The various bit string instructions (bts, btc, etc.) fail to adjust the
address correctly if the bit address is beyond BITS_PER_LONG.

This bug creeped in as the emulator originally relied on cr2 to contain the
memory address; however we now decode it from the mod r/m bits, and must
adjust the offset to account for large bit indices.

The patch is rather large because it switches src and dst decoding around, so
that the bit index is available when decoding the memory address.

This fixes workloads like the FC5 installer.
Signed-off-by: NAvi Kivity <avi@qumranet.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The kvm mmio read path looks like:

 1. guest read faults
 2. kvm emulates read, calls emulator_read_emulated()
 3. fails as a read requires userspace help
 4. exit to userspace
 5. userspace emulates read, kvm sets vcpu->mmio_read_completed
 6. re-enter guest, fault again
 7. kvm emulates read, calls emulator_read_emulated()
 8. succeeds as vcpu->mmio_read_emulated is set
 9. instruction completes and guest is resumed

A problem surfaces if the userspace exit (step 5) also requests an interrupt
injection.  In that case, the guest does not re-execute the original
instruction, but the interrupt handler.  The next time an mmio read is
exectued (likely for a different address), step 3 will find
vcpu->mmio_read_completed set and return the value read for the original
instruction.

The problem manifested itself in a few annoying ways:
- little squares appear randomly on console when switching virtual terminals
- ne2000 fails under nfs read load
- rtl8139 complains about "pci errors" even though the device model is
  incapable of issuing them.

Fix by skipping interrupt injection if an mmio read is pending.

A better fix is to avoid re-entry into the guest, and re-emulating immediately
instead.  However that's a bit more complex.
Signed-off-by: NAvi Kivity <avi@qumranet.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This makes the vmwrite errors on vm shutdown go away.
Signed-off-by: NAvi Kivity <avi@qumranet.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The paravirt subsystem is still in flux so all exports from it are
definitely internal use only.  The APIs around this /will/ change.
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Cc: Andi Kleen <ak@suse.de>
Cc: Zachary Amsden <zach@vmware.com>
Cc: Jeremy Fitzhardinge <jeremy@xensource.com>
Acked-by: NRusty Russell <rusty@rustcorp.com.au>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Sing the praises of `gcc -W'.  Would have prevented that blockdev direct-IO
bug.

Cc: "Chen, Kenneth W" <kenneth.w.chen@intel.com>
Cc: "Randy.Dunlap" <rdunlap@xenotime.net>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

size_t is unsigned.  IO errors aren't getting through.

Cc: "Chen, Kenneth W" <kenneth.w.chen@intel.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Commit f2802e7f and its x86 version
(b7471c6d) adds nmi_known_cpu() check
while parsing boot options in x86_64 and i386.

With that, "nmi_watchdog=2" stops working for me on Intel Core 2 CPU
based system.

The problem is, setup_nmi_watchdog is called while parsing the boot
option and identify_cpu is not done yet.  So, the return value of
nmi_known_cpu() is not valid at this point.

So revert that check.  This should not have any adverse effect as the
nmi_known_cpu() check is done again later in enable_lapic_nmi_watchdog().
Signed-off-by: NVenkatesh Pallipadi <venkatesh.pallipadi@intel.com>
Cc: Don Zickus <dzickus@redhat.com>
Cc: Andi Kleen <ak@suse.de>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

export profile_hits() on !SMP too.

Cc: Ingo Molnar <mingo@elte.hu>
Cc: Avi Kivity <avi@qumranet.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The current PDA code, which went in in post 2.6.19 has a flaw in that it
doesn't correctly cycle the GDT and %GS segment through the boot PDA,
the CPU PDA and finally the per-cpu PDA.

The bug generally doesn't show up if the boot CPU id is zero, but
everything falls apart for a non zero boot CPU id.  The basically kills
voyager which is perfectly capable of doing non zero CPU id boots, so
voyager currently won't boot without this.

The fix is to be careful and actually do the GDT setups correctly.
Signed-off-by: NJames Bottomley <James.Bottomley@SteelEye.com>
Cc: Andi Kleen <ak@suse.de>
Cc: Jeremy Fitzhardinge <jeremy@goop.org>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* git://git.infradead.org/mtd-2.6: (84 commits)
  [JFFS2] debug.h: include <linux/sched.h> for current->pid
  [MTD] OneNAND: Handle DDP chip boundary during read-while-load
  [MTD] OneNAND: return ecc error code only when 2-bit ecc occurs
  [MTD] OneNAND: Implement read-while-load
  [MTD] OneNAND: fix onenand_wait bug in read ecc error
  [MTD] OneNAND: release CPU in cycles
  [MTD] OneNAND: add subpage write support
  [MTD] OneNAND: fix onenand_wait bug
  [JFFS2] use the ref_offset macro
  [JFFS2] Reschedule in loops
  [JFFS2] Fix error-path leak in summary scan
  [JFFS2] add cond_resched() when garbage collecting deletion dirent
  [MTD] Nuke IVR leftovers
  [MTD] OneNAND: fix oob handling in recent oob patch
  [MTD] Fix ssfdc blksize typo
  [JFFS2] replace kmalloc+memset with kzalloc
  [MTD] Fix SSFDC build for variable blocksize.
  [MTD] ESB2ROM uses PCI
  [MTD] of_device-based physmap driver
  [MTD] Support combined RedBoot FIS directory and configuration area
  ...

Both "=r" and "=g" breaks my build on i386:

  $ make
    CC [M]  drivers/kvm/vmx.o
  {standard input}: Assembler messages:
  {standard input}:3318: Error: bad register name `%sil'
  make[1]: *** [drivers/kvm/vmx.o] Error 1
  make: *** [_module_drivers/kvm] Error 2

The reason is that setbe requires an 8-bit register but "=r" does not
constrain the target register to be one that has an 8-bit version on
i386.

According to

	http://gcc.gnu.org/bugzilla/show_bug.cgi?id=10153

the correct constraint is "=q".
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/pci-2.6:
  PCI: fix pci-driver kernel-doc
  PCI: rework Documentation/pci.txt
  PCI: Unhide the SMBus on the Asus P4P800-X

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: unusual_devs.h entry for nokia 6233
  USB: Fix for typo in ohci-ep93xx.c
  USB: disable USB_MULTITHREAD_PROBE
  USB: add vendor/device id for Option GT Max 3.6 cards
  USB: unusual_devs.h for 0x046b:ff40
  USB: make usbhid ignore Imation Disc Stakka
  USB: rndis_host: fix crash while probing a Nokia S60 mobile
  USB: asix: Detect internal PHY and enable/use accordingly
  usbtouchscreen: make ITM screens report BTN_TOUCH as zero when not touched

Function short description should be on only one line.
Signed-off-by: NRandy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Rewrite Documentation/pci.txt:
o restructure document to match how API is used when writing init code.
o update to reflect changes in struct pci_driver function pointers.
o removed language on "new style vs old style" device discovery.
  "Old style" is now deprecated. Don't use it. Left description in
  to document existing driver behaviors.
o add section "Legacy I/O Port free driver" by Kenji Kaneshige
  http://lkml.org/lkml/2006/11/22/25
  (renamed to "pci_enable_device_bars() and Legacy I/O Port space")
o add "MMIO space and write posting" section to help avoid common pitfall
  when converting drivers from IO Port space to MMIO space.
  Orignally posted http://lkml.org/lkml/2006/2/27/24
o many typo/grammer/spelling corrections from Randy Dunlap
o two more spelling corrections from Stephan Richter
o fix CodingStyle as per Randy Dunlap
Signed-off-by: NGrant Grundler <grundler@parisc-linux.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Unhide the SMBus on the Asus P4P800-X (and probably some other
models of the family.) This gives access to the memory module SPD
EEPROMs.

Thanks to Winbond for supporting the lm-sensors project with the
donation of this motherboard.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

In appendix a patch for the nokia 6233 mobile phone is included.
The patch is against 2.6.20-rc5. It is my first patch. Hopefully it has
the right format. The code makes my nokia 6233 on my computer work.


From: Manuel Osdoba <manuel.osdoba@tu-ilmenau.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Attached patch fixes typo in USB driver reported by Chase Douglas on linux-cirrus mailing
list. http://www.freelists.org/archives/linux-cirrus/12-2006/msg00003.htmlSigned-off-by: NPetr Stetiar <ynezz@true.cz>
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Disable the USB_MULTITHREAD_PROBE option because it causes crashes on
people's machines and they never remember to actually read the config
help files.

No one likes this, everyone hates it, I'm going to go eat worms...

The full logic will be ripped out later.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This fixes http://bugzilla.kernel.org/show_bug.cgi?id=7814Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

American Megatrends did something wrong in their floppy emulator. It breaks
with both kinds of MODE SENSE which our stack sends. Alan and I tried a few
tweaks, and got LUNs sensed right, but US_FL_NO_WP_DETECT is still needed.

I set the firmware bracket to 1.00 exactly, in case AMI or Sun fix it with a
firmware update. Hey, you never know.
Signed-off-by: NPete Zaitcev <zaitcev@redhat.com>
Signed-off-by: NPhil Dibowitz <phil@ipom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

on request of the sourceforge project for this device, a kind of
robotized CD storage, it should be ignored by the generic driver.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Bug fix for driver rndis_host which fixes rndis_host probing certain
Nokia S60 (Series 60) mobiles. While the rndis_host get probed by usbnet
and tries to bind the Nokia mobile the bind is going to fail. The
rndis_host module tries to release the device, in a wrong way, which
cause the oops.

Fixes Bugzilla #7201
Signed-off-by: NDaniel Gollub <dgollub@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Different AX88772 dongles use different PHYs; the chip is capable of using
both a primary and secondary PHY, and supports an internal and external PHY.

It appears that some DUB-E100 devices use the internal PHY, so trying to use
an external one will not work (note that this is different across revisions,
as well; the "A" and "B" revs of the DUB-E100 use different PHYs!).  The data
sheet for the AX88772 chip specifies that the internal PHY id will be 0x10,
so if that's read from the EEPROM, we should use that rather than attempting
to use an external PHY.

Thanks to Mitch Bradley for pointing this out!
Signed-off-by: NAndres Salomon <dilinger@debian.org>
Cc: David Hollis <dhollis@davehollis.com>
Cc: Chris Ball <cjb@laptop.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

ITM screens send invalid x/y data when not touched. this was fixes a while ago
but the problem is if the screen is not touched anymore the driver never does
not report BTN_TOUCH as zero. fix it by sending the report with the last valid
coordinates when pressure is released.
Signed-off-by: NDaniel Ritz <daniel.ritz@gmx.ch>
Cc: J.P. Delport <jpdelport@csir.co.za>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2:
  ocfs2: Add backup superblock info to ocfs2_fs.h
  ocfs2: cleanup ocfs2_iget() errors
  ocfs2: Directory c/mtime update fixes
  ocfs2: Don't print errors when following symlinks

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  sis190: failure to set the MAC address from EEPROM
  Fix phy_read/write redefinition errors in ucc_geth_phy.c
  Update ucc_geth.c for new workqueue structure
  myri10ge: update driver version to 1.2.0
  myri10ge: check that we can get an irq
  myri10ge: make wc_fifo usage load-time tunable
  8139cp: Don't blindly enable interrupts
  [PATCH] bcm43xx: Fix failure to deliver PCI-E interrupts

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  sata_mv HighPoint 2310 support (88SX7042)
  libata: fix handling of port actions in per-dev action mask
  libata: initialize qc->dma_dir to DMA_NONE
  sata_via: add PCI ID 0x5337
  libata doc: "error : unterminated entity reference exceptions"

* master.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: (30 commits)
  [SCSI] qla1280: set residual correctly
  [SCSI] fusion: bump version
  [SCSI] fusion: MODULE_VERSION support
  [SCSI] fusion: power pc and miscellaneous bug fixs
  [SCSI] fusion: fibre channel: return DID_ERROR for MPI_IOCSTATUS_SCSI_IOC_TERMINATED
  [SCSI] megaraid_sas: Update module author
  [SCSI] 3ware 8000 serialize reset code
  [SCSI] sr: fix error code check in sr_block_ioctl()
  [SCSI] scsi: lpfc error path fix
  [SCSI] aacraid: Product List Update
  [SCSI] libiscsi: fix senselen calculation
  [SCSI] iscsi: simplify IPv6 and IPv4 address printing
  [SCSI] iscsi: newline in printk
  [SCSI] iscsi: fix crypto_alloc_hash() error check
  [SCSI] iscsi: fix 2.6.19 data digest calculation bug
  [SCSI] scsi_scan: fix report lun problems with CDROM or RBC devices
  [SCSI] qla2xxx: Update version number to 8.01.07-k4.
  [SCSI] qla2xxx: Use generic isp_ops.fw_dump() function.
  [SCSI] qla2xxx: Perform a fw-dump when an ISP23xx RISC-paused state is detected.
  [SCSI] qla2xxx: Correct reset handling logic.
  ...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  hid-core.c: Adds GTCO CalComp Interwrite IPanel PIDs to blacklist
  HID: put usb_interface instead of usb_device into hid->dev to fix udevinfo breakage
  HID: add missing RX, RZ and RY enum values to hid-debug output
  HID: hid/hid-input.c doesn't need to include linux/usb/input.h
  HID: compilation fix when DEBUG_DATA is defined
  HID: proper LED-mapping for SpaceNavigator
  HID: update MAINTAINERS entry for USB-HID
  HID: GEYSER4_ISO needs quirk
  HID: fix some ARM builds due to HID brokenness - make USB_HID depend on INPUT

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] Update defconfigs
  [POWERPC] atomic_dec_if_positive sign extension fix
  [POWERPC] Fix OF node refcnt underflow in 836x and 832x platform code
  [POWERPC] Make it blatantly clear; mpc5200 device tree is not yet stable
  [POWERPC] Fix broken DMA on non-LPAR pSeries
  [POWERPC] Fix cell's mmio nvram to properly parse device tree
  [POWERPC] Remove bogus sanity check in pci -> OF node code

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] Delete duplicate call to load_irq_save.
  [MIPS] SMTC: Fix cp0 hazard.

* 'hwmon-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6:
  hwmon/w83793: Hide invalid VID readings
  hwmon/w83793: Fix the fan input detection
  hwmon/w83793: Ignore disabled temperature channels
  hwmon: Fix the VRD 11 decoding
  hwmon/w83793: Remove the description of AMDSI and update the voltage formula

* git://git.kernel.org/pub/scm/linux/kernel/git/aia21/ntfs-2.6:
  NTFS: Forgot to bump version number in makefile to 2.1.28...
  NTFS: 2.1.28 - Fix deadlock reported by Sergey Vlasov due to ntfs_put_inode().

* 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/v4l-dvb:
  V4L/DVB (5023): Fix compilation on ppc32 architecture
  V4L/DVB (5071): Tveeprom: autodetect LG TAPC G701D as tuner type 37
  V4L/DVB (5069): Fix bttv and friends on 64bit machines with lots of memory
  V4L/DVB (5033): MSI TV@nywhere Plus fixes
  V4L/DVB (5029): Ks0127 status flags
  V4L/DVB (5024): Fix quickcam communicator driver for big endian architectures
  V4L/DVB (5021): Cx88xx: Fix lockup on suspend
  V4L/DVB (5020): Fix: disable interrupts while at KM_BOUNCE_READ
  V4L/DVB (5019): Fix the frame->grabstate update in read() entry point.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc:
  mmc: Correct definition of R6
  omap: Update MMC response types

This reverts commit 99a10a60.

As per Hugh Dickins:

  "Nadia Derbey has reported that mmap of /dev/kmem no longer works with
   the kernel virtual address as offset, and Franck has confirmed that
   his patch came from a misunderstanding of what an offset means to
   /dev/kmem - whereas his patch description seems to say that he was
   correcting the offset on a few plaforms, there was no such problem to
   correct, and his patch was in fact changing its API on all platforms."
Suggested-by: NHugh Dickins <hugh@veritas.com>
Cc: Franck Bui-Huu <fbuihuu@gmail.com>
Cc: Nadia Derbey <Nadia.Derbey@bull.net>
Cc: Andi Kleen <ak@suse.de>
Cc: Arjan van de Ven <arjan@infradead.org>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Mostly took the defaults, except tried to get the netfilter options
more or less as they were before.
Signed-off-by: NPaul Mackerras <paulus@samba.org>

On 64-bit machines, if an atomic counter is explicitly set to a
negative value, the atomic_dec_if_positive function will decrement and
store the next smallest value in the atomic counter, contrary to its
intended operation.

The comparison to determine if the decrement will make the result
negative was done by the "addic." instruction, which operates on a
64-bit value, namely the zero-extended word loaded from the atomic
variable.  This patch uses an explicit word compare (cmpwi) and
changes the addic. to an addi (also changing "=&r" to "=&b" so that r0
isn't used, and addi doesn't become li).

This also fixes a bug for both 32-bit and 64-bit in that previously
0x80000000 was considered positive, since the result after
decrementing is positive.  Now it is considered negative.

Also, I clarify the return value in the comments just to make it clear
that the value returned is always the decremented value, even if that
value is not stored back to the atomic counter.
Signed-off-by: NRobert Jennings <rcj@linux.vnet.ibm.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Incorrect use of of_find_node_by_name() causes of_node_put()
on a node which has already been put.  It causes the refcount of
the node to underflow, which triggers the WARN_ON in kref_get
for 836x and 832x.  This fixes it.
Signed-off-by: NLi Yang <leoli@freescale.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>