Merge branch 'linux-2.6'

5 files changed, 67 insertions, 24 deletions

diff --git a/drivers/char/agp/agp.h b/drivers/char/agp/agp.h
index 35ab1a9f8e8b..8955e7ff759a 100644
--- a/drivers/char/agp/agp.h
+++ b/drivers/char/agp/agp.h
@@ -176,7 +176,7 @@ struct agp_bridge_data {
 #define I830_GMCH_MEM_MASK              0x1
 #define I830_GMCH_MEM_64M               0x1
 #define I830_GMCH_MEM_128M              0
-#define I830_GMCH_GMS_MASK              0xF0
+#define I830_GMCH_GMS_MASK              0x70
 #define I830_GMCH_GMS_DISABLED          0x00
 #define I830_GMCH_GMS_LOCAL             0x10
 #define I830_GMCH_GMS_STOLEN_512        0x20
@@ -190,6 +190,7 @@ struct agp_bridge_data {
 #define INTEL_I830_ERRSTS       0x92
 
 /* Intel 855GM/852GM registers */
+#define I855_GMCH_GMS_MASK              0xF0
 #define I855_GMCH_GMS_STOLEN_0M         0x0
 #define I855_GMCH_GMS_STOLEN_1M         (0x1 << 4)
 #define I855_GMCH_GMS_STOLEN_4M         (0x2 << 4)
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index 7c69bf259caa..a5d0e95a227a 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -511,7 +511,7 @@ static void intel_i830_init_gtt_entries(void)
                  */
                 if (IS_G33)
                         size = 0;
-                switch (gmch_ctrl & I830_GMCH_GMS_MASK) {
+                switch (gmch_ctrl & I855_GMCH_GMS_MASK) {
                 case I855_GMCH_GMS_STOLEN_1M:
                         gtt_entries = MB(1) - KB(size);
                         break;
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index f2e5cb1bedf3..1dd3a065f57b 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2215,7 +2215,8 @@ static int ipmi_pci_resume(struct pci_dev *pdev)
 
 static struct pci_device_id ipmi_pci_devices[] = {
         { PCI_DEVICE(PCI_HP_VENDOR_ID, PCI_MMC_DEVICE_ID) },
-        { PCI_DEVICE_CLASS(PCI_ERMC_CLASSCODE, PCI_ERMC_CLASSCODE_MASK) }
+        { PCI_DEVICE_CLASS(PCI_ERMC_CLASSCODE, PCI_ERMC_CLASSCODE_MASK) },
+        { 0, }
 };
 MODULE_DEVICE_TABLE(pci, ipmi_pci_devices);
 
diff --git a/drivers/char/mspec.c b/drivers/char/mspec.c
index c08a4152ee8f..049a46cc9f87 100644
--- a/drivers/char/mspec.c
+++ b/drivers/char/mspec.c
@@ -67,7 +67,7 @@
 /*
  * Page types allocated by the device.
  */
-enum {
+enum mspec_page_type {
         MSPEC_FETCHOP = 1,
         MSPEC_CACHED,
         MSPEC_UNCACHED
@@ -83,15 +83,25 @@ static int is_sn2;
  * One of these structures is allocated when an mspec region is mmaped. The
  * structure is pointed to by the vma->vm_private_data field in the vma struct.
  * This structure is used to record the addresses of the mspec pages.
+ * This structure is shared by all vma's that are split off from the
+ * original vma when split_vma()'s are done.
+ *
+ * The refcnt is incremented atomically because mm->mmap_sem does not
+ * protect in fork case where multiple tasks share the vma_data.
  */
 struct vma_data {
         atomic_t refcnt;        /* Number of vmas sharing the data. */
-        spinlock_t lock;        /* Serialize access to the vma. */
+        spinlock_t lock;        /* Serialize access to this structure. */
         int count;              /* Number of pages allocated. */
-        int type;               /* Type of pages allocated. */
+        enum mspec_page_type type; /* Type of pages allocated. */
+        int flags;              /* See VMD_xxx below. */
+        unsigned long vm_start; /* Original (unsplit) base. */
+        unsigned long vm_end;   /* Original (unsplit) end. */
         unsigned long maddr[0]; /* Array of MSPEC addresses. */
 };
 
+#define VMD_VMALLOCED 0x1       /* vmalloc'd rather than kmalloc'd */
+
 /* used on shub2 to clear FOP cache in the HUB */
 static unsigned long scratch_page[MAX_NUMNODES];
 #define SH2_AMO_CACHE_ENTRIES   4
@@ -129,8 +139,8 @@ mspec_zero_block(unsigned long addr, int len)
  * mspec_open
  *
  * Called when a device mapping is created by a means other than mmap
- * (via fork, etc.).  Increments the reference count on the underlying
- * mspec data so it is not freed prematurely.
+ * (via fork, munmap, etc.).  Increments the reference count on the
+ * underlying mspec data so it is not freed prematurely.
  */
 static void
 mspec_open(struct vm_area_struct *vma)
@@ -151,34 +161,44 @@ static void
 mspec_close(struct vm_area_struct *vma)
 {
         struct vma_data *vdata;
-        int i, pages, result, vdata_size;
+        int index, last_index, result;
+        unsigned long my_page;
 
         vdata = vma->vm_private_data;
-        if (!atomic_dec_and_test(&vdata->refcnt))
-                return;
 
-        pages = (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
-        vdata_size = sizeof(struct vma_data) + pages * sizeof(long);
-        for (i = 0; i < pages; i++) {
-                if (vdata->maddr[i] == 0)
+        BUG_ON(vma->vm_start < vdata->vm_start || vma->vm_end > vdata->vm_end);
+
+        spin_lock(&vdata->lock);
+        index = (vma->vm_start - vdata->vm_start) >> PAGE_SHIFT;
+        last_index = (vma->vm_end - vdata->vm_start) >> PAGE_SHIFT;
+        for (; index < last_index; index++) {
+                if (vdata->maddr[index] == 0)
                         continue;
                 /*
                  * Clear the page before sticking it back
                  * into the pool.
                  */
-                result = mspec_zero_block(vdata->maddr[i], PAGE_SIZE);
+                my_page = vdata->maddr[index];
+                vdata->maddr[index] = 0;
+                spin_unlock(&vdata->lock);
+                result = mspec_zero_block(my_page, PAGE_SIZE);
                 if (!result)
-                        uncached_free_page(vdata->maddr[i]);
+                        uncached_free_page(my_page);
                 else
                         printk(KERN_WARNING "mspec_close(): "
                                "failed to zero page %i\n",
                                result);
+                spin_lock(&vdata->lock);
         }
+        spin_unlock(&vdata->lock);
 
-        if (vdata_size <= PAGE_SIZE)
-                kfree(vdata);
-        else
+        if (!atomic_dec_and_test(&vdata->refcnt))
+                return;
+
+        if (vdata->flags & VMD_VMALLOCED)
                 vfree(vdata);
+        else
+                kfree(vdata);
 }
 
 
@@ -195,7 +215,8 @@ mspec_nopfn(struct vm_area_struct *vma, unsigned long address)
         int index;
         struct vma_data *vdata = vma->vm_private_data;
 
-        index = (address - vma->vm_start) >> PAGE_SHIFT;
+        BUG_ON(address < vdata->vm_start || address >= vdata->vm_end);
+        index = (address - vdata->vm_start) >> PAGE_SHIFT;
         maddr = (volatile unsigned long) vdata->maddr[index];
         if (maddr == 0) {
                 maddr = uncached_alloc_page(numa_node_id());
@@ -237,10 +258,11 @@ static struct vm_operations_struct mspec_vm_ops = {
  * underlying pages.
  */
 static int
-mspec_mmap(struct file *file, struct vm_area_struct *vma, int type)
+mspec_mmap(struct file *file, struct vm_area_struct *vma,
+                                        enum mspec_page_type type)
 {
         struct vma_data *vdata;
-        int pages, vdata_size;
+        int pages, vdata_size, flags = 0;
 
         if (vma->vm_pgoff != 0)
                 return -EINVAL;
@@ -255,12 +277,17 @@ mspec_mmap(struct file *file, struct vm_area_struct *vma, int type)
         vdata_size = sizeof(struct vma_data) + pages * sizeof(long);
         if (vdata_size <= PAGE_SIZE)
                 vdata = kmalloc(vdata_size, GFP_KERNEL);
-        else
+        else {
                 vdata = vmalloc(vdata_size);
+                flags = VMD_VMALLOCED;
+        }
         if (!vdata)
                 return -ENOMEM;
         memset(vdata, 0, vdata_size);
 
+        vdata->vm_start = vma->vm_start;
+        vdata->vm_end = vma->vm_end;
+        vdata->flags = flags;
         vdata->type = type;
         spin_lock_init(&vdata->lock);
         vdata->refcnt = ATOMIC_INIT(1);
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index 4a8969cef315..3ee73cf64bd2 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -795,6 +795,19 @@ int n_tty_ioctl(struct tty_struct * tty, struct file * file,
                         if (L_ICANON(tty))
                                 retval = inq_canon(tty);
                         return put_user(retval, (unsigned int __user *) arg);
+#ifndef TCGETS2
+                case TIOCGLCKTRMIOS:
+                        if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios_locked))
+                                return -EFAULT;
+                        return 0;
+
+                case TIOCSLCKTRMIOS:
+                        if (!capable(CAP_SYS_ADMIN))
+                                return -EPERM;
+                        if (user_termios_to_kernel_termios(real_tty->termios_locked, (struct termios __user *) arg))
+                                return -EFAULT;
+                        return 0;
+#else
                 case TIOCGLCKTRMIOS:
                         if (kernel_termios_to_user_termios_1((struct termios __user *)arg, real_tty->termios_locked))
                                 return -EFAULT;
@@ -806,6 +819,7 @@ int n_tty_ioctl(struct tty_struct * tty, struct file * file,
                         if (user_termios_to_kernel_termios_1(real_tty->termios_locked, (struct termios __user *) arg))
                                 return -EFAULT;
                         return 0;
+#endif
 
                 case TIOCPKT:
                 {