Johannes Berg discovered that kernel space was leaking to
userspace on 64 bit platform. He made a first patch to fix that. This
is an improved version of his patch.
Signed-off-by: NJean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

 	Johannes Berg and Michael Buesch noticed that the WPA ioctls
were missing from the 64<->32 bit conversion. This means that when
using a 32 bits userspace on a 64 bit kernel, those ioctls fail.
Signed-off-by: NJean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Recent changes in the specs that were introduced in commit
740ac4fb were incorrect and resulted in machine check
errors on the PPC architecture for G PHY's with a revision number equal to 1. The
two offending changes are reverted.
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

Fix a duplicated leftshift in bcm43xx_radio_set_tx_iq. data_high values are
already leftshifted. Thanks to Michael Buesch for spotting this.
Signed-off-by: NStefano Brivio <stefano.brivio@polimi.it>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

There are several places where the PHY version and revision were interchanged.
These are changed in the specifications on 2/13/07 and now use "analog" instead
instead of "version" to help reduce confusion.
Signed-off-by: NLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>

.. hopefully most of the fallout of the timer changes is contained now.
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The watchdog implementation excludes low res / non continuous
clocksources from being selected as a watchdog reference
unintentionally.

Allow using jiffies/PIT as a watchdog reference as long as no better
clocksource is available. This is necessary to detect TSC breakage on
systems, which have no pmtimer/hpet.

The main goal of the initial patch (preventing to switch to highres/nohz
when no reliable fallback clocksource is available) is still guaranteed
by the checks in clocksource_watchdog().
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The rework of next_timer_interrupt() fixed the timer wheel bugs, but
invented a rounding error versus the next hrtimer event. This is caused
by the conversion of the hrtimer internal representation to relative
jiffies.

This causes bug #8100:
http://bugzilla.kernel.org/show_bug.cgi?id=8100

next_timer_interrupt() returns "now" in such a case and causes the code
in tick_nohz_stop_sched_tick() to trigger the timer softirq, which is
bogus as no timer is due for expiry. This results in an endless context
switching between idle and ksoftirqd until a timer is due for expiry.

Modify the hrtimer evaluation so that, it returns now + 1, when the
conversion results in a delta < 1 jiffie.

It's confirmed to resolve bug #8100
Reported-by: NEmil Karlson <jkarlson@cc.hut.fi>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 4278/1: configure pxa27x I2C SCL as "input"
  [ARM] 4272/1: Missing symbol h1940_pm_return fix
  [ARM] 4235/1: ns9xxx: declare the clock functions as "const"
  [ARM] 4271/1: iop32x: fix ep80219 detection (support iq80219 platforms)
  [ARM] 4270/2: mach-s3c2443/irq.c off by one error in dma irqs

This is just a QA / cosmetic fix ..

[ "a modules" => "a module" ]
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

After dvb tuner refactoring, the pllbuff has been altered such that the pll
address is now stored in buf[0].  Instead of sending buf to set_pll_input,
we should send buf+1.
Signed-off-by: NMichael Krufky <mkrufky@linuxtv.org>
Cc: Mauro Carvalho Chehab <mchehab@infradead.org>
Cc: Ivan Andrewjeski <ivan@fiero-gt.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

It has been reported by Julian Deng that configuring the pxa27x i2c SCL line as output generates a short negative pulse on it during the call to pxa_gpio_mode(GPIO117_I2CSCL_MD); as it first switches it to output and then configures it for the alternate function. The SCL line is in fact bidirectional and can also be configured as 117 | GPIO_ALT_FN_1_IN, in which case the pulse is not generated. This is exactly what this patch does.

Author: Julian Deng <dengtj@sitek.cn>
Signed-off-by: NG. Liakhovetski <gl@dsa-ac.de>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

commit f9690982 removed the check for
cpu_khz from sched_clock(), which prevented early access to the TSC by
non obvious magic.

This is harmless as long as the CPU has a TSC. On TSCless systems this
results in an illegal instruction trap.

Replace tsc_disabled and tsc_unstable by tsc_enabled, which is only set
when the tsc is available and not unstable.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Acked-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

  CC      arch/mips/mm/cerr-sb1.o
arch/mips/mm/cerr-sb1.c: In function 'sb1_cache_error':
arch/mips/mm/cerr-sb1.c:235: warning: format '%010llx' expects type 'long long unsigned int', but argument 2 has type 'uint64_t'
arch/mips/mm/cerr-sb1.c: In function 'extract_ic':
arch/mips/mm/cerr-sb1.c:385: warning: format '%016llx' expects type 'long long unsigned int', but argument 3 has type 'uint64_t'
arch/mips/mm/cerr-sb1.c:385: warning: format '%016llX' expects type 'long long unsigned int', but argument 6 has type 'uint64_t'
arch/mips/mm/cerr-sb1.c: In function 'extract_dc':
arch/mips/mm/cerr-sb1.c:523: warning: format '%010llx' expects type 'long long unsigned int', but argument 3 has type 'uint64_t'
arch/mips/mm/cerr-sb1.c:523: warning: format '%016llX' expects type 'long long unsigned int', but argument 7 has type 'uint64_t'
arch/mips/mm/cerr-sb1.c:570: warning: format '%016llX' expects type 'long long unsigned int', but argument 3 has type 'uint64_t'
  LD      arch/mips/mm/built-in.o
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

arch/mips/jazz/jazzdma.c:70: warning: assignment makes integer from pointer without a cast
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

The missing cast did result a warning when calling an 32-bit ARC firmware
function that takes 5 arguments where the 5th argument is a pointer from a
64-bit kernel.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NAtsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

In the the sequence:
        ei
        ..
        mfc0    $x, $status

the mfc0 may not see the SR_IE bit set. This was a deliberate bug in the
kernel code because we knew this was a safe thing to do on all R2 silicon
so far but new silicon is changing this.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NManish Lachwani <mlachwani@mvista.com>
Signed-off-by: NDeepak Saxena <dsaxena@mvista.com>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

This patch fixes two places where we used plain 'x - PAGE_OFFSET' to
achieve virtual to physical address convertions. This type of convertion
is no more allowed since commit 6f284a2c.
Reported-by: NMaxime Bizon <mbizon@freebox.fr>
Signed-off-by: NFranck Bui-Huu <fbuihuu@gmail.com>

[Build fixes for machines that don't use the generic dma-coherence.h]
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Ray Lee reported, that on an UP kernel with "noapic" command line option
set, the box locks hard during boot.

Adding some debug printks revealed, that the last action on the box
before stalling was "Send IPI" - a debug printk which was put into
smp_send_timer_broadcast_ipi().

It seems that send_IPI_mask(mask, LOCAL_TIMER_VECTOR) fails when
"noapic" is set on the command line on an UP kernel.

Aside of that it does not make much sense to trigger an interrupt
instead of calling the function directly on the CPU which gets the
PIT/HPET interrupt in case of broadcasting.
Reported-by: NRay Lee <ray-lk@madrabbit.org>
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Acked-by: NRay Lee <ray-lk@madrabbit.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The segment register slots in struct pt_regs are padded to 32 bits.
Some of these are stored with instructions like "pushl %es", which
leaves the high 16 bits as they were.  So the high bits of these
fields in struct pt_regs contain kernel stack garbage.  These bits are
ignored by everything and never leak to user space, except in core
dumps.  The user struct pt_regs is always at the base of the thread's
kernel stack and so it seems unlikely the information that leaks from
here is ever worthwhile so as to be a security concern, but I'm not
sure about that.  It has been this way for ages; userland consumers of
core dumps all mask off these high bits themselves.  So it is not urgent.

This change masks off the padding bits of the segment register slots
in core dumps.  ptrace already masks off these high bits, so this
makes the values in core dumps consistent with what ptrace would
report just before the process died.

As I read the processor manuals, the cs and ss values will always be
padded with zero bits rather than stack garbage.  But unlike "pushl %es",
this is not simple to test with a userland program.  So I added the two
instructions rather than wonder if they are really never necessary.

I think that x86_64 does not have this problem (for either 32-bit or
64-bit processes).  It only uses "mov" instructions from segment
registers, which zero-extend.
Signed-off-by: NRoland McGrath <roland@redhat.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Needed for any architecture that claims ARCH_APICTIMER_STOPS_ON_C3,
not just i386.

I'm hoping Thomas will clean this up a bit later..
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
  ieee1394: fix oops on "modprobe -r ohci1394" after network class_device conversion

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  [netdrvr] ewrk3: correct card detection bug
  cxgb3 - fix white spaces in drivers/net/Kconfig
  myri10ge: update driver version to 1.3.0-1.226
  myri10ge: fix management of >4kB allocated pages
  myri10ge: update wcfifo and intr_coal_delay default values
  myri10ge: Serverworks HT2100 provides aligned PCIe completion
  mv643xx_eth: add mv643xx_eth_shutdown function
  SAA9730: Fix large pile of warnings
  Revert "ucc_geth: returns NETDEV_TX_BUSY when BD ring is full"
  cxgb3 - T3B2 pcie config space
  cxgb3 - Fix potential MAC hang
  cxgb3 - Auto-load FW if mismatch detected
  cxgb3 - fix ethtool cmd on multiple queues port
  Fix return code in pci-skeleton.c
  skge: use per-port phy locking
  skge: mask irqs when device down
  skge: deadlock on tx timeout
  [PATCH] airo: Fix an error path memory leak
  [PATCH] bcm43xx: MANUALWLAN fixes

A little mistake in 8a2bfdcb is making all
transactions synchronous, which reduces ext3 performance to comical levels.

Cc: Mingming Cao <cmm@us.ibm.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This is the rivafb equivalent of 238576e1.
It fixes rivafb having a default backlight brightness of 0 (no picture at
all) on a PBook 6,1.
Signed-off-by: NGuido Guenther <agx@sigxcpu.org>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Acked-by: NRichard Purdie <rpurdie@rpsys.net>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Adds device ids of two Fujitsu Siemens Tablet PCs to pnp_dev_table
Signed-off-by: NDanny Kukawka <dkukawka@suse.de>
Cc: Russell King <rmk@arm.linux.org.uk>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix the /proc/pid/stat representation of executable boundaries.  It should
show the bounds of the executable, but instead shows the bounds of the
loader.

Before the patch is applied, the bug can be seen by examining, say, inetd:

	# ps | grep inetd
	  610         root          0   S   /usr/sbin/inetd -i
	# cat /proc/610/maps
	c0bb0000-c0bba788 r-xs 00000000 00:0b 14582157  /lib/ld-uClibc-0.9.28.so
	c3180000-c31dede4 r-xs 00000000 00:0b 14582179  /lib/libuClibc-0.9.28.so
	c328c000-c328ea00 rw-p 00008000 00:0b 14582157  /lib/ld-uClibc-0.9.28.so
	c3290000-c329b6c0 rw-p 00000000 00:00 0
	c32a0000-c32c0000 rwxp 00000000 00:00 0
	c32d4000-c32d8000 rw-p 00000000 00:00 0
	c3394000-c3398000 rw-p 00000000 00:00 0
	c3458000-c345f464 r-xs 00000000 00:0b 16384612  /usr/sbin/inetd
	c3470000-c34748f8 rw-p 00004000 00:0b 16384612  /usr/sbin/inetd
	c34cc000-c34d0000 rw-p 00000000 00:00 0
	c34d4000-c34d8000 rw-p 00000000 00:00 0
	c34d8000-c34dc000 rw-p 00000000 00:00 0
	# cat /proc/610/stat
	610 (inetd) S 1 610 610 0 -1 256 0 0 0 0 0 8 0 0 19 0 1 0 94392000718
	950272 0 4294967295 3233480704 3233523592 3274440352 3274439976
 	3273467584 0 0 4096 90115 3221712796 0 0 17 0 0 0 0

The code boundaries are 3233480704 to 3233523592, which are:

	(gdb) p/x 3233480704
	$1 = 0xc0bb0000
	(gdb) p/x 3233523592
	$2 = 0xc0bba788

Which corresponds to this line in the maps file:

	c0bb0000-c0bba788 r-xs 00000000 00:0b 14582157  /lib/ld-uClibc-0.9.28.so

Which is wrong.  After the patch is applied, the maps file is pretty much
identical (there's some minor shuffling of the location of some of the
anonymous VMAs), but the stat file is now:

	# cat /proc/610/stat
	610 (inetd) S 1 610 610 0 -1 256 0 0 0 0 0 7 0 0 18 0 1 0 94392000722
	950272 0 4294967295 3276111872 3276141668 3274440352 3274439976
	3273467584 0 0 4096 90115 3221712796 0 0 17 0 0 0 0

The code boundaries are then 3276111872 to 3276141668, which are:

	(gdb) p/x 3276111872
	$1 = 0xc3458000
	(gdb) p/x 3276141668
	$2 = 0xc345f464

And these correspond to this line in the maps file instead:

	c3458000-c345f464 r-xs 00000000 00:0b 16384612  /usr/sbin/inetd

Which is now correct.
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fix the print formatting of three unsigned long fields in /proc/timer_list,
which are currently being formatted as signed long.
Signed-off-by: NJames Morris <jmorris@namei.org>
Acked-by: NIngo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

It turned out that it is almost impossible to trust ACPI, BIOS & Co.
regarding the C states. This was the reason to switch the local apic
timer off in C2 state already. OTOH there are sane and well behaving
systems, which get punished by that decision.

Allow the user to confirm that the local apic timer is trustworthy in C2
state. This keeps the default behaviour on the safe side.
Signed-off-by: NThomas Gleixner <tglx@linutronix.de>
Acked-by: NIngo Molnar <mingo@elte.hu>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This reverts commit 25496cae, which
broke bootup on at least Ingo's ThinkPad T60.  Need to figure out
exactly what is wrong before we can re-do the logic.
Requested-by: NIngo Molnar <mingo@elte.hu>
Acked-by: NThomas Gleixner <tglx@linutronix.de>
Cc: Thomas Renninger <trenn@suse.de>
Cc: Len Brown <len.brown@intel.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The networking subsystem has been converted from class_device to device
but ieee1394 hasn't.  This results in a 100% reproducible NULL pointer
dereference if the ohci1394 driver module is unloaded while the eth1394
module is still loaded.
http://lkml.org/lkml/2006/11/16/147
http://lkml.org/lkml/2007/3/14/4

This is a regression in 2.6.21-rc1.
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
Tested-by: NIsmail Dönmez <ismail@pardus.org.tr>

Arwin Vosselman pointed out:
> The ewrk3-driver doesn't function with 2.6.16-kernels (used 2.6.16.41 for
> my tests). Cards will never be detected due to this bug.
>
> drivers/net/ewrks3.c:
> Line 417 reads:
>
> if (nicsr == (CSR_TXD | CSR_RXD))
>
> that should be:
>
> if (nicsr != (CSR_TXD | CSR_RXD))
>
> Comparison with the same line in v2.4 shows why:
>
> 2.4:
> if (nicsr == (CSR_TXD | CSR_RXD)){
>
> blah, blah
> ==========
> 2.6:
> if (nicsr == (CSR_TXD | CSR_RXD))
>     return -ENXIO;
>
> blah, blah
> ==========
>
> blah,blah will not, but should, be executed in 2.6 with a card being present.
>
> The fix mentioned above solves this bug.
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into tmp

Use tabs instead of white spaces for CHELSIO_T3 entry.
Signed-off-by: NDivy Le Ray <divy@chelsio.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>

Driver version is now 1.3.0-1.226.
Signed-off-by: NBrice Goglin <brice@myri.com>
Signed-off-by: NJeff Garzik <jeff@garzik.org>