Masami reported:

> Since the fixmap pages are assigned higher address to lower,
> text_poke() has to use it with inverted order (FIX_TEXT_POKE1
> to FIX_TEXT_POKE0).

I prefer to just invert the order of the fixmap declaration.
It's simpler and more straightforward.

Backward fixmaps seems to be used by both x86 32 and 64.

It's really rare but a nasty bug, because it only hurts when
instructions to patch are crossing a page boundary. If this
happens, the fixmap write accesses will spill on the following
fixmap, which may very well crash the system. And this does not
crash the system, it could leave illegal instructions in place.
Thanks Masami for finding this.

It seems to have crept into the 2.6.30-rc series, so this calls
for a -stable inclusion.
Signed-off-by: NMathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
Acked-by: NMasami Hiramatsu <mhiramat@redhat.com>
Cc: <stable@kernel.org>
LKML-Reference: <20090701213722.GH19926@Krystal>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

Instead of this:

[   75.690022] <7>printing local APIC contents on CPU#0/0:
[   75.704406] ... APIC ID:      00000000 (0)
[   75.707905] ... APIC VERSION: 00060015
[   75.722551] ... APIC TASKPRI: 00000000 (00)
[   75.725473] ... APIC PROCPRI: 00000000
[   75.728592] ... APIC LDR: 00000001
[   75.742137] ... APIC SPIV: 000001ff
[   75.744101] ... APIC ISR field:
[   75.746648] 0123456789abcdef0123456789abcdef
[   75.746649] <7>00000000000000000000000000000000

Improve the code to be saner and simpler and just print out
the bitfield in a single line using hexa values - not as a
(rather pointless) binary bitfield.

Partially reused Linus's initial fix for this.
Reported-and-Tested-by: NYinghai Lu <yinghai@kernel.org>
Signed-off-by: NYinghai Lu <yinghai@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
LKML-Reference: <4A4C43BC.90506@kernel.org>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

This sparse warning:

  arch/x86/mm/init.c:83:16: warning: symbol 'check_efer' was not declared. Should it be static?

triggers because check_efer() is not decalared before using it.
asm/proto.h includes the declaration of check_efer(), so
including asm/proto.h to fix that - this also addresses the
sparse warning.
Signed-off-by: NJaswinder Singh Rajput <jaswinderrajput@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
LKML-Reference: <1246458263.6940.22.camel@hpdv5.satnam>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

This sparse warning:

  arch/x86/kernel/amd_iommu.c:1195:23: warning: symbol 'device_nb' was not declared. Should it be static?

triggers because device_nb is global but is only used in a
single .c file. change device_nb to static to fix that - this
also addresses the sparse warning.

This sparse warning:

  arch/x86/kernel/amd_iommu.c:1766:10: warning: Using plain integer as NULL pointer

triggers because plain integer 0 is used in place of a NULL
pointer. change 0 to NULL to fix that - this also address the
sparse warning.
Signed-off-by: NJaswinder Singh Rajput <jaswinderrajput@gmail.com>
Cc: Joerg Roedel <joerg.roedel@amd.com>
LKML-Reference: <1246458194.6940.20.camel@hpdv5.satnam>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

MSR_P6_EVNTSEL0 and MSR_P6_EVNTSEL1 is already declared in msr-index.h.
Signed-off-by: NJaswinder Singh Rajput <jaswinderrajput@gmail.com>
LKML-Reference: <1246450778.6940.8.camel@hpdv5.satnam>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

The init_IRQ() function is now called with slab allocator initialized.
Therefore, we must not use the bootmem allocator in xen_init_IRQ().

Fixes the following boot-time warning:

  ------------[ cut here ]------------
  WARNING: at mm/bootmem.c:535 alloc_arch_preferred_bootmem+0x27/0x45()
  Modules linked in:
  Pid: 0, comm: swapper Not tainted 2.6.30 #1
  Call Trace:
   [<ffffffff8102d6e3>] ? warn_slowpath_common+0x73/0xb0
   [<ffffffff810210d9>] ? pvclock_clocksource_read+0x49/0x90
   [<ffffffff812e522f>] ? alloc_arch_preferred_bootmem+0x27/0x45
   [<ffffffff812e5761>] ? ___alloc_bootmem_nopanic+0x39/0xc9
   [<ffffffff812e57fa>] ? ___alloc_bootmem+0x9/0x2f
   [<ffffffff812e9e21>] ? xen_init_IRQ+0x25/0x61
   [<ffffffff812d69ee>] ? start_kernel+0x1b5/0x29e
  ---[ end trace 4eaa2a86a8e2da22 ]---
Acked-by: NJeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Tested-by: NChristian Kujau <lists@nerdbynature.de>
Reported-by: NChristian Kujau <lists@nerdbynature.de>
Signed-off-by: NPekka Enberg <penberg@cs.helsinki.fi>
Cc: lists@nerdbynature.de
Cc: jeremy.fitzhardinge@citrix.com
LKML-Reference: <1246438278.22417.28.camel@penberg-laptop>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

The merge of the 32- and 64-bit fixmap headers made a latent
bug on x86-64 a real one: with the right config settings
it is possible for FIX_OHCI1394_BASE to overlap the FIX_BTMAP_*
range.
Signed-off-by: NJan Beulich <jbeulich@novell.com>
Cc: <stable@kernel.org> # for 2.6.30.x
LKML-Reference: <4A4A0A8702000078000082E8@vpn.id2.novell.com>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

Noticed the zero-sized function symbol while looking at 'perf' profiles,
it causes the profiler to display those addresses in hexa.

Turns out that this was wrong/bogus for an eternity.
Signed-off-by: NMike Galbraith <efault@gmx.de>
Acked-by: NAlexander van Heukelum <heukelum@fastmail.fm>
Acked-by: NCyrill Gorcunov <gorcunov@gmail.com>
LKML-Reference: <1246366820.6538.1.camel@marge.simson.net>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide-2.6:
  ide: memory overrun in ide_get_identity_ioctl() on big endian machines using ioctl HDIO_OBSOLETE_IDENTITY
  ide: fix resume for CONFIG_BLK_DEV_IDEACPI=y
  ide-cd: handle fragmented packet commands gracefully
  ide: always kill the whole request on error
  ide: fix ide_kill_rq() for special ide-{floppy,tape} driver requests

ide: memory overrun in ide_get_identity_ioctl() on big endian machines using ioctl HDIO_OBSOLETE_IDENTITY

This patch fixes a memory overrun in function ide_get_identity_ioctl() which
chooses the size of a memory buffer depending on the ioctl command that led
to the function call, however, passes that buffer to a function which needs the
buffer size to be always chosen unconditionally.

Due to conditional compilation the memory overrun can only happen on big endian
machines. The error can be triggered using ioctl HDIO_OBSOLETE_IDENTITY. Usage
of ioctl HDIO_GET_IDENTITY is safe.
Signed-off-by: NChristian Engelmayer <christian.engelmayer@frequentis.com>
Acked-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

commit 2f0d0fd2 ("ide-acpi: cleanup
do_drive_get_GTF()") didn't account for the lack of hwif->acpidata
check in generic_ide_suspend() [ indirect user of do_drive_get_GTF()
through ide_acpi_exec_tfs() ] resulting in broken resume when ACPI
support is enabled but ACPI data is unavailable.

Fix it by adding ide_port_acpi() helper for checking if port needs
ACPI handling and cleaning generic_ide_{suspend,resume}() to use it
instead of hiding hwif->acpidata and ide_noacpi checks in IDE ACPI
helpers (this should help in preventing similar bugs in the future).

While at it:
- kill superfluous debugging printks in ide_acpi_{get,push}_timing()
Reported-and-tested-by: NEtienne Basset <etienne.basset@numericable.fr>
Also-reported-and-tested-by: NJeff Chua <jeff.chua.linux@gmail.com>
Signed-off-by: NBartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

* master.kernel.org:/home/rmk/linux-2.6-arm: (28 commits)
  [ARM] 5562/2: at91: add gpio button support for at91sam9g20ek
  [ARM] 5563/1: at91: at91sam9rlek lcd interface correction
  [ARM] 5565/2: Use PAGE_SIZE and RO_DATA() in link script
  [ARM] 5560/1: Avoid buffer overrun in case of an invalid IRQ
  [ARM] GTA02: build fixes (s3c2410_nand_set usage)
  [ARM] MINI2440: Add missing flash_bbt flat to NAND
  [ARM] s3c2410_defconfig: add MINI2440 machine to build
  [ARM] S3C: Fix S3C24XX build to not include s3c64xx IIS devices
  [ARM] S3C24XX: Fix missing s3c_iis_device.
  [ARM] MINI2440: remove duplicated #include
  [ARM] S3C24XX: Fix spi-bus configuration build errors
  OMAP: Fix IOMEM macro for assembly
  [ARM] S3C: Remove unused CONFIG_DEBUG_S3C_PORT
  [ARM] S3C24XX: Fix use of CONFIG_S3C24XX_PWM
  OMAP2/3: Initialize gpio debounce register
  OMAP: IOMMU: function flush_iotlb_page is not flushing correct entry
  OMAP3: RX51: Use OneNAND sync read / write
  OMAP2/3: gpmc-onenand: correct use of async timings
  OMAP3: DMA: Enable idlemodes for DMA OCP
  OMAP3: SRAM size fix for HS/EMU devices
  ...

* 'for-linus' of git://git.infradead.org/users/eparis/notify:
  fs: allow d_instantiate to be called with negative parent dentry

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  sound: OSS: mpu401, fix deadlock
  ALSA: hda - Add missing initializations for ALC268 and ALC269
  ALSA: cmi8330: fix MPU-401 PnP init copy&paste bug
  ALSA: hda - Line In for Acer Inspire 6530G model
  sound: oxygen: make mic volume control mono
  MAINTAINERS: Add entry for twl4030 series soc codec driver
  ALSA: lx6464es - configure ethersound io channels
  sound: Use PCI_VDEVICE for CREATIVE and ECTIVA
  sound: Use PCI_VDEVICE
  ALSA: hda - Use model=acer-aspire-6530g for Acer Aspire 6930G
  ALSA: hda - Fix acer-aspire-6530g model quirk
  ALSA: hda - Add pin-sense trigger when needed for Realtek codecs
  ALSA: hda - Fix support for Samsung P50 with AD1986A codec
  ALSA: hda - Generalize the pin-detect quirk for Lenovo N100
  ALSA: hda - Simplify AD1986A mixer definitions

Merge branch 'bugfixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6

* 'bugfixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
  integrity: add ima_counts_put (updated)
  integrity: ima audit hash_exists fix
  integrity: ima mq_open imbalance msg fix

Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  Revert "x86: cap iomem_resource to addressable physical memory"

* 'for-linus' of git://git.o-hand.com/linux-rpurdie-backlight:
  backlight: Fix tdo24m crash on kmalloc

FYI, there's a post-rc1 build regression with certain configs:

 drivers/built-in.o: In function `pci_hp_deregister':
 (.text+0xb166): undefined reference to `pci_hp_remove_module_link'
 drivers/built-in.o: In function `pci_hp_deregister':
 (.text+0xb19f): undefined reference to `pci_destroy_slot'
 drivers/built-in.o: In function `__pci_hp_register':
 (.text+0xb583): undefined reference to `pci_create_slot'
 drivers/built-in.o: In function `__pci_hp_register':
 (.text+0xb5b1): undefined reference to `pci_hp_create_module_link'
 make: *** [.tmp_vmlinux1] Error 1

Caused by:

| 2b121bc2 is first bad commit
| commit 2b121bc2
| Date:   Thu Jun 25 13:25:36 2009 +0200
|
|     eeepc-laptop: Register as a pci-hotplug device

which changed the driver to use the PCI hotplug infrastructure, but
didn't do a good job on the Kconfig rules.
Signed-off-by: NIngo Molnar <mingo@elte.hu>
Acked-by: NRandy Dunlap <randy.dunlap@oracle.com>
Acked-by: NLen Brown <len.brown@intel.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Currently we reinit the ldisc on final tty close which is what the old code
did to ensure that if the device retained its termios settings then it had the
right ldisc. tty_ldisc_reinit does that but also leaves us with the reset
ldisc reference which is then leaked.

At this point we know the port will be recycled so we can kill the ldisc
off completely rather than try and add another ldisc free up when the kref
count hits zero.

At this point it is safe to keep the ldisc closed as tty_ldisc waiting
methods are only used from the user side, and as the final close we are
the last such reference. Interrupt/driver side methods will always use the
non wait version and get back a NULL.

Found with kmemleak and investigated/identified by Catalin Marinas.
Signed-off-by: NAlan Cox <alan@linux.intel.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

mpu401_chk_version is called with a spin lock already held. Don't take it
again.
Signed-off-by: NJiri Slaby <jirislaby@gmail.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

* fix/pci-vdevice:
  sound: Use PCI_VDEVICE for CREATIVE and ECTIVA
  sound: Use PCI_VDEVICE

* fix/oxygen:
  sound: oxygen: make mic volume control mono

* fix/misc:
  ALSA: cmi8330: fix MPU-401 PnP init copy&paste bug

* fix/lx6464es:
  ALSA: lx6464es - configure ethersound io channels

* fix/hda-samsung-p50:
  ALSA: hda - Fix support for Samsung P50 with AD1986A codec
  ALSA: hda - Generalize the pin-detect quirk for Lenovo N100
  ALSA: hda - Simplify AD1986A mixer definitions

* fix/hda:
  ALSA: hda - Add missing initializations for ALC268 and ALC269
  ALSA: hda - Line In for Acer Inspire 6530G model
  ALSA: hda - Use model=acer-aspire-6530g for Acer Aspire 6930G
  ALSA: hda - Fix acer-aspire-6530g model quirk
  ALSA: hda - Add pin-sense trigger when needed for Realtek codecs

The new fsnotify infrastructure (starting at 90586523) causes an oops in
spufs, where we populate a directory with files before instantiating the
directory itself. The new changes seem to have introduced an assumption
that a dentry's parent will be positive when instantiating.

This change makes it once again possible to d_instantiate a dentry
with a negative parent, and brings __fsnotify_d_instantiate() into
line with inotify_d_instantiate(), which already has this NULL check.
Signed-off-by: NJeremy Kerr <jk@ozlabs.org>
Signed-off-by: NEric Paris <eparis@redhat.com>

This adds input keyboard gpio support on at91sam9g20ek board.
It adds button 3 and 4.
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: NAndrew Victor <linux@maxim.org.za>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

During the changes to clean up / fix the realtek codec initialization
routines in commit 4a79ba34,
I forgot to add the check for ALC268 and ALC269.
This resulted in the missing EAPD and COEF setup for these codecs.

This patch adds the missing checks for these codecs.

Reference: bko#13633
	http://bugzilla.kernel.org/show_bug.cgi?id=13633Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Fix copy&paste bug in PnP MPU-401 initialization.
Signed-off-by: NOndrej Zary <linux@rainbow-software.org>
Cc: <stable@kernel.org>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The Line In connector is set up as PIN_IN by default, using
VREF_HIZ. It is connected to both ADCs, so add it to both
input selectors.
Also add the ability to use the input mix (on a SoundBlaster
one would call this "What You Hear").
Signed-off-by: NTony Vroon <tony@linx.net>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  be2net: Fix to avoid a crash seen on PPC with LRO and Jumbo frames.
  gro: Flush GRO packets in napi_disable_pending path
  inet: Call skb_orphan before tproxy activates
  mac80211: Use rcu_barrier() on unload.
  sunrpc: Use rcu_barrier() on unload.
  bridge: Use rcu_barrier() instead of syncronize_net() on unload.
  ipv6: Use rcu_barrier() on module unload.
  decnet: Use rcu_barrier() on module unload.
  sky2: Fix checksum endianness
  mdio add missing GPL flag
  sh_eth: remove redundant test on unsigned
  fsl_pq_mdio: Fix fsl_pq_mdio to work with modules
  ipv6: avoid wraparound for expired preferred lifetime
  tcp: missing check ACK flag of received segment in FIN-WAIT-2 state
  atl1*: add device_set_wakeup_enable to atl1*_set_wol
  Phonet: generate Netlink RTM_DELADDR when destroying a device
  Phonet: publicize the Netlink notification function
  Revert "veth: prevent oops caused by netdev destructor"
  cpmac: fix compilation failure introduced with netdev_ops conversion
  ipsec: Fix name of CAST algorithm

While testing the driver on PPC, we ran into a crash with LRO, Jumbo frames.
With CONFIG_PPC_64K_PAGES configured (a default in PPC), MAX_SKB_FRAGS drops to 3 and we were crossing the array limits on skb_shinfo(skb)->frags[].
Now we coalesce the frags from the same physical page into one slot in
skb_shinfo(skb)->frags[] and go to the next index when the frag is from

different physical page.

This patch is against the net-2.6 tree.
Signed-off-by: NAjit Khaparde <ajitk@serverengines.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

This patch fixes an imbalance message as reported by J.R. Okajima.
The IMA file counters are incremented in ima_path_check. If the
actual open fails, such as ETXTBSY, decrement the counters to
prevent unnecessary imbalance messages.
Reported-by: NJ.R. Okajima <hooanon05@yahoo.co.jp>
Signed-off-by: NMimi Zohar <zohar@us.ibm.com>
Signed-off-by: NJames Morris <jmorris@namei.org>

Audit the file name, not the template name.
Signed-off-by: NMimi Zohar <zohar@us.ibm.com>
Signed-off-by: NJames Morris <jmorris@namei.org>

This patch fixes an imbalance message as reported by Sanchin Sant.
As we don't need to measure the message queue, just increment the
counters.
Reported-by: NSanchin Sant <sanchinp@in.ibm.com>
Signed-off-by: NMimi Zohar <zohar@us.ibm.com>
Acked-by: NSerge Hallyn <serue@us.ibm.com>
Signed-off-by: NJames Morris <jmorris@namei.org>

* 'kvm-updates/2.6.31' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: shut up uninit compiler warning in paging_tmpl.h
  KVM: Ignore reads to K7 EVNTSEL MSRs
  KVM: VMX: Handle vmx instruction vmexits
  KVM: s390: Allow stfle instruction in the guest
  KVM: kvm/x86_emulate.c toggle_interruptibility() should be static
  KVM: ia64: fix ia64 build due to missing kallsyms_lookup() and double export
  KVM: protect concurrent make_all_cpus_request
  KVM: MMU: Allow 4K ptes with bit 7 (PAT) set
  KVM: Fix dirty bit tracking for slots with large pages

* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
  cifs: fix fh_mutex locking in cifs_reopen_file

* git://git.infradead.org/iommu-2.6:
  intel-iommu: fix Identity Mapping to be arch independent

Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86, delay: tsc based udelay should have rdtsc_barrier
  x86, setup: correct include file in <asm/boot.h>
  x86, setup: Fix typo "CONFIG_x86_64" in <asm/boot.h>
  x86, mce: percpu mcheck_timer should be pinned
  x86: Add sysctl to allow panic on IOCK NMI error
  x86: Fix uv bau sending buffer initialization
  x86, mce: Fix mce resume on 32bit
  x86: Move init_gbpages() to setup_arch()
  x86: ensure percpu lpage doesn't consume too much vmalloc space
  x86: implement percpu_alloc kernel parameter
  x86: fix pageattr handling for lpage percpu allocator and re-enable it
  x86: reorganize cpa_process_alias()
  x86: prepare setup_pcpu_lpage() for pageattr fix
  x86: rename remap percpu first chunk allocator to lpage
  x86: fix duplicate free in setup_pcpu_remap() failure path
  percpu: fix too lazy vunmap cache flushing
  x86: Set cpu_llc_id on AMD CPUs