We need to ensure that the area size is page aligned so that
remap_area_pte() doesn't increment the address past the end of
the desired area.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Add:
  sys_unshare
  sys_set_robust_list
  sys_get_robust_list
  sys_splice
  sys_arm_sync_file_range
  sys_tee
  sys_vmsplice
  sys_move_pages
  sys_getcpu

Special note about sys_arm_sync_file_range(), which is implemented as:

asmlinkage long sys_arm_sync_file_range(int fd, unsigned int flags,
                                        loff_t offset, loff_t nbytes)
{
        return sys_sync_file_range(fd, offset, nbytes, flags);
}

We can't export sys_sync_file_range() directly on ARM because the
argument list someone picked does not fit in the available registers.
Would be nice if... there was an arch maintainer review mechanism for
new syscalls before they hit the kernel.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  [PATCH] pata_via: Cable detect error
  [PATCH] Fix help text for CONFIG_ATA_PIIX
  [PATCH] initializer entry defined twice in pata_rz1000
  [PATCH] ata: fix platform_device_register_simple() error check
  [PATCH] ahci: do not mangle saved HOST_CAP while resetting controller
  [PATCH] libata: don't initialize sg in ata_exec_internal() if DMA_NONE (take #2)
  [libata] sata_svw: Disable ATAPI DMA on current boards (errata workaround)
  [libata] use kmap_atomic(KM_IRQ0) in SCSI simulator
  [PATCH] ata_piix: use piix_host_stop() in ich_pata_ops
  [PATCH] ata_piix: IDE mode SATA patch for Intel ICH9

On architectures where the atomicity of the bit operations is handled by
external means (ie a separate spinlock to protect concurrent accesses),
just doing a direct assignment on the workqueue data field (as done by
commit 4594bf15) can cause the
assignment to be lost due to lack of serialization with the bitops on
the same word.

So we need to serialize the assignment with the locks on those
architectures (notably older ARM chips, PA-RISC and sparc32).

So rather than using an "unsigned long", let's use "atomic_long_t",
which already has a safe assignment operation (atomic_long_set()) on
such architectures.

This requires that the atomic operations use the same atomicity locks as
the bit operations do, but that is largely the case anyway.  Sparc32
will probably need fixing.

Architectures (including modern ARM with LL/SC) that implement sane
atomic operations for SMP won't see any of this matter.

Cc: Russell King <rmk+lkml@arm.linux.org.uk>
Cc: David Howells <dhowells@redhat.com>
Cc: David Miller <davem@davemloft.com>
Cc: Matthew Wilcox <matthew@wil.cx>
Cc: Linux Arch Maintainers <linux-arch@vger.kernel.org>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Doug Chapman noticed that mincore() will doa "copy_to_user()" of the
result while holding the mmap semaphore for reading, which is a big
no-no.  While a recursive read-lock on a semaphore in the case of a page
fault happens to work, we don't actually allow them due to deadlock
schenarios with writers due to fairness issues.

Doug and Marcel sent in a patch to fix it, but I decided to just rewrite
the mess instead - not just fixing the locking problem, but making the
code smaller and (imho) much easier to understand.

Cc: Doug Chapman <dchapman@redhat.com>
Cc: Marcel Holtmann <holtmann@redhat.com>
Cc: Hugh Dickins <hugh@veritas.com>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

The UDMA66 VIA hardware has no controller side cable detect bits we can
use. This patch minimally fixes the problem by reporting unknown in this
case and using drive side detection.

The old drivers/ide code does some additional tricks but those aren't
appropriate now we are in -rc.

Without this update UDMA66 via controllers run slowly. They don't fail so
it's a borderline call whether this is -rc material or not.
Signed-off-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

> Thanks for clarifying Bill, and sorry Alan. ata_piix does indeed work
> correctly. The help text is a bit confusing:
>
> config ATA_PIIX
>         tristate "Intel PIIX/ICH SATA support"
>         depends on PCI
>         help
>           This option enables support for ICH5/6/7/8 Serial ATA.
>           If PATA support was enabled previously, this enables
>           support for select Intel PIIX/ICH PATA host controllers.

New help text
Signed-off-by: NAlan Cox <alan@redhat.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This removes the extra definition of the .error_handler member
in the pata_rz1000 driver.
Signed-off-by: NIra W. Snyder <kernel@irasnyder.com>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

The return value of platform_device_register_simple() should be checked
by IS_ERR().

Cc: Jeff Garzik <jgarzik@pobox.com>
Acked-by: NAlan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Do not mangle with HOST_CAP while resetting controller.  The code is
there for a historical reason.  The mangling breaks controller feature
detection and 0 PORTS_IMPL workaround code.

This problem was spotted by Manoj Kasichainula.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Cc: Manoj Kasichainula <manoj@io.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Calling sg_init_one() with NULL buf causes oops on certain
configurations.  Don't initialize sg in ata_exec_internal() if
DMA_NONE and make the function complain if @buf is NULL when dma_dir
isn't DMA_NONE.  While at it, fix comment.

The problem is discovered and initial patch was submitted by Arnd
Bergmann.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Cc: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Current Broadcom/Serverworks SATA boards (including Apple K2 SATA)
have problems with ATAPI DMA, so it is disabled.  ATAPI PIO, ATA PIO,
and ATA DMA continue to work just fine.
Acked-by: NAnantha Subramanyam <ananth@broadcom.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

We are inside spin_lock_irqsave().  quoth akpm's debug facility:

 [  231.948000] SCSI device sda: 195371568 512-byte hdwr sectors (100030 MB)
 [  232.232000] ata1.00: configured for UDMA/33
 [  232.404000] WARNING (1) at arch/i386/mm/highmem.c:47 kmap_atomic()
 [  232.404000]  [<c01162e6>] kmap_atomic+0xa9/0x1ab
 [  232.404000]  [<c0242c81>] ata_scsi_rbuf_get+0x1c/0x30
 [  232.404000]  [<c0242caf>] ata_scsi_rbuf_fill+0x1a/0x87
 [  232.404000]  [<c0243ab2>] ata_scsiop_mode_sense+0x0/0x309
 [  232.404000]  [<c01729d5>] end_bio_bh_io_sync+0x0/0x37
 [  232.404000]  [<c02311c6>] scsi_done+0x0/0x16
 [  232.404000]  [<c02311c6>] scsi_done+0x0/0x16
 [  232.404000]  [<c0242dcc>] ata_scsi_simulate+0xb0/0x13f
[...]
Signed-off-by: NJeff Garzik <jeff@garzik.org>

piix_init_one() allocates host private data which should be freed by
piix_host_stop().  ich_pata_ops wasn't converted to piix_host_stop()
while merging, leaking 4 bytes on driver detach.  Fix it.

This was spotted using Kmemleak by Catalin Marinas.
Signed-off-by: NTejun Heo <htejun@gmail.com>
Cc: Catalin Marinas <catalin.marinas@gmail.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

This updated patch adds the Intel ICH9 IDE mode SATA controller DID's.
Signed-off-by: NJason Gaston <jason.d.gaston@intel.com>
Acked-by: NTejun Heo <htejun@gmail.com>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Nobody uses it, but it was still wrong.  Using the macro argument name
'work' meant that when we used 'work' as a member name, that would also
get replaced by the macro argument.
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] cio: css_register_subchannel race.
  [S390] Save prefix register for dump on panic
  [S390] Fix reboot hang
  [S390] Fix reboot hang on LPARs
  [S390] sclp_cpi module license.
  [S390] zcrypt: module unload fixes.
  [S390] Hipersocket multicast queue: make sure outbound handler is called
  [S390] hypfs fixes
  [S390] update default configuration

It has caused more problems than it ever really solved, and is
apparently not getting cleaned up and fixed.  We can put it back when
it's stable and isn't likely to make warning or bug events worse.

In the meantime, enable frame pointers for more readable stack traces.
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Asynchronous probe can release memory of a subchannel before
css_get_ssd_info is called. To fix this call css_get_ssd_info
before registering with driver core.
Signed-off-by: NStefan Bader <shbader@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

The dump tools expect that the saved prefix register points to the
lowcore of the dump cpu. Since we set the prefix register to 0 during
reipl/dump, we have to save the original prefix register. Before we
start the dump program, we copy the original prefix register to the
designated location in the lowcore.
Signed-off-by: NMichael Holzheu <holzheu@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

We use printks after shutting down all other cpus. This is not allowed
and can lead to deadlocks. Therefore the printks have to be removed.
Signed-off-by: NMichael Holzheu <holzheu@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

Reboot hangs on LPARs without diag308 support. The reason for this is,
that before the reboot is done, the channel subsystem is shut down.
During the reset on each possible subchannel a "store subchannel" is
done. This operation can end in a program check interruption, if the
specified subchannel set is not implemented by the hardware. During
the reset, currently we do not have a program check handler, which
leads to the described kernel bug. We install now a new program check
handler for the reboot code to fix this problem.
Signed-off-by: NMichael Holzheu <holzheu@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

sclp_cpi is GPL. Make the module not taint the kernel
Signed-off-by: NChristian Borntraeger <cborntra@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

Add code to reset all queues for a domain and add missing tasklet_kill
call to ap bus module exit code.
Signed-off-by: NRalph Wuerthner <rwuerthn@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

A HiperSocket multicast queue works asynchronously. When sending
buffers, the buffer state change from PRIMED to EMPTY may happen
delayed. Reschedule the checking for changes in the outbound queue,
if there are still PRIMED buffers.
Signed-off-by: NUrsula Braun <braunu@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

Correct typo to make hypfs work on systems that support only diag204
subcode 4 and fix error handling in hypfs_diag_init.
Signed-off-by: NChristian Borntraeger <cborntra@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

At least on PPC, the "op ? op : dma" construct causes a compile failure
because the dma_* is a do{}while(0) macro.

This turns all of them into proper if/else to avoid this problem.
Signed-off-by: NBen Collins <bcollins@ubuntu.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

.. and so the stabilization phase starts.
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

Remove the deferred hooks and all related code as scheduled in
feature-removal-schedule.
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Make fib6_node 'subtree' depend on IPV6_SUBTREES.
Signed-off-by: NKim Nordlund <kim.nordlund@nokia.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NIvan Skytte Jorgensen <isj-sctp@i1.dk>
Signed-off-by: NSridhar Samudrala <sri@us.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NSridhar Samudrala <sri@us.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Currently in SCTP, we maintain a local address list by rebuilding the whole
list from the device list whenever we get a address add/delete event.

This patch fixes it by only adding/deleting the address for which we
receive the event.

Also removed the sctp_local_addr_lock() which is no longer needed as we
now use list_for_each_safe() to traverse this list. This fixes the bugs
in sctp_copy_laddrs_xxx() routines where we do copy_to_user() while
holding this lock.
Signed-off-by: NSridhar Samudrala <sri@us.ibm.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

It should call tcp_free_md5sig_pool() not __tcp_free_md5sig_pool()
so that it does proper refcounting.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

> Relevant standard (RFC 3493) notes:
>
>    The IPV6_UNICAST_HOPS option may be used with getsockopt() to
>    determine the hop limit value that the system will use for subsequent
>    unicast packets sent via that socket.
>
> I don't reckon -1 could be the hop limit value.

-1 means un-initialized.

> IMHO, the value from
> case 1 (if socket is connected to some destination), otherwise case 2
> (if bound to a scope interface) or ultimately the default hop limit
> ought to be returned instead, as it will be most often correct, while
> the current behavior is always wrong, unless setsockopt() has been used
> first. I don't if some people may think doing a route lookup in
> getsockopt might be overly expensive, but at least the two other cases
> should be ok, particularly the last one.

The following patch seems to work for me, but this code has behaved this
way for a while, so don't know if it will break any existing apps.
Signed-off-by: NBrian Haley <brian.haley@hp.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

In a recent patch we introduced invalid return codes which will result in the
opposite of what is intended (i.e. send more packets in face of peculiar
network conditions).

This fixes it by returning ~0 which means not calculated as per
dccp_li_hist_calc_i_mean.
Signed-off-by: NIan McDonald <ian.mcdonald@jandi.co.nz>
Signed-off-by: NArnaldo Carvalho de Melo <acme@mandriva.com>

If we come to node we'd already marked as seen and it's not a part of path
(i.e. we don't have a loop right there), we already know that it isn't a
part of any loop, so we don't need to revisit it.

That speeds the things up if some chain is refered to from several places
and kills O(exp(table size)) worst-case behaviour (without sleeping,
at that, so if you manage to self-LART that way, you are SOL for a long
time)...
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Matches and targets verification is duplicated in normal and compat processing
ways. This patch refactors code in order to remove this.
Signed-off-by: NDmitry Mishin <dim@openvz.org>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

CLUSTERIP, CONNMARK, CONNSECMARK, and connbytes need ip_conntrack or
layer 3 protocol module of nf_conntrack.
Signed-off-by: NYasuyuki Kozakai <yasuyuki.kozakai@toshiba.co.jp>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>