fix memory corruption and crash due to mis-sized grant table.

A PV OS has two grant table data structures: the grant table itself
and a free list.  The free list is composed of an array of pages,
which grow dynamically as the guest OS requires more grants.  While
the grant table contains 8-byte entries, the free list contains 4-byte
entries.  So we have half as many pages in the free list than in the
grant table.

There was a bug in the free list allocation code. The free list was
indexed as if it was the same size as the grant table.  But it's only
half as large.  So memory got corrupted, and I was seeing crashes in
the slab allocator later on.

Taken from:

  http://xenbits.xensource.com/linux-2.6.18-xen.hg?rev/4018c0da3360Signed-off-by: NMichael Abd-El-Malek <mabdelmalek@cmu.edu>
Signed-off-by: NMark McLoughlin <markmc@redhat.com>
Signed-off-by: NJeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

25-rc* stopped working with CONFIG_X86_VSMP on vSMP machines.

Looks like the vsmp irq ops got accidentally removed during merge of x86_64
pvops in 2.6.25. -- commit 6abcd98f removed
vsmp irq ops.

Tested with both CONFIG_X86_VSMP and without CONFIG_X86_VSMP, on vSMP and non
vSMP x86_64 machines.

Please apply.
Signed-off-by: NRavikiran Thirumalai <kiran@scalex86.org>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

right now if there's no CPU support for nmi_watchdog=2 we'll just
refuse it silently.

print a useful warning.
Signed-off-by: NIngo Molnar <mingo@elte.hu>

implement nmi_watchdog=2 on this class of CPUs:

  cpu family      : 15
  model           : 6
  model name      : Intel(R) Pentium(R) D CPU 3.00GHz

the watchdog's ->setup() method is safe anyway, so if the CPU
cannot support it we'll bail out safely.
Signed-off-by: NIngo Molnar <mingo@elte.hu>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6:
  selinux: prevent rentry into the FS

This avoids using wrmsr on MSR_IA32_DEBUGCTLMSR when it's not needed.
No wrmsr ever needs to be done if noone has ever used block stepping.

Without this change, using ptrace on 2.6.25 on an x86 KVM guest
will tickle KVM's missing support for the MSR and crash the guest
kernel.  Though host KVM is the buggy one, this makes for a regression
in the guest behavior from 2.6.24->2.6.25 that we can easily avoid.

I also corrected some bad whitespace.
Signed-off-by: NRoland McGrath <roland@redhat.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: appletouch - add product IDs for the 4th generation MacBooks

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] Fix MPC5200 (not B!) device tree so FEC ethernet works
  [POWERPC] mpc5200: Amalgamated DTS fixes and updates
  [POWERPC] Fix rtas_flash procfs interface
  [POWERPC] Fix deadlock with mmu_hash_lock in hash_page_sync
  [POWERPC] Fix iSeries hard irq enabling regression
  [POWERPC] Fix CPM2 SCC1 clock initialization.
  [POWERPC] Fix defconfigs so we dont set both GENRTC and RTCLIB
  [POWERPC] fsldma: Use compatiable binding as spec
  [POWERPC] sata_fsl: reduce compatibility to fsl,pq-sata
  [POWERPC] 83xx: enable usb in 837x rdb and 83xx defconfigs
  [POWERPC] 83xx: Fix wrong USB phy type in mpc837xrdb dts

Signed-off-by: NSven Schnelle <svens@stackframe.org>
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NSven Schnelle <svens@stackframe.org>
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The loop block driver is careful to mask __GFP_IO|__GFP_FS out of its
mapping_gfp_mask, to avoid hangs under memory pressure.  But nowadays
it uses splice, usually going through __generic_file_splice_read.  That
must use mapping_gfp_mask instead of GFP_KERNEL to avoid those hangs.
Signed-off-by: NHugh Dickins <hugh@veritas.com>
Cc: Jens Axboe <jens.axboe@oracle.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

BUG fix.  Keep us from re-entering the fs when we aren't supposed to.

See discussion at
http://marc.info/?t=120716967100004&r=1&w=2Signed-off-by: NJosef Bacik <jbacik@redhat.com>
Acked-by: NStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: NJames Morris <jmorris@namei.org>

This gets the FEC ethernet driver working again on the lite5200
platform.

The FEC driver is also compatible with the MPC5200, not only with the
MPC5200B, so this adds a suitable entry to the driver's match list.
Furthermore this adds the settings for the PHY in the dts file for the
Lite5200.  Note, that this is not exactly the same as in the
Lite5200B, because the PHY is located at f0003000:01 for the 5200, and
at :00 for the 5200B.  This was tested on a Lite5200 and a Lite5200B,
both booted a kernel via tftp and mounted the root via nfs
successfully.
Signed-off-by: NRené Bürgel <r.buergel@unicontrol.de>
Acked-by: NGrant Likely <grant.likely@secretlab.ca>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

DTS updates that fix booting problems on mpc5200-based boards:
- change to ethernet reg property
- addition of mdio and phy nodes
- removal of pci node (Motion-Pro board)

Other DTS updates:
- update i2c device tree nodes
- add lpb bus node and flash device (without partitions defined)
- add rtc i2c nodes
Signed-off-by: NMarian Balakowicz <m8@semihalf.com>
Acked-by: NGrant Likely <grant.likely@secretlab.ca>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

Handling of the proc_dir_entry->count was changed in 2.6.24-rc5.
After this change, the default value for pde->count is 1 and not 0 as
before.  Therefore, if we want to check whether our procfs file is
already opened (already in use), we have to check if pde->count is
greater than 2 rather than 1.
Signed-off-by: NMaxim Shchetynin <maxim@de.ibm.com>
Signed-off-by: NJens Osterkamp <jens@de.ibm.com>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

hash_page_sync() takes and releases the low level mmu hash
lock in order to sync with other processors disposing of page
tables.  Because that lock can be needed to service hash misses
triggered by interrupt handlers, taking it must be done with
interrupts off.  However, hash_page_sync() appears to be called
with interrupts enabled, thus causing occasional deadlocks.

We fix it by making sure hash_page_sync() masks interrupts while
holding the lock.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

A subtle bug sneaked into iSeries recently.  On this platform, we must
not normally clear MSR:EE (the hardware external interrupt enable)
except for short periods of time.  Taking an interrupt while
soft-disabled doesn't cause us to clear it for example.

The iSeries kernel expects to mostly run with MSR:EE enabled at all
times except in a few exception entry/exit code paths.  Thus
local_irq_enable() doesn't check if it needs to hard-enable as it
expects this to be unnecessary on iSeries.

However, hard_irq_disable() _does_ cause MSR:EE to be cleared,
including on iSeries.  A call to it was recently added to the
context switch code, thus causing interrupts to become disabled
for a long periods of time, causing the iSeries watchdog to kick
in under some circumstances and other nasty things.

This patch fixes it by making local_irq_enable() properly re-enable
MSR:EE on iSeries.  It basically removes a return statement here
to make iSeries use the same code path as everybody else.  That does
mean that we might occasionally get spurious decrementer interrupts
but I don't think that matters.

Another option would have been to make hard_irq_disable() a nop
on iSeries but I didn't like it much, in case we have good reasons
to hard-disable.

Part of the patch is fixes to make sure the hard_enabled PACA field
is properly set on iSeries as it used not to be before, since it
was mostly unused.
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NPaul Mackerras <paulus@samba.org>

A missing break statement in a switch caused cpm2_clk_setup() to initialize
SCC2 instead of SCC1.
Signed-off-by: NLaurent Pinchart <laurentp@cse-semaphore.com>
Signed-off-by: NKumar Gala <galak@kernel.crashing.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: ohci: fix 2 timers to fire at jiffies + 1s
  USB: Allow initialization of broken keyspan serial adapters.
  USB: fix bug in sg initialization in usbtest
  USB: serial: fix regression in Visor/Palm OS module for kernels >= 2.6.24
  USB: cp2101: Add identifiers for the Telegesys ETRX2USB
  USB: serial: ti_usb_3410_5052: Correct TUSB3410 endpoint requirements.
  USB: another ehci_iaa_watchdog fix

A nasty compile error:

In file included from security/keys/internal.h:16,
                 from security/keys/sysctl.c:14:
include/linux/key-ui.h: In function 'key_permission':
include/linux/key-ui.h:51: error: invalid use of undefined type 'struct task_struct'

apparently the compiler has decided that it needs to know sizeof(task_struct)
so that it can add zero to a task_struct* (which is rather dumb of it).

Getting task_struct in scope in these deeply-nested headers is scary-looking,
so let's just remove the "+ 0".

Cc: David Howells <dhowells@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Markers do not mix well with CONFIG_PREEMPT_RCU because it uses
preempt_disable/enable() and not rcu_read_lock/unlock for minimal
intrusiveness.  We would need call_sched and sched_barrier primitives.

Currently, the modification (connection and disconnection) of probes
from markers requires changes to the data structure done in RCU-style :
a new data structure is created, the pointer is changed atomically, a
quiescent state is reached and then the old data structure is freed.

The quiescent state is reached once all the currently running
preempt_disable regions are done running.  We use the call_rcu mechanism
to execute kfree() after such quiescent state has been reached.
However, the new CONFIG_PREEMPT_RCU version of call_rcu and rcu_barrier
does not guarantee that all preempt_disable code regions have finished,
hence the race.

The "proper" way to do this is to use rcu_read_lock/unlock, but we don't
want to use it to minimize intrusiveness on the traced system.  (we do
not want the marker code to call into much of the OS code, because it
would quickly restrict what can and cannot be instrumented, such as the
scheduler).

The temporary fix, until we get call_rcu_sched and rcu_barrier_sched in
mainline, is to use synchronize_sched before each call_rcu calls, so we
wait for the quiescent state in the system call code path.  It will slow
down batch marker enable/disable, but will make sure the race is gone.
Signed-off-by: NMathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
Acked-by: NPaul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix the problem that makedumpfile sometimes fails on x86_64 machine.

This patch adds the symbol "phys_base" to a vmcoreinfo data.  The
vmcoreinfo data has the minimum debugging information only for dump
filtering.  makedumpfile (dump filtering command) gets it to distinguish
unnecessary pages, and makedumpfile creates a small dumpfile.

On x86_64 kernel which compiled with CONFIG_PHYSICAL_START=0x0 and
CONFIG_RELOCATABLE=y, makedumpfile fails like the following:

 # makedumpfile -d31 /proc/vmcore dumpfile
 The kernel version is not supported.
 The created dumpfile may be incomplete.
 _exclude_free_page: Can't get next online node.

 makedumpfile Failed.
 #

The cause is the lack of the symbol "phys_base" in a vmcoreinfo data.
If the symbol "phys_base" does not exist, makedumpfile considers an
x86_64 kernel as non relocatable.  As the result, makedumpfile
misunderstands the physical address where the kernel is loaded, and it
cannot translate a kernel virtual address to physical address correctly.

To fix this problem, this patch adds the symbol "phys_base" to a
vmcoreinfo data.
Signed-off-by: NKen'ichi Ohmichi <oomichi@mxs.nes.nec.co.jp>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: <stable@kernel.org>
Acked-by: NVivek Goyal <vgoyal@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NRobert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Add some locks and unlocks to some code paths.
Signed-off-by: NJiri Slaby <jirislaby@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Unlock two grabbed locks on some paths.
Signed-off-by: NJiri Slaby <jirislaby@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

NBD does not protect the nbd_device's socket from becoming NULL during
receives.

This closes a race with the NBD_CLEAR_SOCK ioctl (nbd-client -d) setting
the nbd_device's socket to NULL right before NBD calls sock_xmit.
Signed-off-by: NMike Snitzer <snitzer@gmail.com>
Cc: Paul Clements <paul.clements@steeleye.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NJim Meyering <meyering@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This patch deletes a couple of superfluous word occurrences in the
document Documentation/unaligned-memory-access.txt.

Thanks to Sebastien Dugue for the remark about English usage.
Signed-off-by: NDmitri Vorobiev <dmitri.vorobiev@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Make dma_alloc_coherent respect gfp flags (__GFP_COMP is one that
matters).
Signed-off-by: NIvan Kokshaysky <ink@jurassic.park.msu.ru>
Tested-by: NMichael Cree <mcree@orcon.net.nz>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Takashi Iwai <tiwai@suse.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Strange chars appear on the serial port when a printk and a printf
happens at the same time.  This is caused by the pdc sending chars while
atmel_console_write (called from printk) is executing

Concurent access of uart and console to the same port leads to corrupted
data to be transmitted, so disable tx dma (PDC) while writing to the
console.
Signed-off-by: NMarc Pignat <marc.pignat@hevs.ch>
Signed-off-by: NHaavard Skinnemoen <haavard.skinnemoen@atmel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

I found a problem related to losing data during pdc transmission in
atmel_serial: connect ttyS1 with ttyS2 using a loopback cable, send 30
byte of packet from one to the other and waiting for 30 byte.  On the
other side just read and echo the data received.

We always call atmel_tx_dma() from the tasklet regardless of what interrupt
triggered it.
Signed-off-by: Nmichael <trimarchi@gandalf.sssup.it>
Acked-by: NHaavard Skinnemoen <hskinnemoen@atmel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Currently include/linux/kvm.h is not considered by make headers_install,
because Kbuild cannot handle " unifdef-$(CONFIG_FOO) += foo.h.  This problem
was introduced by

commit fb56dbb3
Author: Avi Kivity <avi@qumranet.com>
Date:   Sun Dec 2 10:50:06 2007 +0200

    KVM: Export include/linux/kvm.h only if $ARCH actually supports KVM

    Currently, make headers_check barfs due to <asm/kvm.h>, which <linux/kvm.h>
    includes, not existing.  Rather than add a zillion <asm/kvm.h>s, export kvm.
    only if the arch actually supports it.
Signed-off-by: NAvi Kivity <avi@qumranet.com>

which makes this an 2.6.25 regression.

One way of solving the issue is to enhance Kbuild, but Avi and David conviced
me, that changing headers_install is not the way to go.  This patch changes
the definition for linux/kvm.h to unifdef-y.

If  unifdef-y is used for linux/kvm.h "make headers_check" will fail on all
architectures without asm/kvm.h.  Therefore, this patch also provides
asm/kvm.h on all architectures.
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Acked-by: NAvi Kivity <avi@qumranet.com>
Cc: Sam Ravnborg <sam@ravnborg.org
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: <linux-arch@vger.kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Code inspection discovered in 2 places timers were being incorrectly setup
using round_jiffies_relative(HZ).  The timer would then fire at time (0 <= T <
HZ).

Fix them to use round_jiffies(jiffies + HZ);
Signed-off-by: NRichard Kennedy <richard@rsk.demon.co.uk>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: David Brownell <david-b@pacbell.net>
Cc: Arjan van de Ven <arjan@infradead.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fixes the keyspan driver after the addition of additional
checking of driver requirements introduced in usb-serial.c
commit 063a2da8.  The initialization
of the keyspan usb_serial_driver structs were not initializing the
num_interrupt_out field and the additional checking was rejecting
the end point so the driver wouldn't finish initializing.

This commit initializes the fields to NUM_DONT_CARE.
It works for the keyspan USA-49WG and doesn't break the USA-19HS
which are the two keyspan devices I have to test with.
Signed-off-by: NClark Rawlins <clark.rawlins@escient.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1062) fixes a bug in the scatter-gather initialization
code in the usbtest driver.  When the sg-helper conversion was
performed, it wasn't done correctly.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
CC: Jens Axboe <axboe@kernel.dk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fixes a bug/inconsistency revealed by the additional sanity checking in
   commit 063a2da8
introduced in the original 2.6.24 branch.

The Handspring Visor / PalmOS 4 device structure defines .num_bulk_out=2
but the usb-serial probe returns num_bulk_out=3, triggering the check in
the above commit and forcing a bail out when the device (a Garmin iQue in
my case) attempts to connect.  The patch bumps the expected number of
endpoints to 3.

FWIW, this patch will probably solve the following kernel bug report for
Treo users (identical symptoms, different model PalmOS units):
  <http://bugzilla.kernel.org/show_bug.cgi?id=10118>
Signed-off-by: NBrad Sawatzky <brad+kernel@swatter.net>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch adds support for the Telegesys ETRX2USB which
works fine with the cp2101 driver.
Signed-off-by: NFlorian Fainelli <florian.fainelli@telecomint.eu>
Tested-by: NXavier Carcelle <xavier.carcelle@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The changes introduced in commit
063a2da8 changed the semantics of the
num_interrupt_in, num_interrupt_out, num_bulk_in and num_bulk_out
entries of the usb_serial_driver struct to be the number of endpoints
the device has when probed.

This patch changes the ti_1port_device usb_serial_driver struct to
reflect this change.  The single port devices only have 1
bulk_out endpoint in their initial configuration, and so this patch
changes the number of other types to NUM_DONT_CARE.

The same change probably needs doing to the ti_2port_device struct,
but I don't have a two port device at hand.
Signed-off-by: NRobert Spanton <rspanton@zepler.net>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch, suggested by Alan Stern, fixes the hung USB issues
on my notebook from suspend/resume cycles.

It does so by eliminating some confusion about the internal state
machine associated with unlinking from the EHCI async schedule ring,
which caused a recent regression:

  http://bugzilla.kernel.org/show_bug.cgi?id=10345Signed-off-by: NMark Lord <mlord@pobox.com>
Signed-off-by: NDavid Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

* git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
  ide: use ->ata_input_data in ide_driveid_update()
  ide-h8300: 32-bit I/O is unsupported
  ide/legacy/q40ide.c: add MODULE_LICENSE
  ide/legacy/macide: add MODULE_LICENSE
  ide/legacy/falconide.c: add MODULE_LICENSE
  ide/legacy/buddha.c: add MODULE_LICENSE
  ide/legacy/gayle.c: add MODULE_LICENSE
  ide/h8300/ide-h8300.c: add MODULE_LICENSE
  ide/cris/ide-cris.c: add MODULE_LICENSE
  ide/arm/ide_arm.c: add MODULE_LICENSE
  ide/ppc/pmac.c: add MODULE_LICENSE
  ide/ppc/mpc8xx.c: add MODULE_LICENSE
  ide/pci/cmd640.c: add MODULE_LICENSE
  ide-pnp.c: add MODULE_LICENSE