We found an issue in pal.S.

According to the software runtime SPEC,
The caller's output registers do not need to be preserved for
caller. The callee may reuse input registers for any other
purpose within the procedure.

in ia64_pal_call_phys_stacked,

input registers are copied to output registers before call
into ia64_switch_mode_phys, then used to call into PAL. This
assumes output registers are preserved in ia64_switch_mode_phys,
which may not be true.

In this particular case, ia64_switch_mode_phys alloc a null frame
, and mask off psr.i.
If an interrupt comes at this small window,
or an MCA comes inside the procedure, output registers
maybe changed,
then the pal call may got some staled input registers.

This patch moves the copies from input to output
after ia64_switch_mode_phys to follow the software
runtime convention.

It  also removed some unused labels in
ia64_pal_call_phys_stacked.
Signed-off-by: Zou Nan hai <nanhai.zou@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

Add a platform check to the snsc driver init function, to prevent
loading on non-sn2 systems.
Signed-off-by: Greg Edwards <edwardsg@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

Fix some sparse warnings on ia64.  Large constants that should be long
instead of int.  Use NULL instead of 0.  Add some missing __iomem
casts.  Replace a non-C99 structure assignment.
Signed-off-by: Keith Owens <kaos@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

arch/ia64/hp/sim/simscsi.c: In function `simscsi_sg_readwrite':
arch/ia64/hp/sim/simscsi.c:154: error: structure has no member named `buffer'
arch/ia64/hp/sim/simscsi.c: In function `simscsi_fillresult':
arch/ia64/hp/sim/simscsi.c:247: error: structure has no member named `buffer'

hch said:
>Just change it to access the request_buffer member instead.  buffer
>and request_buffer have been synonymous 99% of the time, and a driver
>never even wants to access buffer.
Signed-off-by: Tony Luck <tony.luck@intel.com>

/proc/pal/*/version_info is a bit confusing.  HP firmware, at least,
reports 07.31 instead of 0.7.31.  Also, the comment is out of place;
it's an internal detail about the implementation of ia64_pal_version.
Since the 2.2 revision of the SDM still states that PAL_VERSION can
be called in virtual mode, correct the comment to be more accurate.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: Tony Luck <tony.luck@intel.com>

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 3734/1: Fix the unused variable warning in __iounmap()
  [ARM] 3737/1: Export ARM copy/clear_user_page symbols
  [ARM] 3736/1: xscale: don't mis-report 80219 as an iop32x
  [ARM] 3733/2: S3C24XX: Remove old IDE registers in Anubis
  [ARM] 3732/1: S3C24XX: tidy syntax in osiris and anubis machines
  [ARM] Fix SMP booting
  [ARM] 3731/1: Allow IRQ definitions of IQ80331 and IQ80332 to co-exist
  [ARM] 3730/1: ep93xx: enable usb ohci driver in the defconfig
  [ARM] Fix cats build

For some reason it triggers always with NFS root and spams the kernel
logs of my nfs root boxes a lot.
Signed-off-by: Andi Kleen <ak@suse.de>
Acked-by: Trond Myklebust <trond.myklebust@fys.uio.no>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

I didn't test all compilation combinations. Shame on me.
And fix a missing option in the boot option following x86-64 (Jan Beulich)
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

It was broken before. But having it is important as possible hardware
bug workaround.

And previously there was no way to force swiotlb if there is another IOMMU.
Side effect is that iommu=force won't force swiotlb anymore even if there
isn't another IOMMU.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

As Travis Betak points out it accesses the wrong northbridge subfunction
now. Switch back to the old code.

Cc: "Travis Betak" <betak@mpdtxmail.amd.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Calgary hits a NULL pointer dereference when booting in a multi-chassis
NUMA system.  See Redhat bugzilla number 198498, found by Konrad
Rzeszutek (konradr@redhat.com).

There are many issues that had to be resolved to fix this problem.
Firstly when I originally wrote the code to handle NUMA systems, I
had a large misunderstanding that was not corrected until now.  That was
that I thought the "number of nodes online" referred to number of
physical systems connected.  So that if NUMA was disabled, there
would only be 1 node and it would only show that node's PCI bus.
In reality if NUMA is disabled, the system displays all of the
connected chassis as one node but is only ignorant of the delays
in accessing main memory.  Therefore, references to num_online_nodes()
and MAX_NUMNODES are incorrect and need to be set to the maximum
number of nodes that can be accessed (which are 8).  I created a
variable, MAX_NUM_CHASSIS, and set it to 8 to fix this.

Secondly, when walking the PCI in detect_calgary, the code only
checked the first "slot" when looking to see if a device is present.
This will work for most cases, but unfortunately it isn't always the
case.  In the NUMA MXE drawers, there are USB devices present on the
3rd slot (with slot 1 being empty).  So, to work around this, all
slots (up to 8) are scanned to see if there are any devices present.

Lastly, the bus is being enumerated on large systems in a different
way the we originally thought.  This throws the ugly logic we had
out the window.  To more elegantly handle this, I reorganized the
kva array to be sparse (which removed the need to have any bus number
to kva slot logic in tce.c) and created a secondary space array to
contain the bus number to phb mapping.

With these changes Calgary boots on an x460 with 4 nodes with and
without NUMA enabled.
Signed-off-by: Jon Mason <jdmason@us.ibm.com>
Signed-off-by: Muli Ben-Yehuda <muli@il.ibm.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fixed off-by-one error in detect_calgary and calgary_init which will
cause arrays to overflow.  Also, removed impossible to hit BUG_ON.
Signed-off-by: Jon Mason <jdmason@us.ibm.com>
Signed-off-by: Muli Ben-Yehuda <muli@il.ibm.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

On Intel systems generally the TSC stops in C3 or deeper,
so don't use it there. Follows similar logic on i386.

This should fix problems on Meroms.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Update defconfig
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Patch from Catalin Marinas

This patch adds #ifdef around some variables in the arch/arm/mm/ioremap.c
file.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from George G. Davis

As reported by various folks on the ARM Linux kernel mailing list,
the video-buf.ko driver has undefined references on all ARM machines
which use it as observed during `make modules`:

Warning: "v4wb_clear_user_page" [drivers/media/video/video-buf.ko] undefined!

Similar warnings exist for all ARM machines which use this driver.
So this change adds the missing EXPORT_SYMBOLs to allow using this
driver as a module.
Signed-off-by: George G. Davis <gdavis@mvista.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Lennert Buytenhek

The IOP 80219 xscale CPU is a stripped down version of the IOP32x.
But the fact that the 80219 and IOP32x are very similar doesn't mean
that they need to share a cpu table entry.  It's also somewhat confusing
for the end user to see the 80219 reported as an IOP32x, so this patch
splits the IOP32x cpu table entry to make a separate entry for the
80219.
Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  [libata] sata_promise: comment out duplicate PCI ID
  [PATCH] libata: improve EH action and EHI flag handling
  [PATCH] libata: fix eh_skip_recovery condition
  [PATCH] libata: fix autopsy ehc->i.action and ehc->i.dev handling

Merge branch 'upstream' of git://electric-eye.fr.zoreil.com/home/romieu/linux-2.6 into upstream-fixes

Okay, Fix both typo's in one patch .The impact is that the incorrect value
was being computed for blinking LED and interrupt moderation values.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Always do a dummy RDMA after loading the firmware to work around
buggy PCIe chipsets which do not implement resending properly.
This is so cheap as to be almost free, and should never have been
conditional on the tx boundary != 4096.
Signed-off-by: Brice Goglin <brice@myri.com>
Signed-off-by: Jeff Garzik <jeff@garzik.org>

Merge branch 'upstream-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6 into upstream-fixes

Fix robust PI-futexes to be properly unlocked on unexpected exit.

For this to work the kernel has to know whether a futex is a PI or a
non-PI one, because the semantics are different.  Since the space in
relevant glibc data structures is extremely scarce, the best solution is
to encode the 'PI' information in bit 0 of the robust list pointer.
Existing (non-PI) glibc robust futexes have this bit always zero, so the
ABI is kept.  New glibc with PI-robust-futexes will set this bit.

Further fixes from Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Ulrich Drepper <drepper@redhat.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix pi_state->list handling bugs: list handling mishap, locking error.
Plus add more debug checks and fix a few style issues i noticed while
debugging this.

(reported by Ulrich Drepper and Jakub Jelinek.)
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Similar patch to earlier x86-64 patch. When the dwarf2 unwinder fails
dump the left over stack with the old unwinder.

Also some clarifications in the headers.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The dwarf2 unwinder currently often gets stuck because a lot
of assembly code doesn't have proper dwarf2 annotiation yet.

This currently often happens with __down. Should fix this by
adding proper dwarf2 annotation to all inline assembly. However
until that's done we need a quick fix for 2.6.18 to avoid
incomplete backtraces.

So when this happens dump the rest of the stack with the old unwinder
instead of silently not dumping it. There was already a optional
"both" mode that dumped both, but that was too ugly.

I also clarified the headers for the different backtraces a bit.

Also add a clear error message for missing dwarf2
annotation that people can work on.

And I removed a dead variable left over from Ingo's changes.

Cc: mingo@elte.hu
Cc: jbeulich@novell.com
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

In x86_64 platform, INT1 and INT3 trap stack is IST stack called DEBUG_STACK,
when INT1/INT3 trap happens, system will switch to DEBUG_STACK by hardware.
Current DEBUG_STACK size is 4K, when int1/int3 trap happens, kernel will
minus current DEBUG_STACK IST value by 4k. But if int3/int1 trap is nested,
it will destroy other vector's IST stack. This patch modifies this, it sets
DEBUG_STACK size as 8K and allows two level of nested int1/int3 trap.

Kprobe DEBUG_STACK may be nested, because kprobe handler may be probed
by other kprobes.

Thanks jbeulich for pointing out error in the first patch.

[AK: nested kprobes are pretty dubious. Hopefully one nest
will be enough. This will cost 8K per CPU (4K more than before)]
Signed-off-by: bibo, mao <bibo.mao@intel.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

When int 0x80 is called from long mode r8-r11 would leak out of the
kernel (or rather they would be filled with some values from
the kernel stack). I don't think it's a security issue because
the values come from the fixed stack frame which should be near
always user registers from a previous interrupt.

Still better fix it.

Longer term the register save macros need to be cleaned up
to avoid such mistakes in the future.

Original analysis from Richard Brunner, fix by me.

Cc: Richard.Brunner@amd.com
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fixes a obscure user space triggerable crash during oprofiling.

Oprofile calls profile_pc from NMIs even when user_mode(regs) is not true and
the program counter is inside the kernel lock section. This opens
a race - when a user program jumps to a kernel lock address and
a NMI happens before the illegal page fault exception is raised
and the program has a unmapped esp or ebp then the kernel could
oops. NMIs have a higher priority than exceptions so that could
happen.

Add user_mode checks to i386/x86-64 profile_pc to prevent that.

Cc: John Levon <levon@movementarian.org>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] update default configuration
  [S390] duplicate ccw devices in ccwgroup.
  [S390] permanent subchannel busy conditions may cause I/O stall

* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SUNLANCE]: fix compilation on sparc-UP
  [SPARC]: Defer clock_probe to fs_initcall()
  [SPARC64]: Fix typo in pgprot_noncached().
  [SPARC64]: Fix quad-float multiply emulation.

* git://oss.sgi.com:8090/nathans/xfs-rc-2.6:
  [XFS] Ensure bulkstat from an invalid inode number gets caught always with
  [XFS] Fix a barrier related forced shutdown on mounts with quota enabled.
  [XFS] Fix remount vs no/barrier options by ensuring we clear unwanted
  [XFS] All xfs_disk_dquot_t values are (as the name says) disk endian.

* 'for-linus' of git://brick.kernel.dk/data/git/linux-2.6-block:
  [PATCH] scsi: kill overeager "not-ready" messages
  [PATCH] it821x: fix ide dma setup bug
  [PATCH] ide: if the id fields looks screwy, disable DMA
  [PATCH] ide: option to disable cache flushes for buggy drives

Recent changes in i386 __switch_to() have a misplaced closing
parenthesis causing an unlikely() to terminate early.
Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Acked-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

EINVAL.

SGI-PV: 953819
SGI-Modid: xfs-linux-melb:xfs-kern:26629a
Signed-off-by: Nathan Scott <nathans@sgi.com>

SGI-PV: 912426
SGI-Modid: xfs-linux-melb:xfs-kern:26622a
Signed-off-by: Nathan Scott <nathans@sgi.com>