I found an exploit in current kernel.
Currently, there is no range check about mmapping "/mem" node in
spufs. Thus, an application can access privilege memory region.

In case this kernel already worked on a public server, I send this
information only here.
If there are such servers in somewhere, please replace it, ASAP.
Signed-off-by: NMasato Noguchi <Masato.Noguchi@jp.sony.com>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

For SCHED_RR tasks we can do some really trivial timeslicing.  Basically
we fire up a time for every scheduler tick that searches for a higher
or same priority thread that is on the runqueue and if there is one
context switches to it.  Because we can't lock spus from timer context
we actually run this from a delayed runqueue instead of a timer.

A nice optimization would be to skip the actual priority bitmap search
when there are less contexts than physical spus available.  To implement
this I need a so far unpublished patch from Andre, and it will be added
after we have that patch in.

Note that right now we only do the time slicing for SCHED_RR tasks.
The code would work for SCHED_OTHER tasks aswell, but their prio
value is defered from the one the PPU thread has at time of spu_run,
and using this for spu scheduling decisions would make the code very
unfair.  SCHED_OTHER support will be enabled once we the spu scheduler
knows how to calculcate cpu_context.prio (very soon)
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

use DECLARE_BITMAP in the spu scheduler instead of reimplementing it.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

If we start a spu context with realtime priority we want it to run
immediately and not wait until some other lower priority thread has
finished.  Try to find a suitable victim and use it's spu in this
case.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

Give spu_yield a kerneldoc comment and remove the old comment
documenting spu_activate, spu_deactive and spu_yield as all of them
now have descriptive kerneldoc comments of their own.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

If we call spu_remove_from_active_list that spu is always guaranteed
to be on the active list and in runnable state, so we can simply
do a list_del to remove it and unconditionally take the was_active
codepath.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

There is no need to directly wake up contexts in spu_activate when
called from spu_run, so add a flag to surpress this wakeup.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

This is the biggest patch in this series, and it reworks the guts of
the spu scheduler runqueue mechanism:

 - instead of embedding a waitqueue in the runqueue there is now a
   simple doubly-linked list, the actual wakeups happen by reusing
   the stop_wq in the spu context (maybe we should rename it one day)
 - spu_free and spu_prio_wakeup are merged into a single spu_reschedule
   function
 - various functionality is split out into small helpers, and kerneldoc
   comments are added in various places to document what's going on.
 - spu_activate is rewritten into a tight loop by removing test for
   various impossible conditions and using the infrastructure in this
   patch.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

It doesn't make any sense to have a priority field in the physical spu
structure.  Move it into the spu context instead.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

Various cleanups in code surrounding the state semaphore:

 - inline spu_acquire/spu_release
 - cleanup spu_acquire_* and add kerneldoc comments to these functions
 - remove spu_release_exclusive and replace it with spu_release
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

The r/w semaphore to lock the spus was overkill and can be replaced
with a mutex to make it faster, simpler and easier to debug.  It also
helps to allow making most spufs interruptible in future patches.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

Various cleanups to sched.c that don't change the global control flow:

 - add kerneldoc comments to various functions
 - add spu_ prefixes to various functions
 - add/remove context from the runqueue in bind/unbind_context as
   it's part of the logical operation
 - add a call to put_active_spu to spu_unbind_contex as it's logically
   part of the unbind operation
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

Only bind_context/unbind_context change the spu context state.  Thus
we can move all assignents of SPU_STATE_RUNNABLE into bind_context,
which parallels the unbind side aswell.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

unbind_context already sets the context state to SPU_STATE_SAVED, thus
the spu_deactivate callers don't need to do it again.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

Remove the empty last line in arch/powerpc/platforms/cell/spufs/run.c.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

Remove the SPU_CONTEXT_PREEMPT define.  It's unused and won't be used
in this form after the scheduler rework.
Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>

It looks like we've had some serious bitrot there mostly due to tracking
of address_space's of mmap'ed files getting out of sync with the actual
mmap code. The mfc, mss and psmap were not tracked properly and thus
not invalidated on context switches (oops !)

I also removed the various file->f_mapping = inode->i_mapping;
assignments that were done in the other open() routines since that
is already done for us by __dentry_open.

One improvement we might want to do later is to assign the various
ctx-> fields at mmap time instead of file open/close time so that we
don't call unmap_mapping_range() on thing that have not been mmap'ed

Finally, I added some smp_wmb's after assigning the ctx-> fields to make
sure they are visible to other CPUs. I don't think this is really
necessary as I suspect locking in the fs layer will make that happen
anyway but better safe than sorry.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Struct page are no longer needed for SPUs, so let's not create them
on PS3 anymore.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

This patch removes the need for struct page for SPE local store
and registers from spufs. It also makes the locking much more
obvious and no longer relying on the truncate logic black magic
for protecting against races between unmap_mapping_range() and
new pages faulted in. It does so by switching to a nopfn() handler
and using the new vm_insert_pfn() to setup the PTEs itself while
holding a lock on the SPE.

The nice thing is that this patch actually removes a lot more code
than it adds :-)
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

The efika platform used three files efika-pci.c efika-setup.c and
a 2 line efika.h to link the two. The total of code in those is
really not much and therefore, I think they're better merged
in a single file.

There is absolutely _no_code_change_ at all, just merged the files.
Signed-off-by: NSylvain Munaut <tnt@246tNt.com>
Acked-by: NGrant Likely <grant.likely@secretlab.ca>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Signed-off-by: NSylvain Munaut <tnt@246tNt.com>
Acked-by: NGrant Likely <grant.likely@secretlab.ca>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Now that the device tree has the good properties, we can
remove all the efika_init code by a single call to common code.

While we're modifying that file, a few whitespaces/alignement/typo
fixes are made (nothing significant).
Signed-off-by: NSylvain Munaut <tnt@246tNt.com>
Acked-by: NGrant Likely <grant.likely@secretlab.ca>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

The 52xx was put before CHRP to allow EFIKA to be recognized
properly. Now the efika tree is fixed up in prom_init so
no need for this ugly hack. So we restore the 'normal'
order.
Signed-off-by: NSylvain Munaut <tnt@246tNt.com>
Acked-by: NGrant Likely <grant.likely@secretlab.ca>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

We make the efika device tree compliant with the defined bindings
(at least compliant enough). This is mostly done by mangling
the device_type and compatible properties, but also adding
some missing bits.
Signed-off-by: NSylvain Munaut <tnt@246tNt.com>
Acked-by: NGrant Likely <grant.likely@secretlab.ca>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Much needed refinement of mpc5200 device tree binding specifications.

Short list:
- drop mpc52xx designator; only two supported chips exist, 5200 and 5200b.
  It's premature to refer to them as '52xx'.
- Specify optional 'model' and 'revision' properties in the soc5200 node
- Specify reqiured 'cell-index' property to identify between multiple SOC
  devices of the same type.  (Useful for arbitrating shared register access)
- Specify optional 'port-number' property for adjusting the logical serial
  port assignments.
- Specify optional 'has-wdt' property for gpt0 node.
- Add system-frequency property to soc5200 node
Signed-off-by: NGrant Likely <grant.likely@secretlab.ca>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Signed-off-by: NGrant Likely <grant.likely@secretlab.ca>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

This rids us of a warning.
Signed-off-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Signed-off-by: NStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

This patch adds support for the AMCC Taishan PPC440GX evaluation
board.

This is still an arch/ppc port. I'm aware that the move of
4xx to arch/powerpc is making good progress right now. So this
patch is mainly intended to make the Taishan support available
for the community right now.
Signed-off-by: NStefan Roese <sr@denx.de>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

The recent vDSO consolidation patches broke powerpc due to a mistake
in the definition of MAXPAGES constants. This fixes it by moving to
a dynamically allocated array of pages instead as I don't like much
hard coded size limits. Also move the vdso initialisation to an initcall
since it doesn't really need to be done -that- early.

Applogies for not catching the breakage earlier, Roland _did_ CC me on
his patches a while ago, I got busy with other things and forgot to test
them.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

/proc/pmu/info contains AC Power: 0 when booting without battery.
Force AC Power, it will be updated whenever the battery state changes.
Signed-off-by: NOlaf Hering <olaf@aepfle.de>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

libata calls pci_request_regions to claim PCI BAR 0 - 5
pci_request_regions fails if one of the regions cant be claimed.
bar 5 has start == 0,  __request_resource will fail.

Tested on a p630 in SMP mode with pata_sl82c105

 00:03.1 IDE interface: Symphony Labs SL82c105 (rev 05) (prog-if 8f [Master SecP SecO PriP PriO])
         Control: I/O+ Mem- BusMaster- SpecCycle- MemWINV- VGASnoop- ParErr+ Stepping- SERR+ FastB2B-
         Status: Cap- 66MHz- UDF- FastB2B+ ParErr- DEVSEL=medium >TAbort- <TAbort- <MAbort- >SERR- <PERR-
         Interrupt: pin A routed to IRQ 86
         Region 0: I/O ports at 3fd3000f000 [size=8]
         Region 1: I/O ports at 3fd3000f010 [size=4]
         Region 2: I/O ports at 3fd3000f020 [size=8]
         Region 3: I/O ports at 3fd3000f030 [size=4]
         Region 4: I/O ports at 3fd3000f040 [size=16]
         Region 5: I/O ports at 3fd30000000 [size=16]
 00: ad 10 05 01 41 01 80 02 05 8f 01 01 08 48 80 00
 10: 01 f0 00 00 11 f0 00 00 21 f0 00 00 31 f0 00 00
 20: 41 f0 00 00 01 00 00 00 00 00 00 00 00 00 00 00
 30: 00 00 00 00 00 00 00 00 00 00 00 00 56 01 02 28
 40: b3 08 ff 00 09 09 00 00 09 09 00 00 09 09 00 00
 50: 09 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 70: 00 00 00 00 00 00 00 00 00 00 00 00 ff 00 00 00
 80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 a0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 c0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

 name             "ide"
 linux,phandle    00d5cdc0 (14011840)
 assigned-addresses 81001910 00000000 0000f000 00000000 00000008 81001914
                  00000000 0000f010 00000000 00000004 81001918 00000000
                  0000f020 00000000 00000008 8100191c 00000000 0000f030
                  00000000 00000004 81001920 00000000 0000f040 00000000
                  00000010 81001924 00000000 00000000 00000000 00000010
 interrupts       00000003
 built-in
 #size-cells      00000000
 #address-cells   00000001
 device_type      "ide"
 reg              00001900 00000000 00000000 00000000 00000000
                  41001910 00000000 00000000 00000000 00000008
                  41001914 00000000 00000000 00000000 00000004
                  41001918 00000000 00000000 00000000 00000008
                  4100191c 00000000 00000000 00000000 00000004
                  41001920 00000000 00000000 00000000 00000010
                  41001924 00000000 00000000 00000000 00000010
 compatible       "pci10ad,105"
                  "pciclass,01018f"
 ibm,fw-slot-number 00000000
 fast-back-to-back
 devsel-speed     00000001
 max-latency      00000028 (40)
 min-grant        00000002
 class-code       0001018f (65935)
 revision-id      00000005
 device-id        00000105 (261)
 vendor-id        000010ad (4269)
 ibm,loc-code     "U0.1-P1/Q6"
Signed-off-by: NOlaf Hering <olaf@aepfle.de>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Move all the initialized variables to bss.
Mark a version string as const.
Signed-off-by: NOlaf Hering <olaf@aepfle.de>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

During ppc64+ppc merge virtual DMA code for floppy driver was not
ported.  This patch restores virtual DMA support for floppy in new
powerpc target.

It is necessary at least on Pegasos and AmigaOne machines for the
floppy drive to function.  ISA DMA controller works incorrectly there
due to its addressing limitations.

Virtual DMA mode is activated by floppy=nodma option passed to the
kernel (or module).  There's no automatic switch like on i386.
Signed-off-by: NPavel Fedin <sonic_amiga@rambler.ru>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Disabling IRQ is required only in invalidation.  This changes
"spin_lock_irqsave" to "spin_lock" in other ops.
Signed-off-by: NKou Ishizaki <kou.ishizaki@toshiba.co.jp>
Signed-off-by: NAkira Iguchi <akira2.iguchi@toshiba.co.jp>
Acked-by: NArnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

ARCH=powerpc should not use the ghastly un-multiplatformable tangle of
includes that starts with asm-ppc/ibm4xx.h.  This patch removes a
compile-breaking include of it from head_44x.S.
Signed-off-by: NDavid Gibson <dwg@au1.ibm.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC]: Re-export saved_command_line to modules.
  [SPARC64]: Increase command line size to 2048 like other arches.
  [SPARC64]: We do not need ZONE_DMA.

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (25 commits)
  [XFRM]: Fix OOPSes in xfrm_audit_log().
  [TCP]: cleanup of htcp (resend)
  [TCP]: Use read mostly for CUBIC parameters.
  [NETFILTER]: nf_conntrack_tcp: make sysctl variables static
  [NETFILTER]: ip6t_mh: drop piggyback payload packet on MH packets
  [NETFILTER]: Fix whitespace errors
  [NETFILTER]: Kconfig: improve dependency handling
  [NETFILTER]: xt_mac/xt_CLASSIFY: use IPv6 hook names for IPv6 registration
  [NETFILTER]: nf_conntrack: change nf_conntrack_l[34]proto_unregister to void
  [NETFILTER]: nf_conntrack: properly use RCU for nf_conntrack_destroyed callback
  [NETFILTER]: ip_conntrack: properly use RCU for ip_conntrack_destroyed callback
  [NETFILTER]: nf_conntrack: fix invalid conntrack statistics RCU assumption
  [NETFILTER]: ip_conntrack: fix invalid conntrack statistics RCU assumption
  [NETFILTER]: nf_conntrack: properly use RCU API for nf_ct_protos/nf_ct_l3protos arrays
  [NETFILTER]: ip_conntrack: properly use RCU API for ip_ct_protos array
  [NETFILTER]: nf_nat: properly use RCU API for nf_nat_protos array
  [NETFILTER]: ip_nat: properly use RCU API for ip_nat_protos array
  [NETFILTER]: nf_log: minor cleanups
  [NETFILTER]: nf_log: switch logger registration/unregistration to mutex
  [NETFILTER]: nf_log: make nf_log_unregister_pf return void
  ...

This reverts some bogosity from the dynamic command-line
changes made on sparc32 and sparc64.

Drivers such as drivers/sbus/char/openprom.c reference
saved_command_line, and can be modular.

The boot_command_line is __initdata, yet the dynamic command-line
changes add modular exports of that symbol, obviously wrong.
Signed-off-by: NDavid S. Miller <davem@davemloft.net>