There's an off-by-1 in kernel/power/main.c:state_store() ...  if your
kernel just happens to have some non-zero data at pm_states[PM_SUSPEND_MAX]
(i.e.  one past the end of the array) then it'll let you write anything you
want to /sys/power/state and in response the box will enter S5.
Signed-off-by: Ndean gaudet <dean@arctic.org>
Acked-by: NPavel Machek <pavel@ucw.cz>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  [IA64] update sn2 defconfig
  [IA64] Add mca recovery failure messages
  [IA64-SGI] fix SGI Altix tioce_reserve_m32() bug
  [IA64] enable dumps to capture second page of kernel stack
  [IA64-SGI] - Reduce overhead of reading sn_topology
  [IA64-SGI] - Fix discover of nearest cpu node to IO node
  [IA64] IOC4 config option ordering
  [IA64] Setup an IA64 specific reclaim distance
  [IA64] eliminate compile time warnings
  [IA64] eliminate compile time warnings
  [IA64-SGI] SN SAL call to inject memory errors
  [IA64] - Fix MAX_PXM_DOMAINS for systems with > 256 nodes
  [IA64] Remove unused variable in sn_sal.h
  [IA64] Remove redundant NULL checks before kfree
  [IA64] wire up compat_sys_adjtimex()

Update SN2 defconfig to latest kernel and add QLA FC drivers commonly
found in SN2 boxes.
Signed-off-by: NJes Sorensen <jes@sgi.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

When the mca recovery code encounters a condition that makes
the MCA non-recoverable, print the reason it could not recover.
This will make it easier to identify why the recovery code did
not recover.
Signed-off-by: NRuss Anderson <rja@sgi.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

The following patch fixes a bug in the SGI Altix tioce_reserve_m32()
code.  The bug was that we could walking past the end of the CE ASIC
32/40bit PMU ATE Buffer, resulting in a PIO Reply Error.
Signed-off-by: NMike Habeck <habeck@sgi.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

In SLES10 (2.6.16) crash dumping (in my experience, LKCD) is unable to
capture the second page of the 2-page task/stack allocation.
This is particularly troublesome for dump analysis, as the stack traceback
cannot be done.
  (A similar convention is probably needed throughout the kernel to make
   kernel multi-page allocations detectable for dumping)

Multi-page kernel allocations are represented by the single page structure
associated with the first page of the allocation.  The page structures
associated with the other pages are unintialized.

If the dumper is selecting only kernel pages it has no way to identify
any but the first page of the allocation.

The fix is to make the task/stack allocation a compound page.
Signed-off-by: NCliff Wickman <cpw@sgi.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

MPI programs using certain debug options have a long
startup time. This was traced to a "vmalloc/vfree" in
the code that reads /proc/sgi_sn/sn_topology. On large
systems, vfree requires an IPI to all cpus to do TLB
purging.

Replace the vmalloc/vfree with kmalloc/kfree. Although
the size of the structure being allocated is unknown, it
will not not exceed 96 bytes.
Signed-off-by: NJack Steiner <steiner@sgi.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

Fix a bug that causes discovery of the nearest node/cpu to
a TIO (IO node) to fail.
Signed-off-by: NJack Steiner <steiner@sgi.com>
Signed-off-by: NTony Luck <tony.luck@intel.com>

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/pci-2.6:
  [PATCH] PCI quirk: VIA IRQ fixup should only run for VIA southbridges
  [PATCH] PCI: fix potential resource leak in drivers/pci/msi.c
  [PATCH] PCI: Documentation: no more device ids
  [PATCH] PCI: fix via irq SATA patch

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  [PATCH] USB: ftdi_sio: add support for ASK RDR 400 series card reader
  [PATCH] USB: ftdi_sio: Adds support for iPlus device.
  [PATCH] USB: ftdi_sio vendor code for RR-CirKits LocoBuffer USB
  [PATCH] USB: Use new PCI_CLASS_SERIAL_USB_* defines
  [PATCH] USB: net2280: set driver data before it is used
  [PATCH] USB: net2280: check for shared IRQs
  [PATCH] USB: net2280: send 0-length packets for ep0
  [PATCH] USB: net2280: Handle STALLs for 0-length control-IN requests
  [PATCH] USB: storage: atmel unusual dev update
  [PATCH] USB: Storage: unusual devs update
  [PATCH] USB: add new iTegno usb CDMA 1x card support for pl2303
  [PATCH] USB: Resource leak fix for whiteheat driver

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/driver-2.6:
  [PATCH] Added URI of "linux kernel development process"
  [PATCH] Kobject: possible cleanups
  [PATCH] Fix OCFS2 warning when DEBUG_FS is not enabled
  [PATCH] Kobject: fix build error
  [PATCH] Frame buffer: remove cmap sysfs interface

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] Fix branch emulation for floating-point exceptions.
  [MIPS] Cleanup inode->r_dev usage.
  [MIPS] Update MIPS defconfigs.
  [MIPS] Get rid of CONFIG_ADVANCED.
  [MIPS] Kconfig: Clarify description of CROSSCOMPILE.
  [MIPS] 24K LV: Add core card id.
  [MIPS] Sparse: fix sparse for 64-bit kernels.
  [MIPS] Use __ffs() instead of ffs() in ip32_irq0().
  [MIPS] Fix bitops for MIPS32/MIPS64 CPUs.
  [MIPS] Fix ip27 build.
  [MIPS] Oprofile: fix sparse warning.
  [MIPS] Fix oprofile module unloading

* 'splice' of git://brick.kernel.dk/data/git/linux-2.6-block:
  [PATCH] splice: make the read-side do batched page lookups
  [PATCH] Add find_get_pages_contig(): contiguous variant of find_get_pages()
  [PATCH] splice: switch to using page_cache_readahead()

Signed-off-by: NPaolo Ciarrocchi <paolo.ciarrocchi@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch contains the following possible cleanups:
- #if 0 the following unused global function:
  - subsys_remove_file()
- remove the following unused EXPORT_SYMBOL's:
  - kset_find_obj
  - subsystem_init
- remove the following unused EXPORT_SYMBOL_GPL:
  - kobject_add_dir
Signed-off-by: NAdrian Bunk <bunk@stusta.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix the following warning which happens when OCFS2_FS is enabled but
DEBUG_FS isn't:

fs/ocfs2/dlmglue.c: In function `ocfs2_dlm_init_debug':
fs/ocfs2/dlmglue.c:2036: warning: passing arg 5 of `debugfs_create_file' discards qualifiers from pointer target type
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Cc: Arjan van de Ven <arjan@infradead.org>
Cc: Joel Becker <Joel.Becker@oracle.com>
Acked-by: NMark Fasheh <mark.fasheh@oracle.com>
Signed-off-by: NAndrew Morton <akpm@osdl.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This fixes a build error for various odd combinations of CONFIG_HOTPLUG
and CONFIG_NET.
Signed-off-by: NKay Sievers <kay.sievers@vrfy.org>
Cc: Nigel Cunningham <ncunningham@cyclades.com>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Remove it as it does not work properly due to sysfs core changes.
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Alan Cox pointed out that the VIA 'IRQ fixup' was erroneously running
on my system which has no VIA southbridge (but I do have a VIA IEEE
1394 device).

This should address that.  I also changed "Via IRQ" to "VIA IRQ"
(initially I read Via as a capitalized via (by way/means of).
Signed-off-by: NChris Wedgwood <cw@f00f.org>
Acked-by: NJeff Garzik <jeff@garzik.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The coverity checker spotted (as entry #599) that we might leak `entry' in
drivers/pci/msi.c::msix_capability_init()
This patch should take care of that.
Signed-off-by: NJesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Document that we don't like to add more PCI device ids
but are happy to accept PCI vendor ids for linux/include/pci_ids.h

Original text from Jeff Garzik.
Signed-off-by: NIngo Oeser <netdev@axxeo.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This device id improperly got added to the VIA chipset list with a
previous patch.  Remove it as it is not correct.

Cc: Grzegorz Janoszka <Grzegorz@Janoszka.pl>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Proposed fix for ptep_get_and_clear_full PAE bug.  Pte_clear had the same bug,
so use the same fix for both.  Turns out pmd_clear had it as well, but pgds
are not affected.

The problem is rather intricate.  Page table entries in PAE mode are 64-bits
wide, but the only atomic 8-byte write operation available in 32-bit mode is
cmpxchg8b, which is expensive (at least on P4), and thus avoided.  But it can
happen that the processor may prefetch entries into the TLB in the middle of an
operation which clears a page table entry.  So one must always clear the P-bit
in the low word of the page table entry first when clearing it.

Since the sequence *ptep = __pte(0) leaves the order of the write dependent on
the compiler, it must be coded explicitly as a clear of the low word followed
by a clear of the high word.  Further, there must be a write memory barrier
here to enforce proper ordering by the compiler (and, in the future, by the
processor as well).

On > 4GB memory machines, the implementation of pte_clear for PAE was clearly
deficient, as it could leave virtual mappings of physical memory above 4GB
aliased to memory below 4GB in the TLB.  The implementation of
ptep_get_and_clear_full has a similar bug, although not nearly as likely to
occur, since the mappings being cleared are in the process of being destroyed,
and should never be dereferenced again.

But, as luck would have it, it is possible to trigger bugs even without ever
dereferencing these bogus TLB mappings, even if the clear is followed fairly
soon after with a TLB flush or invalidation.  The problem is that memory above
4GB may now be aliased into the first 4GB of memory, and in fact, may hit a
region of memory with non-memory semantics.  These regions include AGP and PCI
space.  As such, these memory regions are not cached by the processor.  This
introduces the bug.

The processor can speculate memory operations, including memory writes, as long
as they are committed with the proper ordering.  Speculating a memory write to
a linear address that has a bogus TLB mapping is possible.  Normally, the
speculation is harmless.  But for cached memory, it does leave the falsely
speculated cacheline unmodified, but in a dirty state.  This cache line will be
eventually written back.  If this cacheline happens to intersect a region of
memory that is not protected by the cache coherency protocol, it can corrupt
data in I/O memory, which is generally a very bad thing to do, and can cause
total system failure or just plain undefined behavior.

These bugs are extremely unlikely, but the severity is of such magnitude, and
the fix so simple that I think fixing them immediately is justified.  Also,
they are nearly impossible to debug.
Signed-off-by: NZachary Amsden <zach@vmware.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>

This patch adds support for an ASK RDR 400 series contactless card
reader <http://www.ask.fr/uk/products_and_services/terminals.html> to
the ftdi_sio driver's device ID table.  The product ID was supplied by
Adriano Couto on the ftdi-usb-sio-devel list.
Signed-off-by: NIan Abbott <abbotti@mev.co.uk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Adds support in ftdi_sio usbserial driver for USB modems sold by
Plus GSM Company in Poland.
Signed-off-by: NLuiz Fernando Capitulino <lcapitulino@mandriva.com.br>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch adds recognition of the RR-CirKits LocoBuffer USB
to the existing FTDI driver.  http://www.rr-cirkits.comSigned-off-by: NNathan Bronson <ngb@sns-usa.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

We could use the recently added PCI_CLASS_SERIAL_USB_UHCI,
PCI_CLASS_SERIAL_USB_OHCI and PCI_CLASS_SERIAL_USB_EHCI defines in
more places, for slightly shorter and clearer code.
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as671) fixes a bug in the error pathway for the net2280
probe routine.  A failure during probe will cause the driver to call
pci_get_drvdata before the corresponding pci_set_drvdata has been set.
The patch also does a kzalloc conversion.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as670) adds a check for whether a shared IRQ was actually
generated by the net2280 device.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as669) fixes a bug in the net2280 driver.  Now it will
properly send zero-length packets on ep0 until the control status stage
occurs.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as668) fixes a typo in net2280.  The handler for 0-length
control-IN requests should check that the endpoint _isn't_ halted before
sending a 0-length packet.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Originally submitted by Olivier Blondeau <zeitoun@gmail.com>, with re-diffing
by me. Adds a new atmel unusual_dev entry.
Signed-off-by: NPhil Dibowitz <phil@ipom.com>

This patch removes the Protocol portion of the Iomega Click! device as it's not
needed. Not-needed message reported by Kenneth Crudup <kenny@panix.com>
Signed-off-by: NPhil Dibowitz <phil@ipom.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Add new iTegno usb CDMA 1x card (usbid '0eba:2080') support to pl2303 driver
Signed-off-by: NWang Jun <wangjun1974@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

We may return from drivers/usb/serial/whiteheat.c::whiteheat_attach()
without freeing `result' if we leave via the no_firmware: label.

Spotted by the coverity checker as #670
Signed-off-by: NJesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

    
In the branch emulation for floating-point exceptions, __compute_return_epc
must determine for bc1f et al which condition code bit to test. This is
based on bits <4:2> of the rt field. The switch statement to distinguish
bc1f et al needs to use only the two low bits of rt, but the old code tests
on the whole rt field.  This patch masks off the proper bits.
Signed-off-by: NWin Treese <treese@acm.org>
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

    
imajor()/iminor() should be used instead of accessing r_dev directly.

Based on patch from Eric Sesterhenn (snakebyte@gmx.de).
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

    
It's been a horrible source of confusion and let users to shoot themselves
into both feet with uzis to no end.
Signed-off-by: NRalf Baechle <ralf@linux-mips.org>

Signed-off-by: NRalf Baechle <ralf@linux-mips.org>