Modified the source code as per the findings reported by the source
code analysis tool. Source code for the following functionalities
has been touched. None of the driver functionalities has changed.

- SMP Passthrough IOCTL
- Debug messages for MPT Replies (i.e. bit 9 of Logging Level)
- Task Management using sysfs
- Device removal, i.e. when a target device (including any PD within a volume)
  is removed, and Volume Deletion.
- Trace Buffer
Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] mpt2sas: Improvement were made to better protect the sas_device, raid_device, and expander_device lists

There were possible race conditions surrounding reading an object
from the link list while from another context in the driver was
removing it. The nature of this enhancement is to rearrange locking
so the link lists are better protected.

Change set:
(1) numerous routines were rearranged so spin locks are held through
the entire time a link list object is being read from or written to.
(2) added new routines for object deletion from link list.  Thus ensuring
lock was held during the deletion of the link list object, then and memory
for object freed outside the lock. The memory was freed outside the lock
so driver had access to device object info which was required for
notifying the scsi mid layer that a device was getting deleted.
(3) added the ioc->blocking_handles parameter.  This is a bitmask used
to identify which devices need blocking when there is device loss.  This was
introduced so that lock can be held for the entire time traversing the link
list objects, and the bitmask was set to indicate which device handles need
blocking. Oustide the lock the ioc->blocking_handles bitmask is traversed,
with the respective device handle the scsi mid layer is called for moving
devices into blocking state.
Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

[SCSI] mpt2sas : Perform Target Reset instead of HBA reset when a SATA_PASSTHROUGH cmd timeout happens
Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

Added support for Block IO requests with multiple segments (vectors) in
the SMP handler of the SAS Transport Class. This is required by the
BSG driver. Multisegment support added for both, Request and Response.
Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

When the lock_kernel and unlock_kernel routines were removed in the
2.6.39 kernel, a global mutex was added on top of the existing mutex
which already existed. With this implementation, only one IOCTL
will be active at any time no matter how many ever controllers
are present. This causes poor performance.

Removed the global mutex so that the driver can work with the existing
semaphore that was already part of the existing code.
Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

Changeset in MPI headers:
1) Bumped MPI2_HEADER_VERSION_UNIT
2) Added 4K sectors supported bit to CapabilitiesFlags field of IOC Page 6.
3) Added UEFIVersion field to BIOS Page 1 and defined additional
    BiosOptions bits to control UEFI behavior.
Signed-off-by: Nagalakshmi Nandigama <nagalakshmi.nandigama@lsi.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

The following patch for megaraid_sas updates the driver version to
v00.00.06.15-rc1, and updates Documentation/scsi/ChangeLog.megaraid_sas.
Signed-off-by: Adam Radford <aradford@gmail.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

The following patch for megaraid_sas fixes the fastpath code decision
logic to use fpRead/WriteCapable, fpRead/WriteAcrossStripe flags
instead of the old logic.  This fixes a bug where fastpath writes
could be sent to a read only LD.
Signed-off-by: Adam Radford <aradford@gmail.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

The following patch for megaraid_sas removes an incorrect comment and
optimizes the setting of HostMSIxVectors.  This was found during a
code review by Tomas Henzl @ RedHat.
Signed-off-by: Adam Radford <aradford@gmail.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

Data type of the 'tag' field of 'fw_flash_Update_resp' should be __le32.

Data type of 'pHeader' should be __le32.  Remove 2nd cast to 'piomb'.
Signed-off-by: Santosh Nayak <santoshprasadnayak@gmail.com>
Acked-by: Jack Wang <jack_wang@usish.com>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

Pull nfsd bugfixes from J. Bruce Fields:
 "One bugfix, and one minor header fix from Jeff Layton while we're
  here"

* 'for-3.4' of git://linux-nfs.org/~bfields/linux:
  nfsd: include cld.h in the headers_install target
  nfsd: don't fail unchecked creates of non-special files

Pull drm fixes from Dave Airlie:
 "It's like a grab bag of one liners:

  - core: fix page flip error path, reorder object teardown.
  - usb: fix the drm_usb module license.
  - i915: VT switch on SNB with non-native modes fix, and a regression
    fix from 3.3.
  - radeon: missing unreserve on SI, AGP/VRAM setup fix (fixes radeon on
    IA64, but its a generic bug), an rn50 regression from 3.3, turn off
    MSIs on rv515 (it loses rearms every so often)."

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  nouveau: Set special lane map for the right chipset
  drm/radeon: fix load detect on rn50 with hardcoded EDIDs.
  drm: Releasing FBs before releasing GEM objects during drm_release
  drm/nouveau/pm: don't read/write beyond end of stack buffer
  drivers: gpu: drm: gma500: mdfld_dsi_output.h: Remove not unneeded include of version.h
  radeon: fix r600/agp when vram is after AGP (v3)
  drm: fix page_flip error handling
  drm/radeon/kms: fix the regression of DVI connector check
  drm/usb: fix module license on drm/usb layer.
  drm/i915: Do not set "Enable Panel Fitter" on SNB pageflips
  drm/i915: Hold mode_config lock whilst changing mode for lastclose()
  drm/radeon/si: add missing radeon_bo_unreserve in si_rlc_init() v2
  drm/radeon: disable MSI on RV515
  drm/i915: don't clobber the special upscaling lvds timings

Pull KVM updates from Marcelo Tosatti.

* git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: lock slots_lock around device assignment
  KVM: VMX: Fix kvm_set_shared_msr() called in preemptible context
  KVM: unmap pages from the iommu when slots are removed
  KVM: PMU emulation: GLOBAL_CTRL MSR should be enabled on reset

The refactoring of the nv50 logic, introduced in 8663bc7c, modified the
test for the special lane map used on some Apple computers with Nvidia
chipsets. The tested MBA3,1 would still boot, but resume from suspend
stopped working. This patch restores the old test, which fixes the problem.
Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
Acked-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

When the force changes went in back in 3.3.0, we ended up returning
disconnected in the !force case, and the connected in when forced,
as it hit the hardcoded check.

Fix it so all exits go via the hardcoded check and stop spurious
modesets on platforms with hardcoded EDIDs.

Reported-by: Evan McNabb (Red Hat)
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Dave Airlie <airlied@redhat.com>

During DRM release, all the FBs and gem objects are released. If
a gem object is being used as a FB and set to a crtc, it must not
be freed before releasing the framebuffer first.

If FBs are released first, the crtc using the FB is disabled first
so now the GEM object can be freed safely. The CRTC will be enabled
again when the driver restores fbdev mode.
Signed-off-by: Prathyush K <prathyush.k@samsung.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

NUL-terminate after strncpy.

If the parameter "profile" has length 16 or more, then strncpy
leaves "string" with no NUL terminator, so the following search
for '\n' may read beyond the end of that 16-byte buffer.
If it finds a newline there, then it will also write beyond the
end of that stack buffer.
Signed-off-by: Jim Meyering <meyering@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

The output of "make versioncheck" points a incorrect include of
version.h in the drivers/gpu/drm/gma500/mdfld_dsi_output.h:

drivers/gpu/drm/gma500/mdfld_dsi_output.h: 32 linux/version.h not needed.

If we take a look in the file, we can agree to remove it.

Cc: David Airlie <airlied@linux.ie>
Cc: <dri-devel@lists.freedesktop.org>
Signed-off-by: Marcos Paulo de Souza <marcos.souza.org@gmail.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

If AGP is placed in the middle, the size_af is off-by-one, it results
in VRAM being placed at 0x7fffffff instead of 0x8000000.

v2: fix the vram_start setup.
v3: also fix r7xx & newer ASIC

Reported-by: russiane39 on #radeon
Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Free event and restore event_space only when page_flip->flags has
DRM_MODE_PAGE_FLIP_EVENT if page_flip() is failed.
Signed-off-by: Joonyoung Shim <jy0922.shim@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

* 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel:
  drm/i915: Do not set "Enable Panel Fitter" on SNB pageflips
  drm/i915: Hold mode_config lock whilst changing mode for lastclose()
  drm/i915: don't clobber the special upscaling lvds timings

The check of the encoder type in the commit [e00e8b5e: drm/radeon/kms:
fix analog load detection on DVI-I connectors] is obviously wrong, and
it's the culprit of the regression on my workstation with DVI-analog
connection resulting in the blank output.

Fixed the typo now.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Allows this module to load correctly with certain debugging options on.

Reported on irc by scientes
Signed-off-by: Dave Airlie <airlied@redhat.com>

My 9ce70c02 "memcg: fix deadlock by inverting lrucare nesting" put a
nasty little bug into v3.3's version of mem_cgroup_replace_page_cache(),
sometimes used for FUSE.  Replacing __mem_cgroup_commit_charge_lrucare()
by __mem_cgroup_commit_charge(), I used the "pc" pointer set up earlier:
but it's for oldpage, and needs now to be for newpage.  Once oldpage was
freed, its PageCgroupUsed bit (cleared above but set again here) caused
"Bad page state" messages - and perhaps worse, being missed from newpage.
(I didn't find this by using FUSE, but in reusing the function for tmpfs.)
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: stable@vger.kernel.org [v3.3 only]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  security: fix compile error in commoncap.c

As pointed out by Jason Baron, when assigning a device to a guest
we first set the iommu domain pointer, which enables mapping
and unmapping of memory slots to the iommu.  This leaves a window
where this path is enabled, but we haven't synchronized the iommu
mappings to the existing memory slots.  Thus a slot being removed
at that point could send us down unexpected code paths removing
non-existent pinnings and iommu mappings.  Take the slots_lock
around creating the iommu domain and initial mappings as well as
around iommu teardown to avoid this race.
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

Add missing "personality.h"
security/commoncap.c: In function 'cap_bprm_set_creds':
security/commoncap.c:510: error: 'PER_CLEAR_ON_SETID' undeclared (first use in this function)
security/commoncap.c:510: error: (Each undeclared identifier is reported only once
security/commoncap.c:510: error: for each function it appears in.)
Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
Acked-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>

kvm_set_shared_msr() may not be called in preemptible context,
but vmx_set_msr() does so:

  BUG: using smp_processor_id() in preemptible [00000000] code: qemu-kvm/22713
  caller is kvm_set_shared_msr+0x32/0xa0 [kvm]
  Pid: 22713, comm: qemu-kvm Not tainted 3.4.0-rc3+ #39
  Call Trace:
   [<ffffffff8131fa82>] debug_smp_processor_id+0xe2/0x100
   [<ffffffffa0328ae2>] kvm_set_shared_msr+0x32/0xa0 [kvm]
   [<ffffffffa03a103b>] vmx_set_msr+0x28b/0x2d0 [kvm_intel]
   ...

Making kvm_set_shared_msr() work in preemptible is cleaner, but
it's used in the fast path.  Making two variants is overkill, so
this patch just disables preemption around the call.
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

Pull fuse updates from Miklos Szeredi.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
  fuse: use flexible array in fuse.h
  fuse: allow nanosecond granularity
  fuse: O_DIRECT support for files
  fuse: fix nlink after unlink

Pull s390 updates from Martin Schwidefsky:
 "A couple of bug fixes, one of them is a TLB flush fix.  Included as
  well is one small coding style patch and a patch to update the default
  configuration."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  [S390] Fix compile error in swab.h
  [S390] Fix stfle() lowcore protection problem
  [S390] cpum_cf: get rid of compile warnings
  [S390] irq: simple coding style change
  [S390] update default configuration
  [S390] fix tlb flushing for page table pages
  [S390] kernel: Use local_irq_save() for memcpy_real()
  [S390] s390/char/vmur.c: fix memory leak
  [S390] drivers/s390/block/dasd_eckd.c: add missing dasd_sfree_request

Pull security subsystem fixes from James Morris.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  fcaps: clear the same personality flags as suid when fcaps are used
  mpi: Avoid using freed pointer in mpi_lshift_limbs()
  Smack: move label list initialization

The BCJ filters were meant to be enabled already on these
archs, but the xz_wrap.sh script was buggy. Enabling the
filters should give smaller kernel images.

xz_wrap.sh will now use $SRCARCH instead of $ARCH to detect
the architecture. That way it doesn't need to care about the
subarchs (like i386 vs. x86_64) since the BCJ filters don't
care either.
Signed-off-by: Lasse Collin <lasse.collin@tukaani.org>
Acked-by: Jan Beulich <jbeulich@suse.com>
Acked-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull libara fixes from Jeff Garzik:

 - Notable regression fix.  Forbid dynamic runtime power management by
   default, due to issues with suspend/resume and hotplug.

   To re-enable, use sysfs.

 - make ata_print_id atomic, due to ref from multiple contexts

 - sata_mv warning fix

 - ata_piix new PCI ID

* tag 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  libata: forbid port runtime pm by default, fixing regression
  libata: make ata_print_id atomic
  sata_mv: silence an uninitialized variable warning
  ata_piix: IDE-mode SATA patch for Intel DH89xxCC DeviceIDs

Forbid port runtime pm by default because it has known hotplug issue.
User can allow it by, for example

echo auto > /sys/devices/pci0000:00/0000:00:1f.2/ata2/power/control
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

This reverts commit 6fe0d062.

Paul bisected this regression.

The conversion was done blindly and is wrong, as it does not provide a
primary handler to disable the level type irq on the device level.
Neither does it set the IRQF_ONESHOT flag which handles that at the irq
line level.  This can't be done as the interrupt might be shared, though
we might extend the core to force it.

So an interrupt on this line will wake up the thread, but immediately
unmask the irq after that.  Due to the interrupt being level type the
hardware interrupt is raised over and over and prevents the irq thread
from handling it.  Fail.

request_irq() unfortunately does not refuse such a request and the patch
was obviously never tested with real interrupts.
Bisected-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Not only do the pageflip work without it at non-native modes (i.e. with
the panel fitter enabled), it also causes normal (non-pageflipped)
modesets to fail.
Reported-by: Adam Jackson <ajax@redhat.com>
Tested-by: Adam Jackson <ajax@redhat.com>
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Wanted-by-for-fixes: Dave Airlie <airlied@gmail.com>
Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>

If a process increases permissions using fcaps all of the dangerous
personality flags which are cleared for suid apps should also be cleared.
Thus programs given priviledge with fcaps will continue to have address space
randomization enabled even if the parent tried to disable it to make it
easier to attack.
Signed-off-by: Eric Paris <eparis@redhat.com>
Reviewed-by: Serge Hallyn <serge.hallyn@canonical.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>

At the start of the function we assign 'a->d' to 'ap'. Then we use the
RESIZE_IF_NEEDED macro on 'a' - this may free 'a->d' and replace it
with newly allocaetd storage. In that case, we'll be operating on
freed memory further down in the function when we index into 'ap[]'.
Since we don't actually need 'ap' until after the use of the
RESIZE_IF_NEEDED macro we can just delay the assignment to it until
after we've potentially resized, thus avoiding the issue.

While I was there anyway I also changed the integer variable 'n' to be
const. It might as well be since we only assign to it once and use it
as a constant, and then the compiler will tell us if we ever assign to
it in the future.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>

A kernel with Smack enabled will fail if tmpfs has xattr support.

Move the initialization of predefined Smack label
list entries to the LSM initialization from the
smackfs setup. This became an issue when tmpfs
acquired xattr support, but was never correct.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>

Pull ext4 regression fixes from Ted Ts'o:
 "This fixes a scalability problem reported by Andi Kleen and Tim Chen;
  they were quite secretive about the precise nature of their workload,
  but they later admitted that it only showed up when they were using a
  large sparse file, so the amount of data I/O that was needed was close
  to zero.

  I'm not sure how realistic this is and it's only a regression if you
  consider changes made since 2.6.39 to be a "regression" vis-a-vis the
  policy regarding post-merge window bug fixes, but Linus agreed it was
  worth fixing, so I'm including it in this pull request.

  This also fixes the journalled quota mount options, which I
  accidentally broke while I was cleaning up the mount option handling."

* tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: fix handling of journalled quota options
  ext4: address scalability issue by removing extent cache statistics