The vdso_per_cpu_data entry in the lowcore structure uses __u32
instead of __u64. If the data page is above 4GB the pointer is
truncated and the kernel crashes.
Reported-by: NMijo Safradin <mijo@linux.vnet.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

Fix regression due to 5a6fe125,
"Do not account for the address space used by hugetlbfs using VM_ACCOUNT"
which added an argument to the function hugetlb_file_setup() but not to
the macro hugetlb_file_setup().
Reported-by: NChris Clayton <chris2553@googlemail.com>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Acked-by: NMel Gorman <mel@csn.ul.ie>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc: Add missing sparsemem.h include
  powerpc/pci: mmap anonymous memory when legacy_mem doesn't exist
  powerpc/cell: Add missing #include for oprofile
  powerpc/ftrace: Fix math to calculate offset in TOC
  powerpc: Don't emulate mr. instructions
  powerpc/fsl-booke: Fix mapping functions to use phys_addr_t
  arch/powerpc: Eliminate double sizeof
  powerpc/cpm2: Fix set interrupt type
  powerpc/83xx: Fix TSEC0 workability on MPC8313E-RDB boards
  powerpc/83xx: Fix missing #{address,size}-cells in mpc8313erdb.dts
  powerpc/83xx: Build breakage for CONFIG_PM but no CONFIG_SUSPEND

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
  sparc64: Fix probe_kernel_{read,write}().
  sparc64: Kill .fixup section bloat.
  sparc64: Don't hook up pcr_ops on spitfire chips.
  sparc64: Call dump_stack() in die_nmi().

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (23 commits)
  bridge: Fix LRO crash with tun
  IPv6: fix to set device name when new IPv6 over IPv6 tunnel device is created.
  gianfar: Fix boot hangs while bringing up gianfar ethernet
  netfilter: xt_sctp: sctp chunk mapping doesn't work
  netfilter: ctnetlink: fix echo if not subscribed to any multicast group
  netfilter: ctnetlink: allow changing NAT sequence adjustment in creation
  netfilter: nf_conntrack_ipv6: don't track ICMPv6 negotiation message
  netfilter: fix tuple inversion for Node information request
  netxen: fix msi-x interrupt handling
  de2104x: force correct order when writing to rx ring
  tun: Fix unicast filter overflow
  drivers/isdn: introduce missing kfree
  drivers/atm: introduce missing kfree
  sunhme: Don't match PCI devices in SBUS probe.
  9p: fix endian issues [attempt 3]
  net_dma: call dmaengine_get only if NET_DMA enabled
  3c509: Fix resume from hibernation for PnP mode.
  sungem: Soft lockup in sungem on Netra AC200 when switching interface up
  RxRPC: Fix a potential NULL dereference
  r8169: Don't update statistics counters when interface is down
  ...

When overcommit is disabled, the core VM accounts for pages used by anonymous
shared, private mappings and special mappings. It keeps track of VMAs that
should be accounted for with VM_ACCOUNT and VMAs that never had a reserve
with VM_NORESERVE.

Overcommit for hugetlbfs is much riskier than overcommit for base pages
due to contiguity requirements. It avoids overcommiting on both shared and
private mappings using reservation counters that are checked and updated
during mmap(). This ensures (within limits) that hugepages exist in the
future when faults occurs or it is too easy to applications to be SIGKILLed.

As hugetlbfs makes its own reservations of a different unit to the base page
size, VM_ACCOUNT should never be set. Even if the units were correct, we would
double account for the usage in the core VM and hugetlbfs. VM_NORESERVE may
be set because an application can request no reserves be made for hugetlbfs
at the risk of getting killed later.

With commit fc8744ad, VM_NORESERVE and
VM_ACCOUNT are getting unconditionally set for hugetlbfs-backed mappings. This
breaks the accounting for both the core VM and hugetlbfs, can trigger an
OOM storm when hugepage pools are too small lockups and corrupted counters
otherwise are used. This patch brings hugetlbfs more in line with how the
core VM treats VM_NORESERVE but prevents VM_ACCOUNT being set.
Signed-off-by: NMel Gorman <mel@csn.ul.ie>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

arch/powerpc/platforms/pseries/hotplug-memory.c uses
remove_section_mapping() but doesn't include sparsemem.h which defines
it.  This can cause compilation fails for some configs.
Signed-off-by: NMichael Neuling <mikey@neuling.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

The new legacy_mem file in sysfs is causing problems with X on machines
that don't support legacy memory access. The way I initially implemented
it, we would fail with -ENXIO when trying to mmap it, thus exposing to
X that we do support the API but there is no legacy memory.

Unfortunately, X poor error handling is causing it to fail to start when
it gets this error.

This implements a workaround hack that instead maps anonymous memory
instead (using shmem if VM_SHARED is set, just like /dev/zero does).
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

arch/powerpc/oprofile/cell/spu_profiler.c is missing a asm/time.h
include which is required for ppc_proc_freq.  This can cause compile
failures for some config combinations.
Signed-off-by: NMichael Neuling <mikey@neuling.org>
Acked-by: NArnd Bergmann <arnd@arndb.de>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Impact: fix dynamic ftrace with large modules in PPC64

The math to calculate the offset into the TOC that is taken from reading
the trampoline is incorrect. The bottom half of the offset is a signed
extended short. The current code was using an OR to create the offset
when it should have been using an addition.
Signed-off-by: NSteven Rostedt <srostedt@redhat.com>
Acked-by: NGeoff Levand <geoffrey.levand@am.sony.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Currently emulate_step() emulates mr. instructions without updating cr0
and this can be disastrous. Don't emulate mr.

This bug has been around for a while, but I am not sure if its a worthy
-stable candidate. I'll leave it to Ben do decide.
Signed-off-by: NAnanth N Mavinakayanahalli <ananth@in.ibm.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Fixed v_mapped_by_tlbcam() and p_mapped_by_tlbcam() to use phys_addr_t
instead of unsigned long.  In 36-bit physical mode we really need these
functions to deal with phys_addr_t when trying to match a physical
address or when returning one.
Signed-off-by: NKumar Gala <galak@kernel.crashing.org>

> Kernel BUG at drivers/net/tun.c:444
> invalid opcode: 0000 [1] SMP
> last sysfs file: /class/net/lo/ifindex
> CPU 0
> Modules linked in: tun ipt_MASQUERADE iptable_nat ip_nat xt_state ip_conntrack
> nfnetlink ipt_REJECT xt_tcpudp iptable_filter d
> Pid: 6912, comm: qemu-kvm Tainted: G      2.6.18-128.el5 #1
> RIP: 0010:[<ffffffff886f57b0>]  [<ffffffff886f57b0>]
> :tun:tun_chr_readv+0x2b1/0x3a6
> RSP: 0018:ffff8102202c5e48  EFLAGS: 00010246
> RAX: 0000000000000000 RBX: ffff8102202c5e98 RCX: 0000000004010000
> RDX: ffff810227063680 RSI: ffff8102202c5e9e RDI: ffff8102202c5e92
> RBP: 0000000000010ff6 R08: 0000000000000000 R09: 0000000000000001
> R10: ffff8102202c5e94 R11: 0000000000000202 R12: ffff8102275357c0
> R13: ffff81022755e500 R14: 0000000000000000 R15: ffff8102202c5ef8
> FS:  00002ae4398db980(0000) GS:ffffffff803ac000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> CR2: 00002ae4ab514000 CR3: 0000000221344000 CR4: 00000000000026e0
> Process qemu-kvm (pid: 6912, threadinfo ffff8102202c4000, task
> ffff81022e58d820)
> Stack:  00000000498735cb ffff810229d1a3c0 0000000000000000 ffff81022e58d820
>  ffffffff8008a461 ffff81022755e528 ffff81022755e528 ffffffff8009f925
>  000005ea05ea0000 ffff8102209d0000 00001051143e1600 ffffffff8003c00e
> Call Trace:
>  [<ffffffff8008a461>] default_wake_function+0x0/0xe
>  [<ffffffff8009f925>] enqueue_hrtimer+0x55/0x70
>  [<ffffffff8003c00e>] hrtimer_start+0xbc/0xce
>  [<ffffffff886f58bf>] :tun:tun_chr_read+0x1a/0x1f
>  [<ffffffff8000b3f3>] vfs_read+0xcb/0x171
>  [<ffffffff800117d4>] sys_read+0x45/0x6e
>  [<ffffffff8005d116>] system_call+0x7e/0x83
>
>
> Code: 0f 0b 68 40 62 6f 88 c2 bc 01 f6 42 0a 08 74 0c 80 4c 24 41
> RIP  [<ffffffff886f57b0>] :tun:tun_chr_readv+0x2b1/0x3a6
>  RSP <ffff8102202c5e48>
>  <0>Kernel panic - not syncing: Fatal exception

This crashed when an LRO packet generated by bnx2x reached a
tun device through the bridge.  We're supposed to drop it at
the bridge.  However, because the check was placed in br_forward
instead of __br_forward, it's only effective if we are sending
the packet through a single port.

This patch fixes it by moving the check into __br_forward.
Signed-off-by: NHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When the user creates IPv6 over IPv6 tunnel, the device name created
by the kernel isn't set to t->parm.name, which is referred as the
result of ioctl().
Signed-off-by: NNoriaki TAKAMIYA <takamiya@po.ntts.co.jp>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Ira Snyder found that commit 8c7396ae
"gianfar: Merge Tx and Rx interrupt for scheduling clean up ring" can
cause hangs. It's because there was removed clearing of interrupts in
gfar_schedule_cleanup() (which is called by an interrupt handler) in
case when netif scheduling has been disabled. This patch brings back
this action and a comment.
Reported-by: NIra Snyder <iws@ovro.caltech.edu>
Reported-by: NPeter Korsgaard <jacmet@sunsite.dk>
Bisected-by: NIra Snyder <iws@ovro.caltech.edu>
Tested-by: NPeter Korsgaard <jacmet@sunsite.dk>
Tested-by: NIra Snyder <iws@ovro.caltech.edu>
Signed-off-by: NJarek Poplawski <jarkao2@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

When user tries to map all chunks given in argument, kernel
works on a copy of the chunkmap, but at the end it doesn't
check the copy, but the orginal one.
Signed-off-by: NQu Haoran <haoran.qu@6wind.com>
Signed-off-by: NNicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch fixes echoing if the socket that has sent the request to
create/update/delete an entry is not subscribed to any multicast
group. With the current code, ctnetlink would not send the echo
message via unicast as nfnetlink_send() would be skip.
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch fixes an inconsistency in the current ctnetlink code
since NAT sequence adjustment bit can only be updated but not set
in the conntrack entry creation.

This patch is used by conntrackd to successfully recover newly
created entries that represent connections with helpers and NAT
payload mangling.
Signed-off-by: NPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch removes connection tracking handling for ICMPv6 messages
related to Stateless Address Autoconfiguration, MLD, and MLDv2. They
can not be tracked because they are massively using multicast (on
pre-defined address). But they are not invalid and should not be
detected as such.
Signed-off-by: NEric Leblond <eric@inl.fr>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The patch fixes a typo in the inverse mapping of Node Information
request. Following draft-ietf-ipngwg-icmp-name-lookups-09, "Querier"
sends a type 139 (ICMPV6_NI_QUERY) packet to "Responder" which answer
with a type 140 (ICMPV6_NI_REPLY) packet.
Signed-off-by: NEric Leblond <eric@inl.fr>
Signed-off-by: NPatrick McHardy <kaber@trash.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable:
  Btrfs: don't use spin_is_contended

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: Storage: Update unusual_devs entry for Datafab KECF-USB
  USB: Correct Makefile to make isp1760 buildable
  USB: option: New mobile broadband modems to be supported
  USB: two more usb ids for ti_usb_3410_5052
  USB: ftdi_sio: unlock_kernel() on error in set_serial_info()
  USB: usb-storage: add Pentax to the bad-vendor list
  USB: ftdi_sio: add support for the NDI Polaris system
  USB: usb-serial: fix the aircable_init failure path
  USB: usb-storage: remove WARN from last-sector hacks
  Revert USB: option: add Pantech cards
  USB: cdc-acm.c: remove duplicate lines for MTK gps support
  USB: fsl_qe_udc: Fix stalled TX requests bug
  USB: fsl_qe_udc: Fix muram corruption by disabled endpoints
  USB: fsl_qe_udc: Fix disconnects reporting during bus reset
  USB: fsl_qe_udc: Fix QE USB controller initialization
  USB: fsl_qe_udc: Fix recursive locking bug in ch9getstatus()
  USB: fsl_qe_udc: Fix oops on QE UDC probe failure

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6:
  Staging: panel: fix lcd panel driver build failure
  Staging: android: fix up units in timed_gpio
  Staging: android: ram_console: Disable ECC when early init is enabled and validate buffer size
  Staging: at76_usb: Add support for OQO Model 01+
  Staging: at76_usb: fix bugs introduced by "Staging: at76_usb: cleanup dma on stack issues"
  Revert Staging: at76_usb: update drivers/staging/at76_usb w/ mac80211 port

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq:
  [CPUFREQ] powernow-k8: Get transition latency from ACPI _PSS table
  [CPUFREQ] Make ignore_nice_load setting of ondemand work as expected.

Btrfs was using spin_is_contended to see if it should drop locks before
doing extent allocations during btrfs_search_slot.  The idea was to avoid
expensive searches in the tree unless the lock was actually contended.

But, spin_is_contended is specific to the ticket spinlocks on x86, so this
is causing compile errors everywhere else.

In practice, the contention could easily appear some time after we started
doing the extent allocation, and it makes more sense to always drop the lock
instead.
Signed-off-by: NChris Mason <chris.mason@oracle.com>

* Fix build break for lcd panel driver.

Signed-off-by : Sachin Sant <sachinp@in.ibm.com>
Cc: Willy Tarreau <w@1wt.eu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The last build fix I did messed up the units of the sysfs file.

This puts them back to be milliseconds, like they originally were.


Thanks to Juha Motorsportcom for pointing this out.
Reported-by: NJuha Motorsportcom <juha_motorsportcom@luukku.com>
Cc: Mike Lockwood <lockwood@android.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NArve Hjønnevåg <arve@android.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Add USB device ID for OQO 01+'s internal wireless LAN

An OQO employee mentions the chip's true identity here:-
   ftp://ftp.oqo.com/unsupported/linux/OQOLinux.htmlSigned-off-by: NJamie Lentin <jm@lentin.co.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Tracking down the firmware loading problem led to this commit.

$ git bisect bad
0d1d1424 is first bad commit
commit 0d1d1424
Author: Oliver Neukum <oliver@neukum.org>
Date:   Thu Dec 18 13:16:40 2008 +0100

    Staging: at76_usb: cleanup dma on stack issues

    - no DMA on stack
    - cleanup unclear endianness issue
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

:040000 040000 c4fee9ea0fef25926229d810d19dc2f89cca9401
8b165a35d16280d2413b2700a6080ef290ca1009 M	drivers

The "no DMA on stack" conversion was incomplete with respect to
updating the arguments passed to usb_control_msg.  The value 40 is
hardcoded as it was prior to conversion.

The driver can now load firmware, but is not fully functional.
Signed-off-by: NJason Andryuk <jandryuk@gmail.com>
Cc: John W. Linville <linville@tuxdriver.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Reverts 02227c28
(Had to be done by hand due to other patches that had come after this.)

Turns out that we don't want the mac80211 port of this driver just yet, as
there is a different driver working on adding this support.

So keep things old and different for now.

This is being reverted at the request of the linux-wireless developers.

Cc: Kalle Valo <kalle.valo@iki.fi>
Cc: John W. Linville <linville@tuxdriver.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This device suffers from the off-by-one error when reporting the capacity,
so add US_FL_FIX_CAPACITY to the existing entry.
Signed-off-by: NNick Holloway <Nick.Holloway@pyrites.org.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NIvan Kuten <ivan.kuten@promwad.com>
Signed-off-by: NMichael Hennerich <michael.hennerich@analog.com>
Signed-off-by: NBryan Wu <cooloney@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

- New Novatel and Dell mobile broadband modem products added
 - Dell pid variables used in stead of numerical PIDs for known
   products
Signed-off-by: NDirk De Schepper <ddeschepper@nvtl.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NMatthias Urlichs <matthias@urlichs.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch adds device IDs and balances the counts to make the
hot ID additioning mechanism work.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Cc: stable <stable@kernel.org>
Cc: Chris Adams <cmadams@hiwaay.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

There was one error path where unlock_kernel() wasn't called.

This was found with a code checker (http://repo.or.cz/w/smatch.git/)
Compile tested only, sorry.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1202) adds Pentax to usb-storage's list of bad vendors
whose devices always need the CAPACITY_HEURISTICS flag.  This is in
addition to the existing entries: Nokia, Nikon, and Motorola.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Tested-by: NVirgo Pärna <virgo.parna@mail.ee>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Add support for the NDI Polaris system *http://www.ndigital.com/).

Cc: Ian Abbott <abbotti@mev.co.uk>
Cc: Oliver Neukum <oneukum@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The failure path of aircable_init is wrong, fix the order of (goto) labels.
Signed-off-by: NDave Young <hidave.darkstar@gmail.com>
Acked-by: NNaranjo Manuel Francisco <naranjo.manuel@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1201) removes the WARN() from the last-sector hacks in
usb-storage, thereby making the code match the version now in
.27-stable and .28-stable.  The WARN() isn't needed, since there is no
longer any intention of assuming that all storage devices have an even
number of sectors, and it annoys users for no good reason.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>