The kdb code should not toggle the sysrq state in case an end user
wants to try and resume the normal kernel execution.
Signed-off-by: NJason Wessel <jason.wessel@windriver.com>
Acked-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>

Fix a regression introduced by ae74e823 ("ipmi: add parameter to limit
CPU usage in kipmid").

Some systems were seeing CPU usage go up dramatically with the recent
changes to try to reduce timer usage in the IPMI driver.  This was traced
down to schedule_timeout_interruptible(1) being changed to
schedule_timeout_interruptbile(0).  Revert that part of the change.

Addresses https://bugzilla.kernel.org/show_bug.cgi?id=16147Reported-by: NThomas Jarosch <thomas.jarosch@intra2net.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Tested-by: NThomas Jarosch <thomas.jarosch@intra2net.com>
Cc: <stable@kernel.org>		[2.6.34.x]
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The ipmi code will never register a PCI or Open Firmware driver if a
hardcoded device is provided by the user by providing device addresses via
the module parameters.  This can cause us to attempt to unregister a
driver that was never registered, resulting in an oops.  Keep track of
registration in order to avoid this.

Fixes a post-2.6.34 regression.
Signed-off-by: NMatthew Garrett <mjg@redhat.com>
Acked-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

also drop the NORETRY we can probably nearly always satisfy order 1 allocs now,
and again the vmalloc path is there.
Signed-off-by: NDave Airlie <airlied@redhat.com>

Since the code that was too ugly to live is upstream, we can use it now,
instead of rolling our own.
Signed-off-by: NDave Airlie <airlied@redhat.com>

This patch adds a missing element of the ReadPubEK command output,
that prevents future overflow of this buffer when copying the
TPM output result into it.

Prevents a kernel panic in case the user tries to read the
pubek from sysfs.
Signed-off-by: NRajiv Andrade <srajiv@linux.vnet.ibm.com>
Signed-off-by: NJames Morris <jmorris@namei.org>

This shoud fix the problem with SysRq mode staying half-way enabled
and interfereing with normal PrtScrn operation after user presses ALT
for the first time.
Reported-and-tested-by: NÉric Piel <E.A.B.Piel@tudelft.nl>
Signed-off-by: NDmitry Torokhov <dtor@mail.ru>

This reverts commit 962400e8, which was
entirely bogus.

The code used to multiply the character offset by "vc->vc_cols", and
that's actually correct, because 'd' itself is an 'unsigned short'.  So
the pointer arithmetic already takes the size of a VGA character into
account.  Changing it to use vc_size_row (which is just "vc_cols"
shifted up to take the size of the character into account) ends up
multiplying with the VGA character size twice.

This got reported as bugs for various other subsystems, because what it
actually results in is writing the 16-bit vc_video_erase_char pattern
(usually 0x0720: 0x07 is the default attribute, 0x20 is ASCII space)
into some random other allocation.

So Markus ended up reporting this as a ext4 bug, while to Torsten Kaiser
it looked like a problem with KMS or libata.  Jeff Chua saw it in
different places.

And finally - Justin Mattock had slab poisoning enabled, and saw it as a
slab poison overwritten.  And bisected and reverted this to verify the
buggy commit.
Reported-by: NMarkus Trippelsdorf <markus@trippelsdorf.de>
Reported-by: NTorsten Kaiser <just.for.lkml@googlemail.com>
Reported-by: NJeff Chua <jeff.chua.linux@gmail.com>
Reported-by: NJustin P. Mattock <justinmattock@gmail.com>
Reported-bisected-and-tested-by: NJustin P. Mattock <justinmattock@gmail.com>
Acked-by: NDave Airlie <airlied@redhat.com>
Cc: Frank Pan <frankpzh@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The driver fails to compile on s390:

drivers/char/ramoops.c: In function 'ramoops_init':
drivers/char/ramoops.c:122: error: implicit declaration of function 'ioremap'

Since we won't make use of the driver anyway on s390 just let it depend on
HAS_IOMEM.
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Cc: Marco Stornelli <marco.stornelli@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

copy_from_user() returns the number of bytes remaining but we want to
return a negative error code here.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The code uses vc->vc_cols instead of vc->vc_size_row by mistake, it
will cause half of the region which is going to clear remain
uncleared.
The issue happens in background consoles, so it's hard to observe.

Frank Pan
Signed-off-by: NFrank Pan <frankpzh@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

In gsm_dlci_data_kick() we call gsm_dlci_data_sweep() with the
"gsm->tx_lock" held so we can't lock it again inside
gsm_dlci_data_sweep().  I removed that lock from and added one to
gsmld_write_wakeup() instead.  The sweep function is only called from
those two places.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Acked-by: NAlan Cox <alan@linux.intel.com>
Cc: stable <stable@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

When a program that has a virtio port opened and blocked for a write
operation, a port hot-unplug event will later led to a crash when
SIGTERM was sent to the program. Fix that.
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>

When removing a port we don't check if a program was blocked for read.
This leads to a crash when SIGTERM is sent to the program after
hot-unplugging the port.
Signed-off-by: NAmit Shah <amit.shah@redhat.com>
Signed-off-by: NRusty Russell <rusty@rustcorp.com.au>

This fixes a sporadic oops at boot on G5 Power Macs.  The table_end
variable has the address of the last byte of the table.  Adding on
PAGE_SIZE means we flush too much, and if the page after the table
is not mapped for any reason, the kernel will oops.  Instead we add
on 1 because flush_dcache_range() interprets its second argument as
the first byte past the range to be flushed.
Signed-off-by: NPaul Mackerras <paulus@samba.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Signed-off-by: NChristoph Hellwig <hch@lst.de>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Use memdup_user when user data is immediately copied into the
allocated region.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
position p;
identifier l1,l2;
@@

-  to = \(kmalloc@p\|kzalloc@p\)(size,flag);
+  to = memdup_user(from,size);
   if (
-      to==NULL
+      IS_ERR(to)
                 || ...) {
   <+... when != goto l1;
-  -ENOMEM
+  PTR_ERR(to)
   ...+>
   }
-  if (copy_from_user(to, from, size) != 0) {
-    <+... when != goto l2;
-    -EFAULT
-    ...+>
-  }
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

kasprintf combines kmalloc and sprintf, and takes care of the size
calculation itself.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression a,flag;
expression list args;
statement S;
@@

  a =
-  \(kmalloc\|kzalloc\)(...,flag)
+  kasprintf(flag,args)
  <... when != a
  if (a == NULL || ...) S
  ...>
- sprintf(a,args);
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Cc: Michael Buesch <mb@bu3sch.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Ramoops, like mtdoops, can log oops/panic information but in RAM.  It can
be used with persistent RAM for systems without flash support.  In
addition, for this systems, with this driver, it's no more needed add to
the kernel the mtd subsystem with advantage in footprint.

It can be used in a very easy way with persistent RAM for systems without
flash support.  For these systems, with this driver, it is no longer
required to cinlude mtd subsystem with an advantage in footprint.  In
addition, you can save flash space and store this information only in RAM.
Signed-off-by: NMarco Stornelli <marco.stornelli@gmail.com>
Cc: Simon Kagstrom <simon.kagstrom@netinsight.net>
Cc: David Woodhouse <David.Woodhouse@intel.com>
Cc; Anders Grafstrom <anders.grafstrom@netinsight.net>
Cc: Yuasa Yoichi <yuasa@linux-mips.org>
Cc: Jamie Lokier <jamie@shareable.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

If run_to_completion flag is set, it means that we are running in a
single-threaded mode, and thus no locks are held.

This fixes a deadlock when IPMI notifier is being called during panic.
Signed-off-by: NJiri Kosina <jkosina@suse.cz>
Acked-by: NCorey Minyard <minyard@acm.org>
Cc: <stable@kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Update core IPMI driver printk()'s with dev_printk(), and its constructs,
to provide additional device topology information.

An example of the additional device topology for a PNP device -
  ipmi_si 00:02: probing via ACPI
  ipmi_si 00:02: [io  0x0ca2-0x0ca3] regsize 1 spacing 1 irq 0
  ipmi_si 00:02: Found new BMC (man_id: 0x00000b, prod_id: 0x0000, ...
  ipmi_si 00:02: IPMI kcs interface initialized

and for a PCI device -
  ipmi_si 0000:01:04.6: probing via PCI
  ipmi_si 0000:01:04.6: PCI INT A -> GSI 21 (level, low) -> IRQ 21
  ipmi_si 0000:01:04.6: [mem 0xf1ef0000-0xf1ef00ff] regsize 1 spaci...
  ipmi_si 0000:01:04.6: IPMI kcs interface initialized

[minyard@acm.org: rework to fix rejects, extended it a bit]
[akpm@linux-foundation.org: coding-style fixes]
Signed-off-by: NMyron Stowe <myron.stowe@hp.com>
Signed-off-by: NCorey Minyard <minyard@acm.org>
Cc: Zhao Yakui <yakui.zhao@intel.com>
Cc: Len Brown <lenb@kernel.org>
Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Convert PNP patch (git 9e368fa0) to
maintain a pointer to a PNP device, 'pnp_dev', instead of the ACPI device,
'acpi_dev', that is currently being tracked with PNP based IPMI device
discovery.
Signed-off-by: NMyron Stowe <myron.stowe@hp.com>
Acked-by: NZhao Yakui <yakui.zhao@intel.com>
Acked-by: NCorey Minyard <minyard@acm.org>
Cc: Len Brown <lenb@kernel.org>
Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The timeouts in IPMI are in the 1-5 second range in message handling, so a
1 second timeout is a reasonable thing to do.  This should help with
reducing power consumption on idle systems.
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Some odd systems may have multiple BMCs, and we want to be able to support
them.  Let's make the assumption that if a system legitimately has
multiple BMCs then each BMC's SI will be of the same type, and also that
we won't see multiple SIs of the same type unless we have multiple BMCs.
If these hold true then we should register all SIs of the same type.
Signed-off-by: NMatthew Garrett <mjg@redhat.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

We can reasonably alter the poll rate depending on whether we're
performing a transaction or merely waiting for an event.
Signed-off-by: NMatthew Garrett <mjg@redhat.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

If we're not currently in the middle of a transaction, and if we have
interrupts, there's no real reason to poll the controller more frequently
than the core IPMI code does.  Set the interrupt_disabled flag
appropriately as the interrupt state changes, and make the timeout code
reset itself only if the transaction is incomplete or we have no
interrupts.
Signed-off-by: NMatthew Garrett <mjg@redhat.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The ipmi spec provides an ordering for si discovery.  Change the driver to
match, with the exception of preferring smbios to SPMI as HPs (at least)
contain accurate information in the former but not the latter.
Signed-off-by: NMatthew Garrett <mjg@redhat.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Only register one si per bmc.  Use any user-provided devices first,
followed by the first device with an irq, followed by the first device
discovered.
Signed-off-by: NMatthew Garrett <mjg@redhat.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The ipmi spec indicates that we should only make use of one si per bmc, so
separate device discovery and registration to make that possible.

[thenzl@redhat.com: fix mutex use]
Signed-off-by: NMatthew Garrett <mjg@redhat.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NTomas Henzl <thenzl@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Switch from a char* to an enum to identify the address source of SIs,
making it easier to handle them appropriately during registration.
Signed-off-by: NMatthew Garrett <mjg@redhat.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Use memdup_user when user data is immediately copied into the
allocated region.

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// <smpl>
@@
expression from,to,size,flag;
position p;
identifier l1,l2;
@@

-  to = \(kmalloc@p\|kzalloc@p\)(size,flag);
+  to = memdup_user(from,size);
   if (
-      to==NULL
+      IS_ERR(to)
                 || ...) {
   <+... when != goto l1;
-  -ENOMEM
+  PTR_ERR(to)
   ...+>
   }
-  if (copy_from_user(to, from, size) != 0) {
-    <+... when != goto l2;
-    -EFAULT
-    ...+>
-  }
// </smpl>
Signed-off-by: NJulia Lawall <julia@diku.dk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

References:

  Bug 15733 - Crash when accessing nonexistent GTT entries in i915
  https://bugzilla.kernel.org/show_bug.cgi?id=15733

On G33 and above, the size of the GTT space is determined by the GMCH
control register. Prior to this revision, the size is determined by the
size of the aperture. So we must careful to map and fill the appropriate
range depending on chipset.
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: NEric Anholt <eric@anholt.net>

Signed-off-by: NGeert Uytterhoeven <geert@linux-m68k.org>

Stanse found pci reference leaks in uli_agp_init and nforce3_agp_init
initialization functions.

The PCI devices are bridges, so it's not critical, but still worth fixing.
Signed-off-by: NJiri Slaby <jirislaby@gmail.com>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NDave Airlie <airlied@redhat.com>

For misc devices, inode->i_cdev doesn't point to the device drivers own
data.  Link between file operations and device driver internal data is
lost.  Pass pointer to misc device struct via file private data for driver
open function use.
Signed-off-by: NSamu Onkalo <samu.p.onkalo@nokia.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Handle out-of-range indices before reading what they refer to.  And don't
access the one-past-the-end element of the array either.
Signed-off-by: NPhil Carmody <ext-phil.2.carmody@nokia.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Roel Kluin <roel.kluin@gmail.com>
Cc: Grant Likely <grant.likely@secretlab.ca>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

drivers/char/hangcheck-timer.c is doubly broken.  When the overflown value
of TIMER_FREQ is abnormally low, it spams the syslog with KERN_CRIT
messages "Hangcheck: hangcheck value past margin!" But whether it happens
or not depends on HZ and lpj in a complex way.  People have hit it
occasionally as far as google search can tell.

First, the following line overflows unsigned long:

# define TIMER_FREQ (HZ*loops_per_jiffy)

Second, and more importantly, loops_per_jiffy has little to do with the
con= version from the the time scale of get_cycles() (aka rdtsc) to the
time scale of jiffies.

The attached patch resolves both of the problems.
Acked-by: NJoel Becker <joel.becker@oracle.com>
Cc: john stultz <johnstul@us.ibm.com>
Cc: Jan Glauber <jan.glauber@de.ibm.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

.name, .match_table and .owner are duplicated in both of_platform_driver
and device_driver.  This patch is a removes the extra copies from struct
of_platform_driver and converts all users to the device_driver members.

This patch is a pretty mechanical change.  The usage model doesn't change
and if any drivers have been missed, or if anything has been fixed up
incorrectly, then it will fail with a compile time error, and the fixup
will be trivial.  This patch looks big and scary because it touches so
many files, but it should be pretty safe.
Signed-off-by: NGrant Likely <grant.likely@secretlab.ca>
Acked-by: NSean MacLennan <smaclennan@pikatech.com>

REMOTE_DEBUG does already appear in 2.2 kernel sources but didn't
appear as a config Option in the initial git import 2.6.12-rc. It's
currently just used in one single place of the linux kernel and should
probably be dropped totally
Signed-off-by: NChristoph Egger <siccegge@cs.fau.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch makes it return -ENODEV if we run out of empty slots in the
probe function.  It's unlikely to happen, but it makes the static
checkers happy.
Signed-off-by: NDan Carpenter <error27@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>