Fix several security issues in Alpha-specific syscalls.  Untested, but
mostly trivial.

1. Signedness issue in osf_getdomainname allows copying out-of-bounds
kernel memory to userland.

2. Signedness issue in osf_sysinfo allows copying large amounts of
kernel memory to userland.

3. Typo (?) in osf_getsysinfo bounds minimum instead of maximum copy
size, allowing copying large amounts of kernel memory to userland.

4. Usage of user pointer in osf_wait4 while under KERNEL_DS allows
privilege escalation via writing return value of sys_wait4 to kernel
memory.
Signed-off-by: NDan Rosenberg <drosenberg@vsecurity.com>
Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Matt Turner <mattst88@gmail.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

RTC_CLASS is changed to bool, so 'm' is invalid.
Signed-off-by: NWanlong Gao <wanlong.gao@gmail.com>
Acked-by: NMike Frysinger <vapier@gentoo.org>
Acked-by: NWolfram Sang <w.sang@pengutronix.de>
Acked-by: NHans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
Acked-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Guan Xuetao <gxt@mprc.pku.edu.cn>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

- usb0 pipe is same as default. own pipe config is not needed
- usb1 lost get_id function
Signed-off-by: NKuninori Morimoto <morimoto.kuninori@renesas.com>
Acked-by: NMagnus Damm <damm@opensource.se>
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

[ Also from Ben Hutchings <ben@decadent.org.uk> and Vitaliy Ivanov
  <vitalivanov@gmail.com> ]

Commit 06ae40ce ("x86 idle: EXPORT_SYMBOL(default_idle, pm_idle)
only when APM demands it") removed the export for pm_idle/default_idle
unless the apm module was modularised and CONFIG_APM_CPU_IDLE was set.

But the apm module uses pm_idle/default_idle unconditionally,
CONFIG_APM_CPU_IDLE only affects the bios idle threshold.  Adjust the
export accordingly.

[ Used #ifdef instead of #if defined() as it's shorter, and what both
  Ben and Vitaliy used.. Andy, you're out-voted ;)    - Linus ]
Reported-by: NRandy Dunlap <randy.dunlap@oracle.com>
Acked-by: NJiri Kosina <jkosina@suse.cz>
Acked-by: NIngo Molnar <mingo@elte.hu>
Acked-by: NLen Brown <len.brown@intel.com>
Signed-off-by: NAndy Whitcroft <apw@canonical.com>
Signed-off-by: NVitaliy Ivanov <vitalivanov@gmail.com>
Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The address limit is already set in flush_old_exec() so this
set_fs(USER_DS) is redundant.
Signed-off-by: NMathias Krause <minipli@googlemail.com>
Signed-off-by: NHans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>

This patch removes the unneeded, and now wrong, return 0 from intc_resume() and
lets the function return void instead. This matches the resume callback in
struct syscore_ops.
Signed-off-by: NHans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>

Somme common drivers will need those at91 cpu_is_xxx() definitions.
Those definitions are already in Linus' tree so if we want to use them
in common drivers, we will need them in AVR32 cpu.h file.
Signed-off-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: NHans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>

This patch makes sure the kconfig option CC_OPTIMIZE_FOR_SIZE is set to yes for
all default configuration files. This ensures the kernel is optimized for size,
and avoids potential relocation truncated to fit problems.
Signed-off-by: NHans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>

This patch will fix the mapping of the platform device id when mapping USART
peripheral ID to UART platform device id. Not setting the platform device id
will in most cases (when you map USART > 0 to UART 0) make the console not
available.
Signed-off-by: NHans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>

This patch fixes the use of the non-existing portnr variable in
at32_map_usart() to use the provided line number instead. Typo was introduced
in commit 2b348e2f.
Signed-off-by: NHans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>

While SH7377 and others were updated to properly use SCIFA/B port types,
SH7367 was left behind. Fix it up accordingly.
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

Initialize ->irq_set_wake() in gic_arch_extn to unbreak wake
up from the KEYSC device on AG5EVM in case of Suspend-to-RAM.

Without this patch "echo mem > /sys/power/state" and a key
press results in the following message on resume:

WARNING: at kernel/irq/manage.c:507 irq_set_irq_wake+0x7c/0xd8()
Unbalanced IRQ 103 wake disable
Signed-off-by: NMagnus Damm <damm@opensource.se>
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

This patch updates the board specific USB support
code for the sh7372 Mackerel board.

With this patch applied port CN22 is driven by the
recently added renesas_usbhs driver using the first
USB controller included in sh7372 aka USBHS0.

Hotplugging of USBHS0 unfortunately has to be
handled by software polling. The sh7372 SoC itself
obviously supports hotplug notification by IRQ but
on the Mackerel board this IRQ happens to be used
for the touch screen.

Also fix the pinmux configuration to avoid setting
up unused pins and fix minor spelling errors.
Signed-off-by: NMagnus Damm <damm@opensource.se>
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

Add a flag for SDHI1 to enable SDIO IRQ, and remove DMA Engine
slave id:s to disable DMA as a workaround.

Tested on sh73a0/AG5EVM with a BCM4318-based SDIO card.
Signed-off-by: NMagnus Damm <damm@opensource.se>
Signed-off-by: NPaul Mundt <lethal@linux-sh.org>

Older m68k-linux compilers will include pre-defined symbols that
confuse what processor it is being targeted for. For example gcc-4.1.2
will pre-define __mc68020__ even if you specify the target processor
as -m68000 on the gcc command line. Newer versions of gcc have this
corrected.

In a few places the m68k code uses defined(__mc68020__) for optimizations
that include instructions that are specific to the CPU 68020 and above.
When compiling with older compilers this will be true even when we have
selected to compile for the older 68000 processors.

Switch to using the kernel processor defines, CONFIG_M68020 and friends.
Signed-off-by: NGreg Ungerer <gerg@uclinux.org>

There are 3 families of CPU core types that we support in the m68knommu
architecture branch. They are

. traditional 68000
. CPU32 (a 68020 core derivative without MMU or bitfield instructions)
. ColdFire

It will be useful going forward to have a CONFIG_ option defined for
each type. We already have one for ColdFire (CONFIG_COLDFIRE), so add
for the other 2 families, CONFIG_M68000 and CONFIG_MCPU32.
Signed-off-by: NGreg Ungerer <gerg@uclinux.org>

The recent commit titled "module: Sort exported symbols" (f02e8a65)
changed the exported symbol name sections. Bring the m68knommu linker
script into line with those changes - including the sorting of the
symbol names.
Signed-off-by: NGreg Ungerer <gerg@uclinux.org>

When I added 3448a19d
I forgot about the special uv handling code for this, so this
patch fixes it up.
Acked-by: NJesse Barnes <jbarnes@virtuousgeek.org>
Acked-by: Ingo Molnar
Signed-off-by: NDave Airlie <airlied@redhat.com>

Since the driver uses the DMA API, we should pass it valid DMA masks.
Signed-off-by: NMika Westerberg <mika.westerberg@iki.fi>
Acked-by: NRussell King <rmk+kernel@arm.linux.org.uk>
Acked-by: NH Hartley Sweeten <hsweeten@visionengravers.com>
Tested-by: NPetr Stetiar <ynezz@true.cz>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

4e8d7637 (ARM: footbridge: convert to clockevents/clocksource) did
not set the cpumask for the clock event device.  This causes boot
to fail.  Add the necessary initialization.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

More of the same of 5f2c1b30 (ARM: footbridge: fix debug macros),
this time for the DC21285-based debugging code rather than the 8250-
based debugging code.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

We can't cope with initrds outside of memory, so check that the
initrd is within some declared memory to the kernel before using
it.  Otherwise we're likely to OOPS during boot.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

During converting per-cpu ticker to genirq layer some
IRQ initialization code was removed by commit
2cf95304 ("sparc32,leon:
per-cpu ticker use genirq per-cpu handler").

This patch reintroduces the code at the same place it was
removed from. IRQ12 - IRQ14 will crash on LEON SMP without
this patch because it will run the SUN4M IRQ trap handler.
Reported-by: NJan Andersson <jan@gaisler.com>
Signed-off-by: NDaniel Hellstrom <daniel@gaisler.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Three new IPIs were introduced by commit
ecbc42b7 ("sparc32, sun4m:
Implemented SMP IPIs support for SUN4M machines"), the
old handler was already prepared for IPIs but handled only
IRQ14 and IRQ13, this patch adds support for the new IPI at
IRQ12.

The IPI trap handler looks at the mask rather than the
pending IRQ/IPI, this bug may have masked the problem
above, introduced by the same commit.
Signed-off-by: NDaniel Hellstrom <daniel@gaisler.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Dump out the following 16-bit instruction to the faulting instruction
in the Code: line.  This allows Thumb-2 instructions to be properly
encoded.
Tested-by: NKevin Hilman <khilman@ti.com>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

The mach-nomadik machine did not compile properly due to bad
ux500-specific functions being called. Introduce new state
variables to fix this up.
Reported-by: NAxel Lin <axel.lin@gmail.com>
Cc: Alessandro Rubini <rubini@unipv.it>
Cc: Prafulla Wadaskar <prafulla.wadaskar@st.com>
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NGrant Likely <grant.likely@secretlab.ca>

Unconditionally changing the address limit to USER_DS and not restoring
it to its old value in the error path is wrong because it prevents us
using kernel memory on repeated calls to this function.  This, in fact,
breaks the fallback of hard coded paths to the init program from being
ever successful if the first candidate fails to load.

With this patch applied switching to USER_DS is delayed until the point
of no return is reached which makes it possible to have a multi-arch
rootfs with one arch specific init binary for each of the (hard coded)
probed paths.

Since the address limit is already set to USER_DS when start_thread()
will be invoked, this redundancy can be safely removed.
Signed-off-by: NMathias Krause <minipli@googlemail.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: stable@kernel.org
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This patch fixes the following build failure:

drivers/built-in.o: In function `early_init_dt_check_for_initrd':
/home/florian/dev/kernel/x86/linux-2.6-x86/drivers/of/fdt.c:571:
undefined reference to `early_init_dt_setup_initrd_arch'
make: *** [.tmp_vmlinux1] Error 1

which happens as soon as we enable initrd support on a x86 devicetree
platform such as Intel CE4100.
Signed-off-by: NFlorian Fainelli <ffainelli@freebox.fr>
Acked-by: NGrant Likely <grant.likely@secretlab.ca>
Cc: Maxime Bizon <mbizon@freebox.fr>
Acked-by: NSebastian Andrzej Siewior <sebastian@breakpoint.cc>
Cc: stable@kernel.org # 2.6.39
Link: http://lkml.kernel.org/r/201106061015.50039.ffainelli@freebox.frSigned-off-by: NThomas Gleixner <tglx@linutronix.de>

If the page to cmpxchg is user mode read only (not write),
we should simulate a data abort first.
Signed-off-by: NPo-Yu Chuang <ratbert@faraday-tech.com>
Acked-by: NNicolas Pitre <nicolas.pitre@linaro.org>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Commit af3e4fd3 "ARM: 6859/1: Add writethrough dcache support for
ARM926EJS processor" broke Thumb2 compilation by omitting to maintain
the wide encoding for the added branch instructions which made the
ARM926EJ-S record smaller than expected, breaking the record walk code.
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>
Cc: Mark A. Greer <mgreer@mvista.com>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

If the DT physical address is zero, this is equivalent to no DT.
Especially when the actual RAM physical address is not located at zero,
the result of phys_to_virt() would point to la-la-land and crash the
kernel, which crash is completely silent this early during boot.
Signed-off-by: NNicolas Pitre <nicolas.pitre@linaro.org>
Acked-by: NGrant Likely <grant.likely@secretlab.ca>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

The IO accessors for U300 were using u32 rather than the nominal
void __iomem * type, rectify this by properly defining the
virtual base for statically mapped peripherals to be
void __iomem *. Requires fixing a field in struct clk as well.
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

This reverts commit 45b95235.

Will Deacon reports that:

 In 52af9c6c ("ARM: 6943/1: mm: use TTBR1 instead of reserved context ID")
 I updated the ASID rollover code to use only the kernel page tables
 whilst updating the ASID.

 Unfortunately, the code to restore the user page tables was part of a
 later patch which isn't yet in mainline, so this leaves the code
 quite broken.

We're also in the process of eliminating __ARCH_WANT_INTERRUPTS_ON_CTXSW
from ARM, so lets revert these until we can properly sort out what we're
doing with the context switching.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

This reverts commit 52af9c6c.

Will Deacon reports that:

 In 52af9c6c ("ARM: 6943/1: mm: use TTBR1 instead of reserved context ID")
 I updated the ASID rollover code to use only the kernel page tables
 whilst updating the ASID.

 Unfortunately, the code to restore the user page tables was part of a
 later patch which isn't yet in mainline, so this leaves the code
 quite broken.

We're also in the process of eliminating __ARCH_WANT_INTERRUPTS_ON_CTXSW
from ARM, so lets revert these until we can properly sort out what we're
doing with the ARM context switching.
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

The patch adds one-line asm-generic files in arch/unicore32/include/asm/Kbuild
Also, remove the old implementation in arch/unicore32/Makefile
see commit from Sam Ravnborg <d8ecc5cd>
  kbuild: asm-generic support
Signed-off-by: NGuan Xuetao <gxt@mprc.pku.edu.cn>
Acked-by: NArnd Bergmann <arnd@arndb.de>

The patch changes PERCPU to PERCPU_SECTION
see commit from Tejun Heo <0415b00d>
  percpu: Always align percpu output section to PAGE_SIZE
Signed-off-by: NGuan Xuetao <gxt@mprc.pku.edu.cn>
Acked-by: NTejun Heo <tj@kernel.org>

Rename debug_defconfig to unicore32_defconfig, which is a minimal config for
PKUnity-v3 (130nm) SoC board.
Also, add KBUILD_DEFCONFIG to use 'make defconfig'.
Signed-off-by: NGuan Xuetao <gxt@mprc.pku.edu.cn>
Acked-by: NArnd Bergmann <arnd@arndb.de>

U-boot will load the kernel image to 48M physical memory address.
The patch changes it to the correct address, though it's PIC codes.
Signed-off-by: NGuan Xuetao <gxt@mprc.pku.edu.cn>
Acked-by: NArnd Bergmann <arnd@arndb.de>

The patch moves rtc driver for PKUnity-v3 SoC from arch/unicore32/kernel/
to drivers/rtc/, with renaming it to rtc-puv3.c.
Also, Kconfig, Makefile, and MAINTAINERS are modified correspondingly.
Signed-off-by: NGuan Xuetao <gxt@mprc.pku.edu.cn>
Acked-by: NArnd Bergmann <arnd@arndb.de>

When using 64K pages with a separate cpio rootfs, U-Boot will align
the rootfs on a 4K page boundary. When the memory is reserved, and
subsequent early memblock_alloc is called, it will allocate memory
between the 64K page alignment and reserved memory. When the reserved
memory is subsequently freed, it is done so by pages, causing the
early memblock_alloc requests to be re-used, which in my case, caused
the device-tree to be clobbered.

This patch forces the reserved memory for initrd to be kernel page
aligned, and will move the device tree if it overlaps with the range
extension of initrd. This patch will also consolidate the identical
function free_initrd_mem() from mm/init_32.c, init_64.c to mm/mem.c,
and adds the same range extension when freeing initrd. free_initrd_mem()
is also moved to the __init section.

Many thanks to Milton Miller for his input on this patch.

[BenH: Fixed build without CONFIG_BLK_DEV_INITRD]
Signed-off-by: NDave Carroll <dcarroll@astekcorp.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>