +- +- if (inverted(attr)) { +- strcpy(b, "\033[m"); +- b += 3; +- } +- +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +-} +- +-static void +-promcon_putc(struct vc_data *conp, int c, int y, int x) +-{ +- unsigned short s; +- +- if (console_blanked) +- return; +- +- scr_writew(c, &s); +- promcon_putcs(conp, &s, 1, y, x); +-} +- +-static void +-promcon_clear(struct vc_data *conp, int sy, int sx, int height, int width) +-{ +- unsigned char buf[256], *b = buf; +- int i, j; +- +- if (console_blanked) +- return; +- +- b += promcon_start(conp, b); +- +- if (!sx && width == pw + 1) { +- +- if (!sy && height == ph + 1) { +- strcpy(b, "\033[H\033[J"); +- b += 6; +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +- return; +- } else if (sy + height == ph + 1) { +- b += sprintf(b, "\033[%dH\033[J", sy + 1); +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +- return; +- } +- +- b += sprintf(b, "\033[%dH", sy + 1); +- for (i = 1; i < height; i++) { +- strcpy(b, "\033[K\n"); +- b += 4; +- } +- +- strcpy(b, "\033[K"); +- b += 3; +- +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +- return; +- +- } else if (sx + width == pw + 1) { +- +- b += sprintf(b, "\033[%d;%dH", sy + 1, sx + 1); +- for (i = 1; i < height; i++) { +- strcpy(b, "\033[K\n"); +- b += 4; +- } +- +- strcpy(b, "\033[K"); +- b += 3; +- +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +- return; +- } +- +- for (i = sy + 1; i <= sy + height; i++) { +- b += sprintf(b, "\033[%d;%dH", i, sx + 1); +- for (j = 0; j < width; j++) +- *b++ = ' '; +- if (b - buf + width >= 224) { +- promcon_puts(buf, b - buf); +- b = buf; +- } +- } +- +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +-} +- +-static void +-promcon_bmove(struct vc_data *conp, int sy, int sx, int dy, int dx, +- int height, int width) +-{ +- char buf[256], *b = buf; +- +- if (console_blanked) +- return; +- +- b += promcon_start(conp, b); +- if (sy == dy && height == 1) { +- if (dx > sx && dx + width == conp->vc_cols) +- b += sprintf(b, "\033[%d;%dH\033[%d@\033[%d;%dH", +- sy + 1, sx + 1, dx - sx, py + 1, px + 1); +- else if (dx < sx && sx + width == conp->vc_cols) +- b += sprintf(b, "\033[%d;%dH\033[%dP\033[%d;%dH", +- dy + 1, dx + 1, sx - dx, py + 1, px + 1); +- +- b += promcon_end(conp, b); +- promcon_puts(buf, b - buf); +- return; +- } +- +- /* +- * FIXME: What to do here??? +- * Current console.c should not call it like that ever. +- */ +- prom_printf("\033[7mFIXME: bmove not handled\033[m\n"); +-} +- +-static void +-promcon_cursor(struct vc_data *conp, int mode) +-{ +- char buf[32], *b = buf; +- +- switch (mode) { +- case CM_ERASE: +- break; +- +- case CM_MOVE: +- case CM_DRAW: +- b += promcon_start(conp, b); +- if (px != conp->vc_x || py != conp->vc_y) { +- px = conp->vc_x; +- py = conp->vc_y; +- b += sprintf(b, "\033[%d;%dH", py + 1, px + 1); +- } +- promcon_puts(buf, b - buf); +- break; +- } +-} +- +-static int +-promcon_blank(struct vc_data *conp, int blank, int mode_switch) +-{ +- if (blank) { +- promcon_puts("\033[H\033[J\033[7m \033[m\b", 15); +- return 0; +- } else { +- /* Let console.c redraw */ +- return 1; +- } +-} +- +-static int +-promcon_scroll(struct vc_data *conp, int t, int b, int dir, int count) +-{ +- unsigned char buf[256], *p = buf; +- unsigned short *s; +- int i; +- +- if (console_blanked) +- return 0; +- +- p += promcon_start(conp, p); +- +- switch (dir) { +- case SM_UP: +- if (b == ph + 1) { +- p += sprintf(p, "\033[%dH\033[%dM", t + 1, count); +- px = 0; +- py = t; +- p += promcon_end(conp, p); +- promcon_puts(buf, p - buf); +- break; +- } +- +- s = (unsigned short *)(conp->vc_origin +- + (t + count) * conp->vc_size_row); +- +- p += sprintf(p, "\033[%dH", t + 1); +- +- for (i = t; i < b - count; i++) +- s = promcon_repaint_line(s, buf, &p); +- +- for (; i < b - 1; i++) { +- strcpy(p, "\033[K\n"); +- p += 4; +- if (p - buf >= 224) { +- promcon_puts(buf, p - buf); +- p = buf; +- } +- } +- +- strcpy(p, "\033[K"); +- p += 3; +- +- p += promcon_end(conp, p); +- promcon_puts(buf, p - buf); +- break; +- +- case SM_DOWN: +- if (b == ph + 1) { +- p += sprintf(p, "\033[%dH\033[%dL", t + 1, count); +- px = 0; +- py = t; +- p += promcon_end(conp, p); +- promcon_puts(buf, p - buf); +- break; +- } +- +- s = (unsigned short *)(conp->vc_origin + t * conp->vc_size_row); +- +- p += sprintf(p, "\033[%dH", t + 1); +- +- for (i = t; i < t + count; i++) { +- strcpy(p, "\033[K\n"); +- p += 4; +- if (p - buf >= 224) { +- promcon_puts(buf, p - buf); +- p = buf; +- } +- } +- +- for (; i < b; i++) +- s = promcon_repaint_line(s, buf, &p); +- +- p += promcon_end(conp, p); +- promcon_puts(buf, p - buf); +- break; +- } +- +- return 0; +-} +- +-#if !(PROMCON_COLOR) +-static u8 promcon_build_attr(struct vc_data *conp, u8 _color, u8 _intensity, +- u8 _blink, u8 _underline, u8 _reverse, u8 _italic) +-{ +- return (_reverse) ? 0xf : 0x7; +-} +-#endif +- +-/* +- * The console 'switch' structure for the VGA based console +- */ +- +-static int promcon_dummy(void) +-{ +- return 0; +-} +- +-#define DUMMY (void *) promcon_dummy +- +-const struct consw prom_con = { +- .owner = THIS_MODULE, +- .con_startup = promcon_startup, +- .con_init = promcon_init, +- .con_deinit = promcon_deinit, +- .con_clear = promcon_clear, +- .con_putc = promcon_putc, +- .con_putcs = promcon_putcs, +- .con_cursor = promcon_cursor, +- .con_scroll = promcon_scroll, +- .con_bmove = promcon_bmove, +- .con_switch = promcon_switch, +- .con_blank = promcon_blank, +- .con_set_palette = DUMMY, +- .con_scrolldelta = DUMMY, +-#if !(PROMCON_COLOR) +- .con_build_attr = promcon_build_attr, +-#endif +-}; +- +-void __init prom_con_init(void) +-{ +-#ifdef CONFIG_DUMMY_CONSOLE +- if (conswitchp == &dummy_con) +- take_over_console(&prom_con, 0, MAX_NR_CONSOLES-1, 1); +- else +-#endif +- if (conswitchp == &prom_con) +- promcon_init_unimap(vc_cons[fg_console].d); +-} +--- a/drivers/video/console/prom.uni ++++ /dev/null +@@ -1,11 +0,0 @@ +-# +-# Unicode mapping table for font in Sun PROM +-# +-# +-0x20-0x7e idem +-0xa0-0xff idem +-# +-0x7c U+2502 +-0x2d U+2500 +-0x2b U+250c U+2510 U+2514 U+2518 U+251c U+2524 U+252c U+2534 U+253c +-0xa4 U+fffd +--- a/scripts/Makefile ++++ b/scripts/Makefile +@@ -10,7 +10,6 @@ + hostprogs-$(CONFIG_KALLSYMS) += kallsyms + hostprogs-$(CONFIG_LOGO) += pnmtologo + hostprogs-$(CONFIG_VT) += conmakehash +-hostprogs-$(CONFIG_PROM_CONSOLE) += conmakehash + hostprogs-$(CONFIG_IKCONFIG) += bin2c + + always := $(hostprogs-y) $(hostprogs-m) diff --git a/queue-2.6.31/sparc64-set-irqf_disabled-on-ldc-channel-irqs.patch b/queue-2.6.31/sparc64-set-irqf_disabled-on-ldc-channel-irqs.patch new file mode 100644 index 00000000000..94469528806 --- /dev/null +++ b/queue-2.6.31/sparc64-set-irqf_disabled-on-ldc-channel-irqs.patch @@ -0,0 +1,38 @@ +From 750663bb2efbcb409eefa1c817b56f9ff7a06e6f Mon Sep 17 00:00:00 2001 +From: David S. Miller +Date: Tue, 13 Oct 2009 00:49:09 -0700 +Subject: sparc64: Set IRQF_DISABLED on LDC channel IRQs. + +From: David S. Miller + +[ Upstream commit c58543c869606532c2382f027d6466f4672ea756 ] + +With lots of virtual devices it's easy to generate a lot of +events and chew up the kernel IRQ stack. + +Reported-by: hyl +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + arch/sparc/kernel/ldc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/sparc/kernel/ldc.c ++++ b/arch/sparc/kernel/ldc.c +@@ -1242,13 +1242,13 @@ int ldc_bind(struct ldc_channel *lp, con + snprintf(lp->tx_irq_name, LDC_IRQ_NAME_MAX, "%s TX", name); + + err = request_irq(lp->cfg.rx_irq, ldc_rx, +- IRQF_SAMPLE_RANDOM | IRQF_SHARED, ++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED, + lp->rx_irq_name, lp); + if (err) + return err; + + err = request_irq(lp->cfg.tx_irq, ldc_tx, +- IRQF_SAMPLE_RANDOM | IRQF_SHARED, ++ IRQF_SAMPLE_RANDOM | IRQF_DISABLED | IRQF_SHARED, + lp->tx_irq_name, lp); + if (err) { + free_irq(lp->cfg.rx_irq, lp); diff --git a/queue-2.6.31/tty-mark-generic_serial-users-as-broken.patch b/queue-2.6.31/tty-mark-generic_serial-users-as-broken.patch new file mode 100644 index 00000000000..53534e97be3 --- /dev/null +++ b/queue-2.6.31/tty-mark-generic_serial-users-as-broken.patch @@ -0,0 +1,77 @@ +From 412145947adfca60a4b5b4893fbae82dffa25edd Mon Sep 17 00:00:00 2001 +From: Alan Cox +Date: Thu, 29 Oct 2009 12:16:22 +0000 +Subject: tty: Mark generic_serial users as BROKEN + +From: Alan Cox + +commit 412145947adfca60a4b5b4893fbae82dffa25edd upstream. + +There isn't much else I can do with these. I can find no hardware for any +of them and no users. The code is broken. + +Signed-off-by: Alan Cox +Signed-off-by: Greg Kroah-Hartman + +--- + arch/m68k/Kconfig | 6 +++--- + drivers/char/Kconfig | 6 +++--- + 2 files changed, 6 insertions(+), 6 deletions(-) + +--- a/arch/m68k/Kconfig ++++ b/arch/m68k/Kconfig +@@ -555,7 +555,7 @@ config HPAPCI + + config MVME147_SCC + bool "SCC support for MVME147 serial ports" +- depends on MVME147 ++ depends on MVME147 && BROKEN + help + This is the driver for the serial ports on the Motorola MVME147 + boards. Everyone using one of these boards should say Y here. +@@ -570,14 +570,14 @@ config SERIAL167 + + config MVME162_SCC + bool "SCC support for MVME162 serial ports" +- depends on MVME16x ++ depends on MVME16x && BROKEN + help + This is the driver for the serial ports on the Motorola MVME162 and + 172 boards. Everyone using one of these boards should say Y here. + + config BVME6000_SCC + bool "SCC support for BVME6000 serial ports" +- depends on BVME6000 ++ depends on BVME6000 && BROKEN + help + This is the driver for the serial ports on the BVME4000 and BVME6000 + boards from BVM Ltd. Everyone using one of these boards should say +--- a/drivers/char/Kconfig ++++ b/drivers/char/Kconfig +@@ -323,7 +323,7 @@ config SPECIALIX + + config SX + tristate "Specialix SX (and SI) card support" +- depends on SERIAL_NONSTANDARD && (PCI || EISA || ISA) ++ depends on SERIAL_NONSTANDARD && (PCI || EISA || ISA) && BROKEN + help + This is a driver for the SX and SI multiport serial cards. + Please read the file for details. +@@ -334,7 +334,7 @@ config SX + + config RIO + tristate "Specialix RIO system support" +- depends on SERIAL_NONSTANDARD ++ depends on SERIAL_NONSTANDARD && BROKEN + help + This is a driver for the Specialix RIO, a smart serial card which + drives an outboard box that can support up to 128 ports. Product +@@ -395,7 +395,7 @@ config NOZOMI + + config A2232 + tristate "Commodore A2232 serial support (EXPERIMENTAL)" +- depends on EXPERIMENTAL && ZORRO && BROKEN_ON_SMP ++ depends on EXPERIMENTAL && ZORRO && BROKEN + ---help--- + This option supports the 2232 7-port serial card shipped with the + Amiga 2000 and other Zorro-bus machines, dating from 1989. At diff --git a/queue-2.6.31/watchdog-fix-rio-watchdog-probe-function.patch b/queue-2.6.31/watchdog-fix-rio-watchdog-probe-function.patch new file mode 100644 index 00000000000..a17f07226f5 --- /dev/null +++ b/queue-2.6.31/watchdog-fix-rio-watchdog-probe-function.patch @@ -0,0 +1,36 @@ +From 366863a7ef5744ac7c4ab02e82c91cfd93782518 Mon Sep 17 00:00:00 2001 +From: Thomas Gleixner +Date: Wed, 14 Oct 2009 01:18:26 -0700 +Subject: watchdog: Fix rio watchdog probe function + +From: Thomas Gleixner + +[ Upstream commit 03717e3d12b625268848414e39beda25e4515692 ] + +After sucessfully registering the misc device the driver iounmaps the +hardware registers and kfree's the device data structure. Ouch ! + +This was introduced with commit e42311d75 (riowatchdog: Convert to +pure OF driver) and went unnoticed for more than a year :) + +Return success instead of dropping into the error cleanup code path. + +Signed-off-by: Thomas Gleixner +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/watchdog/riowd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/watchdog/riowd.c ++++ b/drivers/watchdog/riowd.c +@@ -206,7 +206,7 @@ static int __devinit riowd_probe(struct + + dev_set_drvdata(&op->dev, p); + riowd_device = p; +- err = 0; ++ return 0; + + out_iounmap: + of_iounmap(&op->resource[0], p->regs, 2);