--- /dev/null
+From cb26a24ee9706473f31d34cc259f4dcf45cd0644 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <error27@gmail.com>
+Date: Fri, 7 Jan 2011 16:41:54 -0300
+Subject: [media] [v3,media] av7110: check for negative array offset
+
+From: Dan Carpenter <error27@gmail.com>
+
+commit cb26a24ee9706473f31d34cc259f4dcf45cd0644 upstream.
+
+info->num comes from the user. It's type int. If the user passes
+in a negative value that would cause memory corruption.
+
+Signed-off-by: Dan Carpenter <error27@gmail.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/media/dvb/ttpci/av7110_ca.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/dvb/ttpci/av7110_ca.c
++++ b/drivers/media/dvb/ttpci/av7110_ca.c
+@@ -277,7 +277,7 @@ static int dvb_ca_ioctl(struct file *fil
+ {
+ ca_slot_info_t *info=(ca_slot_info_t *)parg;
+
+- if (info->num > 1)
++ if (info->num < 0 || info->num > 1)
+ return -EINVAL;
+ av7110->ci_slot[info->num].num = info->num;
+ av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?
--- /dev/null
+From 78d2978874e4e10e97dfd4fd79db45bdc0748550 Mon Sep 17 00:00:00 2001
+From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+Date: Fri, 4 Feb 2011 18:13:24 +0000
+Subject: CRED: Fix kernel panic upon security_file_alloc() failure.
+
+From: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
+
+commit 78d2978874e4e10e97dfd4fd79db45bdc0748550 upstream.
+
+In get_empty_filp() since 2.6.29, file_free(f) is called with f->f_cred == NULL
+when security_file_alloc() returned an error. As a result, kernel will panic()
+due to put_cred(NULL) call within RCU callback.
+
+Fix this bug by assigning f->f_cred before calling security_file_alloc().
+
+Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/file_table.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/file_table.c
++++ b/fs/file_table.c
+@@ -125,13 +125,13 @@ struct file *get_empty_filp(void)
+ goto fail;
+
+ percpu_counter_inc(&nr_files);
++ f->f_cred = get_cred(cred);
+ if (security_file_alloc(f))
+ goto fail_sec;
+
+ INIT_LIST_HEAD(&f->f_u.fu_list);
+ atomic_long_set(&f->f_count, 1);
+ rwlock_init(&f->f_owner.lock);
+- f->f_cred = get_cred(cred);
+ spin_lock_init(&f->f_lock);
+ eventpoll_init_file(f);
+ /* f->f_version: 0 */
--- /dev/null
+From 37f809755845cc3e18e8216c04525bdb885fa13b Mon Sep 17 00:00:00 2001
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+Date: Wed, 5 Jan 2011 14:45:24 -0800
+Subject: drm/i915: make DP training try a little harder
+
+From: Jesse Barnes <jbarnes@virtuousgeek.org>
+
+commit 37f809755845cc3e18e8216c04525bdb885fa13b upstream.
+
+When trying to do channel equalization, we need to make sure we still
+have clock recovery on all lanes while training. We also need to try
+clock recovery again if we lose the clock or if channel eq fails 5
+times. We'll try clock recovery up to 5 more times before giving up
+entirely.
+
+Gets suspend/resume working on my Vaio again and brings us back into
+compliance with the DP training sequence spec.
+
+Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
+Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/gpu/drm/i915/intel_dp.c | 27 +++++++++++++++++++++++----
+ 1 file changed, 23 insertions(+), 4 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_dp.c
++++ b/drivers/gpu/drm/i915/intel_dp.c
+@@ -1343,17 +1343,24 @@ intel_dp_complete_link_train(struct inte
+ struct drm_device *dev = intel_dp->base.base.dev;
+ struct drm_i915_private *dev_priv = dev->dev_private;
+ bool channel_eq = false;
+- int tries;
++ int tries, cr_tries;
+ u32 reg;
+ uint32_t DP = intel_dp->DP;
+
+ /* channel equalization */
+ tries = 0;
++ cr_tries = 0;
+ channel_eq = false;
+ for (;;) {
+ /* Use intel_dp->train_set[0] to set the voltage and pre emphasis values */
+ uint32_t signal_levels;
+
++ if (cr_tries > 5) {
++ DRM_ERROR("failed to train DP, aborting\n");
++ intel_dp_link_down(intel_dp);
++ break;
++ }
++
+ if (IS_GEN6(dev) && is_edp(intel_dp)) {
+ signal_levels = intel_gen6_edp_signal_levels(intel_dp->train_set[0]);
+ DP = (DP & ~EDP_LINK_TRAIN_VOL_EMP_MASK_SNB) | signal_levels;
+@@ -1376,14 +1383,26 @@ intel_dp_complete_link_train(struct inte
+ if (!intel_dp_get_link_status(intel_dp))
+ break;
+
++ /* Make sure clock is still ok */
++ if (!intel_clock_recovery_ok(intel_dp->link_status, intel_dp->lane_count)) {
++ intel_dp_start_link_train(intel_dp);
++ cr_tries++;
++ continue;
++ }
++
+ if (intel_channel_eq_ok(intel_dp)) {
+ channel_eq = true;
+ break;
+ }
+
+- /* Try 5 times */
+- if (tries > 5)
+- break;
++ /* Try 5 times, then try clock recovery if that fails */
++ if (tries > 5) {
++ intel_dp_link_down(intel_dp);
++ intel_dp_start_link_train(intel_dp);
++ tries = 0;
++ cr_tries++;
++ continue;
++ }
+
+ /* Compute new intel_dp->train_set as requested by target */
+ intel_get_adjust_train(intel_dp);
--- /dev/null
+From bc5ab083a68bfec212780281f8e57d871d8882a0 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@enac.fr>
+Date: Sat, 8 Jan 2011 12:15:41 +0100
+Subject: HID: add Add Cando touch screen 10.1-inch product id
+
+From: Benjamin Tissoires <benjamin.tissoires@enac.fr>
+
+commit bc5ab083a68bfec212780281f8e57d871d8882a0 upstream.
+
+This device has been reported to be an hid-cando one.
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/hid-cando.c | 2 ++
+ drivers/hid/hid-core.c | 1 +
+ drivers/hid/hid-ids.h | 1 +
+ 3 files changed, 4 insertions(+)
+
+--- a/drivers/hid/hid-cando.c
++++ b/drivers/hid/hid-cando.c
+@@ -236,6 +236,8 @@ static const struct hid_device_id cando_
+ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+ USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
++ USB_DEVICE_ID_CANDO_MULTI_TOUCH_10_1) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+ USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+ USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1287,6 +1287,7 @@ static const struct hid_device_id hid_bl
+ { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_10_1) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -135,6 +135,7 @@
+
+ #define USB_VENDOR_ID_CANDO 0x2087
+ #define USB_DEVICE_ID_CANDO_MULTI_TOUCH 0x0a01
++#define USB_DEVICE_ID_CANDO_MULTI_TOUCH_10_1 0x0a02
+ #define USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6 0x0b03
+ #define USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6 0x0f01
+
--- /dev/null
+From jkosina@suse.cz Wed Feb 16 13:29:47 2011
+From: Chase Douglas <chase.douglas@canonical.com>
+Date: Tue, 11 Jan 2011 19:37:50 +0100 (CET)
+Subject: HID: magicmouse: Don't report REL_{X, Y} for Magic Trackpad
+To: stable@kernel.org
+Cc: Chase Douglas <chase.douglas@canonical.com>
+Message-ID: <alpine.LNX.2.00.1101111936530.26685@pobox.suse.cz>
+
+
+From: Chase Douglas <chase.douglas@canonical.com>
+
+[ Linus' tree commit 6a66bbd693c12f71697c61207aa18bc5a12da0ab ]
+
+With the recent switch to having the hid layer handle standard axis
+initialization, the Magic Trackpad now reports relative axes. This would
+be fine in the normal mode, but the driver puts the device in multitouch
+mode where no relative events are generated. Also, userspace software
+depends on accurate axis information for device type detection. Thus,
+ignoring the relative axes from the Magic Trackpad is best.
+
+Signed-off-by: Chase Douglas <chase.douglas@canonical.com>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/hid-magicmouse.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/hid/hid-magicmouse.c
++++ b/drivers/hid/hid-magicmouse.c
+@@ -433,6 +433,11 @@ static int magicmouse_input_mapping(stru
+ if (!msc->input)
+ msc->input = hi->input;
+
++ /* Magic Trackpad does not give relative data after switching to MT */
++ if (hi->input->id.product == USB_DEVICE_ID_APPLE_MAGICTRACKPAD &&
++ field->flags & HID_MAIN_ITEM_RELATIVE)
++ return -1;
++
+ return 0;
+ }
+
--- /dev/null
+From c64f6f934c7490faff76faf96217066a1b3570a0 Mon Sep 17 00:00:00 2001
+From: Benjamin Tissoires <benjamin.tissoires@enac.fr>
+Date: Sat, 8 Jan 2011 12:15:42 +0100
+Subject: HID: Switch turbox/mosart touchscreen to hid-mosart
+
+From: Benjamin Tissoires <benjamin.tissoires@enac.fr>
+
+commit c64f6f934c7490faff76faf96217066a1b3570a0 upstream.
+
+This device used the MULTI_INPUT quirk whereas it could be used
+with hid-mosart instead to support the multitouch part.
+
+Reference: https://bugs.launchpad.net/ubuntu/+bug/620609/
+
+Signed-off-by: Benjamin Tissoires <benjamin.tissoires@enac.fr>
+Signed-off-by: Jiri Kosina <jkosina@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/hid/hid-core.c | 1 +
+ drivers/hid/hid-mosart.c | 1 +
+ drivers/hid/usbhid/hid-quirks.c | 1 -
+ 3 files changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -1391,6 +1391,7 @@ static const struct hid_device_id hid_bl
+ { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED, USB_DEVICE_ID_TOPSEED_CYBERLINK) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TOPSEED2, USB_DEVICE_ID_TOPSEED2_RF_COMBO) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_TWINHAN, USB_DEVICE_ID_TWINHAN_IR_REMOTE) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_PF1209) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP4030U) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_WP5540U) },
+--- a/drivers/hid/hid-mosart.c
++++ b/drivers/hid/hid-mosart.c
+@@ -240,6 +240,7 @@ static void mosart_remove(struct hid_dev
+ static const struct hid_device_id mosart_devices[] = {
+ { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_T91MT) },
+ { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUSTEK_MULTITOUCH_YFO) },
++ { HID_USB_DEVICE(USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(hid, mosart_devices);
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -35,7 +35,6 @@ static const struct hid_blacklist {
+ { USB_VENDOR_ID_CHIC, USB_DEVICE_ID_CHIC_GAMEPAD, HID_QUIRK_BADPAD },
+ { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER, HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET },
+ { USB_VENDOR_ID_MOJO, USB_DEVICE_ID_RETRO_ADAPTER, HID_QUIRK_MULTI_INPUT },
+- { USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART, HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
+ { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
--- /dev/null
+From 20c457b8587bee4644d998331d9e13be82e05b4c Mon Sep 17 00:00:00 2001
+From: Thomas Renninger <trenn@suse.de>
+Date: Mon, 3 Jan 2011 17:50:45 +0100
+Subject: perf timechart: Adjust perf timechart to the new power events
+
+From: Thomas Renninger <trenn@suse.de>
+
+commit 20c457b8587bee4644d998331d9e13be82e05b4c upstream.
+
+builtin-timechart must only pass -e power:xy events if they are supported by
+the running kernel, otherwise try to fetch the old power:power{start,end}
+events.
+
+For this I added the tiny helper function:
+
+ int is_valid_tracepoint(const char *event_string)
+
+to parse-events.[hc], which could be more generic as an interface and support
+hardware/software/... events, not only tracepoints, but someone else could
+extend that if needed...
+
+Signed-off-by: Thomas Renninger <trenn@suse.de>
+Acked-by: Arjan van de Ven <arjan@linux.intel.com>
+Acked-by: Jean Pihet <j-pihet@ti.com>
+LKML-Reference: <1294073445-14812-4-git-send-email-trenn@suse.de>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ tools/perf/builtin-timechart.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/tools/perf/builtin-timechart.c
++++ b/tools/perf/builtin-timechart.c
+@@ -502,7 +502,7 @@ static int process_sample_event(event_t
+ c_state_start(pe->cpu_id, data.time, pe->value);
+
+ if (strcmp(event_str, "power:power_end") == 0)
+- c_state_end(pe->cpu_id, data.time);
++ c_state_end(data.cpu, data.time);
+
+ if (strcmp(event_str, "power:power_frequency") == 0)
+ p_state_change(pe->cpu_id, data.time, pe->value);
drm-nouveau-only-select-acpi_video-if-its-dependencies-are-met.patch
vt-fix-issue-when-fbcon-wants-to-takeover-a-second-time.patch
arm-6606-1-sa1100-fix-platform-device-registration.patch
+hid-magicmouse-don-t-report-rel_-x-y-for-magic-trackpad.patch
+perf-timechart-adjust-perf-timechart-to-the-new-power-events.patch
+x86-clear-irqstack-thread_info.patch
+drm-i915-make-dp-training-try-a-little-harder.patch
+xen-p2m-correctly-initialize-partial-p2m-leaf.patch
+xen-p2m-mark-invalid_p2m_entry-the-mfn_list-past-max_pfn.patch
+av7110-check-for-negative-array-offset.patch
+xfs-fix-dquot-shaker-deadlock.patch
+hid-add-add-cando-touch-screen-10.1-inch-product-id.patch
+hid-switch-turbox-mosart-touchscreen-to-hid-mosart.patch
+cred-fix-kernel-panic-upon-security_file_alloc-failure.patch
--- /dev/null
+From 7b698ea377e10b074ceef0d79218e6622d618421 Mon Sep 17 00:00:00 2001
+From: Brian Gerst <brgerst@gmail.com>
+Date: Mon, 17 Jan 2011 07:32:10 -0500
+Subject: x86: Clear irqstack thread_info
+
+From: Brian Gerst <brgerst@gmail.com>
+
+commit 7b698ea377e10b074ceef0d79218e6622d618421 upstream.
+
+Mathias Merz reported that v2.6.37 failed to boot on his
+system.
+
+Make sure that the thread_info part of the irqstack is
+initialized to zeroes.
+
+Reported-and-Tested-by: Matthias Merz <linux@merz-ka.de>
+Signed-off-by: Brian Gerst <brgerst@gmail.com>
+Acked-by: Pekka Enberg <penberg@kernel.org>
+Cc: Arjan van de Ven <arjan@linux.intel.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+LKML-Reference: <AANLkTimyKXfJ1x8tgwrr1hYnNLrPfgE1NTe4z7L6tUDm@mail.gmail.com>
+Signed-off-by: Ingo Molnar <mingo@elte.hu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/kernel/irq_32.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/arch/x86/kernel/irq_32.c
++++ b/arch/x86/kernel/irq_32.c
+@@ -129,8 +129,7 @@ void __cpuinit irq_ctx_init(int cpu)
+ irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
+ THREAD_FLAGS,
+ THREAD_ORDER));
+- irqctx->tinfo.task = NULL;
+- irqctx->tinfo.exec_domain = NULL;
++ memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
+ irqctx->tinfo.cpu = cpu;
+ irqctx->tinfo.preempt_count = HARDIRQ_OFFSET;
+ irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
+@@ -140,10 +139,8 @@ void __cpuinit irq_ctx_init(int cpu)
+ irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
+ THREAD_FLAGS,
+ THREAD_ORDER));
+- irqctx->tinfo.task = NULL;
+- irqctx->tinfo.exec_domain = NULL;
++ memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
+ irqctx->tinfo.cpu = cpu;
+- irqctx->tinfo.preempt_count = 0;
+ irqctx->tinfo.addr_limit = MAKE_MM_SEG(0);
+
+ per_cpu(softirq_ctx, cpu) = irqctx;
--- /dev/null
+From 8e1b4cf2108488ccfb9a3e7ed7cd85a435e01d4b Mon Sep 17 00:00:00 2001
+From: Stefan Bader <stefan.bader@canonical.com>
+Date: Thu, 20 Jan 2011 15:38:23 +0100
+Subject: xen: p2m: correctly initialize partial p2m leaf
+
+From: Stefan Bader <stefan.bader@canonical.com>
+
+commit 8e1b4cf2108488ccfb9a3e7ed7cd85a435e01d4b upstream.
+
+After changing the p2m mapping to a tree by
+
+ commit 58e05027b530ff081ecea68e38de8d59db8f87e0
+ xen: convert p2m to a 3 level tree
+
+and trying to boot a DomU with 615MB of memory, the following crash was
+observed in the dump:
+
+kernel direct mapping tables up to 26f00000 @ 1ec4000-1fff000
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<c0107397>] xen_set_pte+0x27/0x60
+*pdpt = 0000000000000000 *pde = 0000000000000000
+
+Adding further debug statements showed that when trying to set up
+pfn=0x26700 the returned mapping was invalid.
+
+pfn=0x266ff calling set_pte(0xc1fe77f8, 0x6b3003)
+pfn=0x26700 calling set_pte(0xc1fe7800, 0x3)
+
+Although the last_pfn obtained from the startup info is 0x26700, which
+should in turn not be hit, the additional 8MB which are added as extra
+memory normally seem to be ok. This lead to looking into the initial
+p2m tree construction, which uses the smaller value and assuming that
+there is other code handling the extra memory.
+
+When the p2m tree is set up, the leaves are directly pointed to the
+array which the domain builder set up. But if the mapping is not on a
+boundary that fits into one p2m page, this will result in the last leaf
+being only partially valid. And as the invalid entries are not
+initialized in that case, things go badly wrong.
+
+I am trying to fix that by checking whether the current leaf is a
+complete map and if not, allocate a completely new page and copy only
+the valid pointers there. This may not be the most efficient or elegant
+solution, but at least it seems to allow me booting DomUs with memory
+assignments all over the range.
+
+BugLink: http://bugs.launchpad.net/bugs/686692
+[v2: Redid a bit of commit wording and fixed a compile warning]
+
+Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/mmu.c | 20 +++++++++++++++++++-
+ 1 file changed, 19 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -395,7 +395,25 @@ void __init xen_build_dynamic_phys_to_ma
+ p2m_top[topidx] = mid;
+ }
+
+- p2m_top[topidx][mididx] = &mfn_list[pfn];
++ /*
++ * As long as the mfn_list has enough entries to completely
++ * fill a p2m page, pointing into the array is ok. But if
++ * not the entries beyond the last pfn will be undefined.
++ * And guessing that the 'what-ever-there-is' does not take it
++ * too kindly when changing it to invalid markers, a new page
++ * is allocated, initialized and filled with the valid part.
++ */
++ if (unlikely(pfn + P2M_PER_PAGE > max_pfn)) {
++ unsigned long p2midx;
++ unsigned long *p2m = extend_brk(PAGE_SIZE, PAGE_SIZE);
++ p2m_init(p2m);
++
++ for (p2midx = 0; pfn + p2midx < max_pfn; p2midx++) {
++ p2m[p2midx] = mfn_list[pfn + p2midx];
++ }
++ p2m_top[topidx][mididx] = p2m;
++ } else
++ p2m_top[topidx][mididx] = &mfn_list[pfn];
+ }
+ }
+
--- /dev/null
+From cf04d120d9413de581437cf9a29f138ec1178f65 Mon Sep 17 00:00:00 2001
+From: Stefan Bader <stefan.bader@canonical.com>
+Date: Thu, 27 Jan 2011 10:03:14 -0500
+Subject: xen/p2m: Mark INVALID_P2M_ENTRY the mfn_list past max_pfn.
+
+From: Stefan Bader <stefan.bader@canonical.com>
+
+commit cf04d120d9413de581437cf9a29f138ec1178f65 upstream.
+
+In case the mfn_list does not have enough entries to fill
+a p2m page we do not want the entries from max_pfn up to
+the boundary to be filled with unknown values. Hence
+set them to INVALID_P2M_ENTRY.
+
+Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/x86/xen/mmu.c | 16 +++++-----------
+ 1 file changed, 5 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/xen/mmu.c
++++ b/arch/x86/xen/mmu.c
+@@ -399,21 +399,15 @@ void __init xen_build_dynamic_phys_to_ma
+ * As long as the mfn_list has enough entries to completely
+ * fill a p2m page, pointing into the array is ok. But if
+ * not the entries beyond the last pfn will be undefined.
+- * And guessing that the 'what-ever-there-is' does not take it
+- * too kindly when changing it to invalid markers, a new page
+- * is allocated, initialized and filled with the valid part.
+ */
+ if (unlikely(pfn + P2M_PER_PAGE > max_pfn)) {
+ unsigned long p2midx;
+- unsigned long *p2m = extend_brk(PAGE_SIZE, PAGE_SIZE);
+- p2m_init(p2m);
+
+- for (p2midx = 0; pfn + p2midx < max_pfn; p2midx++) {
+- p2m[p2midx] = mfn_list[pfn + p2midx];
+- }
+- p2m_top[topidx][mididx] = p2m;
+- } else
+- p2m_top[topidx][mididx] = &mfn_list[pfn];
++ p2midx = max_pfn % P2M_PER_PAGE;
++ for ( ; p2midx < P2M_PER_PAGE; p2midx++)
++ mfn_list[pfn + p2midx] = INVALID_P2M_ENTRY;
++ }
++ p2m_top[topidx][mididx] = &mfn_list[pfn];
+ }
+ }
+
--- /dev/null
+From 0fbca4d1c3932c27c4794bf5c2b5fc961cf5a54f Mon Sep 17 00:00:00 2001
+From: Dave Chinner <dchinner@redhat.com>
+Date: Fri, 28 Jan 2011 11:20:46 +1100
+Subject: xfs: fix dquot shaker deadlock
+
+From: Dave Chinner <dchinner@redhat.com>
+
+commit 0fbca4d1c3932c27c4794bf5c2b5fc961cf5a54f upstream.
+
+Commit 368e136 ("xfs: remove duplicate code from dquot reclaim") fails
+to unlock the dquot freelist when the number of loop restarts is
+exceeded in xfs_qm_dqreclaim_one(). This causes hangs in memory
+reclaim.
+
+Rework the loop control logic into an unwind stack that all the
+different cases jump into. This means there is only one set of code
+that processes the loop exit criteria, and simplifies the unlocking
+of all the items from different points in the loop. It also fixes a
+double increment of the restart counter from the qi_dqlist_lock
+case.
+
+Reported-by: Malcolm Scott <lkml@malc.org.uk>
+Signed-off-by: Dave Chinner <dchinner@redhat.com>
+Reviewed-by: Alex Elder <aelder@sgi.com>
+Cc: Arkadiusz Miskiewicz <a.miskiewicz@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ fs/xfs/quota/xfs_qm.c | 46 +++++++++++++++++++++-------------------------
+ 1 file changed, 21 insertions(+), 25 deletions(-)
+
+--- a/fs/xfs/quota/xfs_qm.c
++++ b/fs/xfs/quota/xfs_qm.c
+@@ -1863,12 +1863,14 @@ xfs_qm_dqreclaim_one(void)
+ xfs_dquot_t *dqpout;
+ xfs_dquot_t *dqp;
+ int restarts;
++ int startagain;
+
+ restarts = 0;
+ dqpout = NULL;
+
+ /* lockorder: hashchainlock, freelistlock, mplistlock, dqlock, dqflock */
+-startagain:
++again:
++ startagain = 0;
+ mutex_lock(&xfs_Gqm->qm_dqfrlist_lock);
+
+ list_for_each_entry(dqp, &xfs_Gqm->qm_dqfrlist, q_freelist) {
+@@ -1885,13 +1887,10 @@ startagain:
+ ASSERT(! (dqp->dq_flags & XFS_DQ_INACTIVE));
+
+ trace_xfs_dqreclaim_want(dqp);
+-
+- xfs_dqunlock(dqp);
+- mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
+- if (++restarts >= XFS_QM_RECLAIM_MAX_RESTARTS)
+- return NULL;
+ XQM_STATS_INC(xqmstats.xs_qm_dqwants);
+- goto startagain;
++ restarts++;
++ startagain = 1;
++ goto dqunlock;
+ }
+
+ /*
+@@ -1906,23 +1905,20 @@ startagain:
+ ASSERT(list_empty(&dqp->q_mplist));
+ list_del_init(&dqp->q_freelist);
+ xfs_Gqm->qm_dqfrlist_cnt--;
+- xfs_dqunlock(dqp);
+ dqpout = dqp;
+ XQM_STATS_INC(xqmstats.xs_qm_dqinact_reclaims);
+- break;
++ goto dqunlock;
+ }
+
+ ASSERT(dqp->q_hash);
+ ASSERT(!list_empty(&dqp->q_mplist));
+
+ /*
+- * Try to grab the flush lock. If this dquot is in the process of
+- * getting flushed to disk, we don't want to reclaim it.
++ * Try to grab the flush lock. If this dquot is in the process
++ * of getting flushed to disk, we don't want to reclaim it.
+ */
+- if (!xfs_dqflock_nowait(dqp)) {
+- xfs_dqunlock(dqp);
+- continue;
+- }
++ if (!xfs_dqflock_nowait(dqp))
++ goto dqunlock;
+
+ /*
+ * We have the flush lock so we know that this is not in the
+@@ -1944,8 +1940,7 @@ startagain:
+ xfs_fs_cmn_err(CE_WARN, mp,
+ "xfs_qm_dqreclaim: dquot %p flush failed", dqp);
+ }
+- xfs_dqunlock(dqp); /* dqflush unlocks dqflock */
+- continue;
++ goto dqunlock;
+ }
+
+ /*
+@@ -1967,13 +1962,8 @@ startagain:
+ */
+ if (!mutex_trylock(&mp->m_quotainfo->qi_dqlist_lock)) {
+ restarts++;
+- mutex_unlock(&dqp->q_hash->qh_lock);
+- xfs_dqfunlock(dqp);
+- xfs_dqunlock(dqp);
+- mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
+- if (restarts++ >= XFS_QM_RECLAIM_MAX_RESTARTS)
+- return NULL;
+- goto startagain;
++ startagain = 1;
++ goto qhunlock;
+ }
+
+ ASSERT(dqp->q_nrefs == 0);
+@@ -1986,14 +1976,20 @@ startagain:
+ xfs_Gqm->qm_dqfrlist_cnt--;
+ dqpout = dqp;
+ mutex_unlock(&mp->m_quotainfo->qi_dqlist_lock);
++qhunlock:
+ mutex_unlock(&dqp->q_hash->qh_lock);
+ dqfunlock:
+ xfs_dqfunlock(dqp);
++dqunlock:
+ xfs_dqunlock(dqp);
+ if (dqpout)
+ break;
+ if (restarts >= XFS_QM_RECLAIM_MAX_RESTARTS)
+- return NULL;
++ break;
++ if (startagain) {
++ mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
++ goto again;
++ }
+ }
+ mutex_unlock(&xfs_Gqm->qm_dqfrlist_lock);
+ return dqpout;
projects / thirdparty / kernel / stable-queue.git / commitdiff
