Intel EM64T CPUs handle uncanonical return addresses differently
from AMD CPUs.

The exception is reported in the SYSRET, not the next instruction.
This leads to the kernel exception handler running on the user stack
with the wrong GS because the kernel didn't expect exceptions
on this instruction.

This version of the patch has the teething problems that plagued an earlier
version fixed.

This is CVE-2006-0744

Thanks to Ernie Petrides and Asit B. Mallick for analysis and initial
patches.
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Machine checks can stall the machine for a long time and
it's not good to trigger the nmi watchdog during that.
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The generic linux/numa.h file defines NODES_SHIFT to 0 in case
the architecture did not.

Every architecture which has a NUMA config option defines
NODES_SHIFT in its asm-$ARCH headers, but only if NUMA is
enabled, except for x86_64.

This should make it like all the rest.
Signed-off-by: NDave Hansen <haveblue@us.ibm.com>
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This prevents crashes on dual core system when enough ticks are lost.

Replaces earlier patch by me.

Cc: Dave Jones <davej@redhat.com>
Signed-off-by: NThomas Renninger <trenn@suse.de>
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

AMD systems have a modern APIC that supports 8 bit IDs, but
don't have a XAPIC version number.  Add a new "modern_apic"
subfunction that handles this correctly and use it (nearly)
everywhere where XAPIC is tested for.

I removed one wart: the code specified that external APICs
would use an 8bit APIC ID. But I checked a real 82093 data sheet
and it says clearly that they only use 4bit. So I removed
this special case since it would a bit awkward to implement now.

I removed the valid APIC tests in mptable parsing completely. On any modern
system they only check against the full field width (8bit) anyways
and are no-ops. This also fixes them doing the wrong thing
on >8 core Opterons.

This makes i386 boot again on 16 core Opterons.

Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Needed for other checks later in ACPI.

Pointed out by Len Brown
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

When nolapic was passed or the local APIC was disabled
for another reason ACPI would still parse the IO-APICs
until these were explicitely disabled with noapic.

Usually this resulted in a non booting configuration unless
"nolapic noapic" was used.

I also disabled the local APIC parsing in this case, although
that's only cosmetic (suppresses a few printks)

This hopefully makes nolapic work in all cases.
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Horus systems don't have anything on bus 0 which makes
the Type 1 sanity checks fail.  Use the DMI BIOS year to
check for newer systems and always assume Type 1 works on them.
I used 2001 as an pretty arbitary cutoff year.

Cc: gregkh@suse.de
Cc: Navin Boppuri <navin.boppuri@newisys.com>
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This patch introduces a user for the e820_all_mapped function:

There have been several machines that don't have a working MMCONFIG,
often because of a buggy MCFG table in the ACPI bios.  This patch adds a
simple sanity check that detects a whole bunch of these cases, and when
it detects it, linux now boots rather than crash-and-burns.

The accuracy of this detection can in principle be improved if there was
a "is this entire range in e820 with THIS attribute", but no such
function exist and the complexity needed for this is not really worth
it; this simple check already catches most cases anyway.
Signed-off-by: NArjan van de Ven <arjan@linux.intel.com>
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Introduce a e820_all_mapped() function which checks if the entire range
<start,end> is mapped with type.

This is done by moving the local start variable to the end of each
known-good region; if at the end of the function the start address is
still before end, there must be a part that's not of the correct type;
otherwise it's a good region.
Signed-off-by: NArjan van de Ven <arjan@linux.intel.com>
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Rename e820_mapped to e820_any_mapped since it tests if any part of the
range is mapped according to the type.

Later steps will introduce e820_all_mapped which will check if the
entire range is mapped with the type.  Both have their merit.
Signed-off-by: NArjan van de Ven <arjan@linux.intel.com>
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The node setup code would try to allocate the node metadata in the node
itself, but that fails if there is no memory in there.

This can happen with memory hotplug when the hotplug area defines an so
far empty node.

Now use bootmem to try to allocate the mem_map in other nodes.

And if it fails don't panic, but just ignore the node.

To make this work I added a new __alloc_bootmem_nopanic function that
does what its name implies.

TBD should try to use nearby nodes here.  Currently we just use any.
It's hard to do it better because bootmem doesn't have proper fallback
lists yet.
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

From: Keith Mannthey, Andi Kleen

Implement memory hotadd without sparsemem. The memory in the SRAT
hotadd area is just preserved instead and can be activated later.

There are a few restrictions:
- Only one continuous hotadd area allowed per node

The main problem is dealing with the many buggy SRAT tables
that are out there. The strategy here is to reject anything
suspicious.

Originally from Keith Mannthey, with several hacks and changes by AK
and also contributions from Andrew Morton

[ TBD: Problems pointed out by KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>:

 1) Goto's rebuild_zonelist patch will not work if CONFIG_MEMORY_HOTPLUG=n.

    Rebuilding zonelist is necessary when the system has just memory <
    4G at boot, and hot add memory > 4G.  because x86_64 has DMA32,
    ZONE_NORAML is not included into zonelist at boot time if system
    doesn't have memory >4G at boot.

    [AK: should just force the higher zones at boot time when SRAT tells us]

 2) zone and node's spanned_pages and present_pages are not incremented.
    They should be.

    For example, our server (ia64/Fujitsu PrimeQuest) can equip memory
    from 4G to 1T(maybe 2T in future), and SRAT will *always* say we have
    possible 1T +memory.  (Microsoft requires "write all possible memory
    in SRAT") When we reserve memmap for possible 1T memory, Linux will
    not work well in +minimum 4G configuraion ;)

    [AK: needs limiting to 5-10% of max memory]
 ]
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Memory hotadd doesn't need SPARSEMEM, but can be handled by just preallocating
mem_maps. This only needs some untangling of ifdefs to enable the necessary
code even without SPARSEMEM.

Originally from Keith Mannthey, hacked by AK.
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Just call IRET always, no need for any special cases.

Needed for the next bug fix.
Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Signed-off-by: NAndi Kleen <ak@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Close of the merge window..

Apparently nobody had tried to compile the ALSA CVS tree without power
management enabled.
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

* 'splice' of git://brick.kernel.dk/data/git/linux-2.6-block:
  [PATCH] splice: fix page stealing LRU handling.
  [PATCH] splice: page stealing needs to wait_on_page_writeback()
  [PATCH] splice: export generic_splice_sendpage
  [PATCH] splice: add a SPLICE_F_MORE flag
  [PATCH] splice: add comments documenting more of the code
  [PATCH] splice: improve writeback and clean up page stealing
  [PATCH] splice: fix shadow[] filling logic

Originally from Nick Piggin, just adapted to the newer branch.

You can't check PageLRU without holding zone->lru_lock.  The page
release code can get away with it only because the page refcount is 0 at
that point. Also, you can't reliably remove pages from the LRU unless
the refcount is 0. Ever.
Signed-off-by: NNick Piggin <nickpiggin@yahoo.com.au>
Signed-off-by: NJens Axboe <axboe@suse.de>

Thanks to Andrew for the good explanation of why this is so. akpm writes:

If a page is under writeback and we remove it from pagecache, it's still
going to get written to disk.  But the VFS no longer knows about that page,
nor that this page is about to modify disk blocks.

So there might be scenarios in which those
blocks-which-are-about-to-be-written-to get reused for something else.
When writeback completes, it'll scribble on those blocks.

This won't happen in ext2/ext3-style filesystems in normal mode because the
page has buffers and try_to_release_page() will fail.

But ext2 in nobh mode doesn't attach buffers at all - it just sticks the
page in a BIO, finds some new blocks, points the BIO at those blocks and
lets it rip.

While that write IO's in flight, someone could truncate the file.  Truncate
won't block on the writeout because the page isn't in pagecache any more.
So truncate will the free the blocks from the file under the page's feet.
Then something else can reallocate those blocks.  Then write data to them.

Now, the original write completes, corrupting the filesystem.
Signed-off-by: NJens Axboe <axboe@suse.de>

Forgot that one, thanks Jeff. Also move the other EXPORT_SYMBOL
to right below the functions.
Signed-off-by: NJens Axboe <axboe@suse.de>

This lets userspace indicate whether more data will be coming in a
subsequent splice call.
Signed-off-by: NJens Axboe <axboe@suse.de>

Hopefully this will make Andrew a little more happy.
Signed-off-by: NJens Axboe <axboe@suse.de>

By cleaning up the writeback logic (killing write_one_page() and the manual
set_page_dirty()), we can get rid of ->stolen inside the pipe_buffer and
just keep it local in pipe_to_file().

This also adds dirty page balancing logic and O_SYNC handling.
Signed-off-by: NJens Axboe <axboe@suse.de>

Clear the entire range, and don't increment pidx or we keep filling
the same position again and again.

Thanks to KAMEZAWA Hiroyuki.
Signed-off-by: NJens Axboe <axboe@suse.de>

* master.kernel.org:/home/rmk/linux-2.6-arm: (27 commits)
  [ARM] 3433/1: ARM: OMAP: 8/8 Update board files
  [ARM] 3455/1: ARM: OMAP: 7/8 Misc updates, take 2
  [ARM] 3454/1: ARM: OMAP: 6/8 Update framebuffer low-level init code, take 2
  [ARM] 3430/1: ARM: OMAP: 5/8 Update PM
  [ARM] 3429/1: ARM: OMAP: 4/8 Update GPIO
  [ARM] 3428/1: ARM: OMAP: 3/8 Update pin multiplexing
  [ARM] 3427/1: ARM: OMAP: 2/8 Update timers
  [ARM] 3426/1: ARM: OMAP: 1/8 Update clock framework
  [ARM] 3396/2: AT91RM9200 Platform devices update
  [ARM] 3395/2: AT91RM9200 Dataflash Card vs MMC selection
  [ARM] 3393/2: AT91RM9200 LED support
  [ARM] 3453/1: Poodle: Correctly set the memory size
  [ARM] 3446/1: i.MX: MMC/SD SDHC controller registration for i.MX/MX1 MX1ADS board
  [ARM] 3444/1: i.MX: Scatter-gather DMA emulation for i.MX/MX1
  [ARM] 3451/1: ep93xx: use the m48t86 rtc driver on the ts72xx platform
  [ARM] 3450/1: ep93xx: use the ep93xx rtc driver
  [ARM] 3452/1: [S3C2410] RX3715 - add nand information
  [ARM] 3449/1: [S3C2410] Anubis - fix NAND timings
  [ARM] 3448/1: [S3C2410] Settle delay when _enabling_ USB PLL
  [ARM] 3442/1: [S3C2410] SMDK: NAND device setup
  ...

* master.kernel.org:/home/rmk/linux-2.6-mmc:
  [ARM] 3457/1: i.MX: SD/MMC support for i.MX/MX1
  [ARM] 3456/1: AT91RM9200 support for 2.6 (MMC/SD driver)

* git://oss.sgi.com:8090/oss/git/xfs-2.6:
  [XFS] Provide XFS support for the splice syscall.
  [XFS] Reenable write barriers by default.
  [XFS] Make project quota enforcement return an error code consistent with
  [XFS] Implement the silent parameter to fill_super, previously ignored.
  [XFS] Cleanup comment to remove reference to obsoleted function

* master.kernel.org:/pub/scm/linux/kernel/git/perex/alsa: (28 commits)
  [ALSA] Kconfig SND_SEQUENCER_OSS help text fix
  [ALSA] Add Aux input switch control for Aureon Universe
  [ALSA] pcxhr - Fix the crash with REV01 board
  [ALSA] sound/pci/hda: use create_singlethread_workqueue()
  [ALSA] hda-intel - Add support of ATI SB600
  [ALSA] cs4281 - Fix the check of timeout in probe
  [ALSA] cs4281 - Fix the check of right channel
  [ALSA] Test volume resolution of usb audio at initialization
  [ALSA] maestro3.c: fix BUG, optimization
  [ALSA] HDA/Realtek: multiple input mux definitions and pin mode additions
  [ALSA] AdLib FM card driver
  [ALSA] Fix / clean up PCM-OSS setup hooks
  [ALSA] Clean up PCM codes (take 2)
  [ALSA] Tiny clean up of PCM codes
  [ALSA] ISA drivers bailing on first !enable[i]
  [ALSA] Remove obsolete kfree_nocheck call
  [ALSA] Remove obsolete kfree_nocheck call
  [ALSA] Add snd-als300 driver for Avance Logic ALS300/ALS300+ soundcards
  [ALSA] Add snd-riptide driver for Conexant Riptide chip
  [ALSA] hda-codec - Fix noisy output wtih AD1986A 3stack model
  ...

No one should be writing a PAGE_SIZE worth of data to a normal sysfs
file, so properly terminate the buffer.

Thanks to Al Viro for pointing out my supidity here.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This reverts the mutex conversion that was recently done to the hdaps
driver; this coversion was buggy because the hdaps driver started using
this semaphore in IRQ context, which mutexes do not allow.  Easiest
solution for now is to just revert the patch (the patch was part of a
bigger GIT commit, 9a61bf63 but this
only reverts this one file)
Signed-off-by: NArjan van de Ven <arjan@linux.intel.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

* master.kernel.org:/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
  [WATCHDOG] at91_wdt.c - Atmel AT91RM9200 watchdog driver
  [WATCHDOG] pcwd_usb.c: fix a NULL pointer dereference
  [WATCHDOG] pcwd.c sprintf/strcpy fix
  [WATCHDOG] pcwd.c general clean-up after patches
  [WATCHDOG] pcwd.c add debug info
  [WATCHDOG] pcwd.c pcwd_cleanup_module patch
  [WATCHDOG] pcwd.c firmware-info patch
  [WATCHDOG] pcwd.c control status patch

* git://git.kernel.org/pub/scm/linux/kernel/git/bunk/trivial: (48 commits)
  Documentation: fix minor kernel-doc warnings
  BUG_ON() Conversion in drivers/net/
  BUG_ON() Conversion in drivers/s390/net/lcs.c
  BUG_ON() Conversion in mm/slab.c
  BUG_ON() Conversion in mm/highmem.c
  BUG_ON() Conversion in kernel/signal.c
  BUG_ON() Conversion in kernel/signal.c
  BUG_ON() Conversion in kernel/ptrace.c
  BUG_ON() Conversion in ipc/shm.c
  BUG_ON() Conversion in fs/freevxfs/
  BUG_ON() Conversion in fs/udf/
  BUG_ON() Conversion in fs/sysv/
  BUG_ON() Conversion in fs/inode.c
  BUG_ON() Conversion in fs/fcntl.c
  BUG_ON() Conversion in fs/dquot.c
  BUG_ON() Conversion in md/raid10.c
  BUG_ON() Conversion in md/raid6main.c
  BUG_ON() Conversion in md/raid5.c
  Fix minor documentation typo
  BFP->BPF in Documentation/networking/tuntap.txt
  ...

sbp2util_mark_command_completed takes a lock which was already taken by
sbp2scsi_complete_all_commands.  This is a regression in Linux 2.6.15.

 Reported by Kristian Harms at
	https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187394

[ More complete commentary, as response to questions by Andrew: ]

> This changes the call environment for all implementations of
> ->Current_done().  Are they all safe to call under this lock?

Short answer: Yes, trust me.  ;-) Long answer:

The done() callbacks are passed on to sbp2 from the SCSI stack along
with each SCSI command via the queuecommand hook.  The done() callback
is safe to call in atomic context.  So does
Documentation/scsi/scsi_mid_low_api.txt say, and many if not all SCSI
low-level handlers rely on this fact.  So whatever this callback does,
it is "self-contained" and it won't conflict with sbp2's internal ORB
list handling.  In particular, it won't race with the
sbp2_command_orb_lock.

Moreover, sbp2 already calls the done() handler with
sbp2_command_orb_lock taken in sbp2scsi_complete_all_commands().  I
admit this is ultimately no proof of correctness, especially since this
portion of code introduced the spinlock recursion in the first place and
we didn't realize it since this code's submission before 2.6.15 until
now.  (I have learned a lesson from this.)

I stress-tested my patch on x86 uniprocessor with a preemptible SMP
kernel (alas I have no SMP machine yet) and made sure that all code
paths which involve the sbp2_command_orb_lock were gone through multiple
times.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

* master.kernel.org:/pub/scm/linux/kernel/git/mchehab/v4l-dvb: (49 commits)
  V4L/DVB (3667b): cpia2: fix function prototype
  V4L/DVB (3702): Make msp3400 routing defines more consistent
  V4L/DVB (3700): Remove obsolete commands from tvp5150.c
  V4L/DVB (3697): More msp3400 and bttv fixes
  V4L/DVB (3696): Previous change for cx2341X boards broke the remote support
  V4L/DVB (3693): Fix msp3400c and bttv stereo/mono/bilingual detection/handling
  V4L/DVB (3692): Keep experimental SLICED_VBI defines under an #if 0
  V4L/DVB (3689): Kconfig: fix VP-3054 Secondary I2C Bus build configuration menu dependencies
  V4L/DVB (3673): Fix budget-av CAM reset
  V4L/DVB (3672): Fix memory leak in dvr open
  V4L/DVB (3671): New module parameter 'tv_standard' (dvb-ttpci driver)
  V4L/DVB (3670): Fix typo in comment
  V4L/DVB (3669): Configurable dma buffer size for saa7146-based budget dvb cards
  V4L/DVB (3653h): Move usb v4l docs into Documentation/video4linux
  V4L/DVB (3667a): Fix SAP + stereo mode at msp3400
  V4L/DVB (3666): Remove trailing newlines
  V4L/DVB (3665): Add new NEC uPD64031A and uPD64083 i2c drivers
  V4L/DVB (3663): Fix msp3400c wait time and better audio mode fallbacks
  V4L/DVB (3662): Don't set msp3400c-non-existent register
  V4L/DVB (3661): Add wm8739 stereo audio ADC i2c driver
  ...

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband:
  IB/ipath: kbuild infrastructure
  IB/ipath: infiniband verbs support
  IB/ipath: misc infiniband code, part 2
  IB/ipath: misc infiniband code, part 1
  IB/ipath: infiniband RC protocol support
  IB/ipath: infiniband UC and UD protocol support
  IB/ipath: infiniband header files
  IB/ipath: layering interfaces used by higher-level driver code
  IB/ipath: support for userspace apps using core driver
  IB/ipath: sysfs and ipathfs support for core driver
  IB/ipath: misc driver support code
  IB/ipath: chip initialisation code, and diag support
  IB/ipath: support for PCI Express devices
  IB/ipath: support for HyperTransport devices
  IB/ipath: core driver header files
  IB/ipath: core device driver

* master.kernel.org:/pub/scm/linux/kernel/git/brodo/pcmcia-2.6: (33 commits)
  [PATCH] pcmcia: declare pccard_iodyn_ops (fix m8xx_pcmcia.c compilation error)
  [PATCH] pcmcia: fix pcmcia_device_remove oops
  [PATCH] pcmcia: Add support for Possio GCC AKA PCMCIA Siemens MC45
  [PATCH] pcmcia: pseudo device handling update
  [PATCH] pcmcia: convert DEV_OK to pcmcia_dev_present
  [PATCH] pcmcia: use bitfield instead of p_state and state
  [PATCH] pcmcia: remove unused p_dev->state flags
  [PATCH] pcmcia: make pcmcia_release_{io,irq} static
  [PATCH] pcmcia: add return value to _config() functions
  [PATCH] pcmcia: remove dev_link_t and client_handle_t indirection
  [PATCH] pcmcia: embed dev_link_t into struct pcmcia_device
  [PATCH] pcmcia: rename pcmcia_device.state
  [PATCH] pcmcia: remove unneeded Vcc pseudo setting
  [PATCH] pcmcia: remove export of pcmcia_release_configuration
  [PATCH] pcmcia: default suspend and resume handling
  [PATCH] pcmcia: convert remaining users of pcmcia_release_io and _irq
  [PATCH] pcmcia: add pcmcia_disable_device
  [PATCH] serial_cs: add Merlin U630 IDs
  [PATCH] pcmcia: AT91RM9200 Compact Flash driver
  [PATCH] pcmcia: socket.functions starts with 1
  ...