Merge commit 'v2.6.35-rc3' into for-linus

6 files changed, 60 insertions, 16 deletions

diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index f09fc0e2062d..7cfcc629a7fd 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -1123,6 +1123,7 @@ source "drivers/s390/char/Kconfig"
 
 config RAMOOPS
         tristate "Log panic/oops to a RAM buffer"
+        depends on HAS_IOMEM
         default n
         help
           This enables panic and oops messages to be logged to a circular
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index e8ea6825822c..9344216183a4 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -1059,7 +1059,7 @@ static void intel_i9xx_setup_flush(void)
         }
 }
 
-static int intel_i915_configure(void)
+static int intel_i9xx_configure(void)
 {
         struct aper_size_info_fixed *current_size;
         u32 temp;
@@ -1207,6 +1207,38 @@ static int intel_i9xx_fetch_size(void)
         return 0;
 }
 
+static int intel_i915_get_gtt_size(void)
+{
+        int size;
+
+        if (IS_G33) {
+                u16 gmch_ctrl;
+
+                /* G33's GTT size defined in gmch_ctrl */
+                pci_read_config_word(agp_bridge->dev, I830_GMCH_CTRL, &gmch_ctrl);
+                switch (gmch_ctrl & G33_PGETBL_SIZE_MASK) {
+                case G33_PGETBL_SIZE_1M:
+                        size = 1024;
+                        break;
+                case G33_PGETBL_SIZE_2M:
+                        size = 2048;
+                        break;
+                default:
+                        dev_info(&agp_bridge->dev->dev,
+                                 "unknown page table size 0x%x, assuming 512KB\n",
+                                (gmch_ctrl & G33_PGETBL_SIZE_MASK));
+                        size = 512;
+                }
+        } else {
+                /* On previous hardware, the GTT size was just what was
+                 * required to map the aperture.
+                 */
+                size = agp_bridge->driver->fetch_size();
+        }
+
+        return KB(size);
+}
+
 /* The intel i915 automatically initializes the agp aperture during POST.
  * Use the memory already set aside for in the GTT.
  */
@@ -1216,7 +1248,7 @@ static int intel_i915_create_gatt_table(struct agp_bridge_data *bridge)
         struct aper_size_info_fixed *size;
         int num_entries;
         u32 temp, temp2;
-        int gtt_map_size = 256 * 1024;
+        int gtt_map_size;
 
         size = agp_bridge->current_size;
         page_order = size->page_order;
@@ -1226,8 +1258,8 @@ static int intel_i915_create_gatt_table(struct agp_bridge_data *bridge)
         pci_read_config_dword(intel_private.pcidev, I915_MMADDR, &temp);
         pci_read_config_dword(intel_private.pcidev, I915_PTEADDR, &temp2);
 
-        if (IS_G33)
-            gtt_map_size = 1024 * 1024; /* 1M on G33 */
+        gtt_map_size = intel_i915_get_gtt_size();
+
         intel_private.gtt = ioremap(temp2, gtt_map_size);
         if (!intel_private.gtt)
                 return -ENOMEM;
@@ -1422,7 +1454,7 @@ static const struct agp_bridge_driver intel_915_driver = {
         .size_type              = FIXED_APER_SIZE,
         .num_aperture_sizes     = 4,
         .needs_scratch_page     = true,
-        .configure              = intel_i915_configure,
+        .configure              = intel_i9xx_configure,
         .fetch_size             = intel_i9xx_fetch_size,
         .cleanup                = intel_i915_cleanup,
         .mask_memory            = intel_i810_mask_memory,
@@ -1455,7 +1487,7 @@ static const struct agp_bridge_driver intel_i965_driver = {
         .size_type              = FIXED_APER_SIZE,
         .num_aperture_sizes     = 4,
         .needs_scratch_page     = true,
-        .configure              = intel_i915_configure,
+        .configure              = intel_i9xx_configure,
         .fetch_size             = intel_i9xx_fetch_size,
         .cleanup                = intel_i915_cleanup,
         .mask_memory            = intel_i965_mask_memory,
@@ -1488,7 +1520,7 @@ static const struct agp_bridge_driver intel_g33_driver = {
         .size_type              = FIXED_APER_SIZE,
         .num_aperture_sizes     = 4,
         .needs_scratch_page     = true,
-        .configure              = intel_i915_configure,
+        .configure              = intel_i9xx_configure,
         .fetch_size             = intel_i9xx_fetch_size,
         .cleanup                = intel_i915_cleanup,
         .mask_memory            = intel_i965_mask_memory,
diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c
index 95db71360d24..f845a8f718b3 100644
--- a/drivers/char/agp/uninorth-agp.c
+++ b/drivers/char/agp/uninorth-agp.c
@@ -415,7 +415,7 @@ static int uninorth_create_gatt_table(struct agp_bridge_data *bridge)
         bridge->gatt_table_real = (u32 *) table;
         /* Need to clear out any dirty data still sitting in caches */
         flush_dcache_range((unsigned long)table,
-                           (unsigned long)(table_end + PAGE_SIZE));
+                           (unsigned long)table_end + 1);
         bridge->gatt_table = vmap(pages, (1 << page_order), 0, PAGE_KERNEL_NCG);
 
         if (bridge->gatt_table == NULL)
diff --git a/drivers/char/n_gsm.c b/drivers/char/n_gsm.c
index c4161d5e053d..e4089c432f15 100644
--- a/drivers/char/n_gsm.c
+++ b/drivers/char/n_gsm.c
@@ -904,9 +904,7 @@ static void gsm_dlci_data_sweep(struct gsm_mux *gsm)
         int len;
         /* Priority ordering: We should do priority with RR of the groups */
         int i = 1;
-        unsigned long flags;
 
-        spin_lock_irqsave(&gsm->tx_lock, flags);
         while (i < NUM_DLCI) {
                 struct gsm_dlci *dlci;
 
@@ -927,7 +925,6 @@ static void gsm_dlci_data_sweep(struct gsm_mux *gsm)
                 if (len == 0)
                         i++;
         }
-        spin_unlock_irqrestore(&gsm->tx_lock, flags);
 }
 
 /**
@@ -2230,12 +2227,16 @@ static int gsmld_open(struct tty_struct *tty)
 static void gsmld_write_wakeup(struct tty_struct *tty)
 {
         struct gsm_mux *gsm = tty->disc_data;
+        unsigned long flags;
 
         /* Queue poll */
         clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
         gsm_data_kick(gsm);
-        if (gsm->tx_bytes < TX_THRESH_LO)
+        if (gsm->tx_bytes < TX_THRESH_LO) {
+                spin_lock_irqsave(&gsm->tx_lock, flags);
                 gsm_dlci_data_sweep(gsm);
+                spin_unlock_irqrestore(&gsm->tx_lock, flags);
+        }
 }
 
 /**
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 8c99bf1b5e9f..942a9826bd23 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -529,6 +529,10 @@ static bool will_write_block(struct port *port)
 {
         bool ret;
 
+        if (!port->guest_connected) {
+                /* Port got hot-unplugged. Let's exit. */
+                return false;
+        }
         if (!port->host_connected)
                 return true;
 
@@ -1099,6 +1103,13 @@ static int remove_port(struct port *port)
 {
         struct port_buffer *buf;
 
+        if (port->guest_connected) {
+                port->guest_connected = false;
+                port->host_connected = false;
+                wake_up_interruptible(&port->waitqueue);
+                send_control_msg(port, VIRTIO_CONSOLE_PORT_OPEN, 0);
+        }
+
         spin_lock_irq(&port->portdev->ports_lock);
         list_del(&port->list);
         spin_unlock_irq(&port->portdev->ports_lock);
@@ -1120,9 +1131,6 @@ static int remove_port(struct port *port)
                 hvc_remove(port->cons.hvc);
 #endif
         }
-        if (port->guest_connected)
-                send_control_msg(port, VIRTIO_CONSOLE_PORT_OPEN, 0);
-
         sysfs_remove_group(&port->dev->kobj, &port_attribute_group);
         device_destroy(pdrvdata.class, port->dev->devt);
         cdev_del(&port->cdev);
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index 6aa10284104a..cb19dbc52136 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -1303,7 +1303,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                 if (!perm)
                         goto eperm;
                 ret = copy_from_user(&ui, up, sizeof(struct unimapinit));
-                if (!ret)
+                if (ret)
+                        ret = -EFAULT;
+                else
                         con_clear_unimap(vc, &ui);
                 break;
               }