Anything larger than MAX_INT is suspect.  Do this
for user copies too.
Signed-off-by: David S. Miller <davem@davemloft.net>

No need to duplicate it locally.  This also fixes
several arg sign extension bugs and the subsequent
ltp testsuite failures.
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

into nuts.davemloft.net:/disk1/BK/sparc-2.6

Suggested by Linus: optimise a condition in the clear_p?d_range functions.
Results in one less conditional branch on i386 with gcc-3.4.4
Signed-off-by: Nick Piggin <nickpiggin@yahoo.com.au>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch fixes a nasty bug that took us almost a week to track down on
ppc64, introduced by the 4L page table changes, and resulting in random
memory corruption. All archs that rely on a PTE page's struct page to
contain the mm & address (in mapping/index) will be affected.

zeromap_pud_range() is one of these page tables walking functions that
split the address into a base and an offset. It forgets to add back the
"base" when calling the lower level zeromap_pmd_range(), thus passing a
bogus virtual address. Most archs won't care, unless they do the above,
since the lower level can allocate a PTE page.

Kudo's to Michael Ellerman too who spent that week running tests after
tests to track it down, since the only way we managed to get it to show
up was after about 1 to 2h of LTP runs ...

(Note: We are in _urgent_ need to consolidate all those page table
walking functions, they all do things in a subtely different way, with
different checks (sometimes redudant) and inconsitent with each other,
even within a given set of them. Hopefully, Nick has some work in
progress there).
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

While browsing the 4 level page table changes (looking for a bug), I
noticed that copy_page_range, unlike others, do not check for
wraparound, which I suppose could be a problem with 4G/4G architectures
or that sort of thing.

This patch fixes it.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

When using 4level-fixup.h, a PMD page may end up beeing freed before the
matching PGD entry is cleared due to the way the compatibility macros
work. This can cause nasty races on some architectures.

This patch fixes it by defining pud_clear() to be pgd_clear(). That
means we'll actually write 0 twice, a small price to pay here,
especially seeing how easy it is to convert to the new headers anyway
(hint hint, ppc & ppc64 patches as soon as 2.6.11 is out).
Signed-off-by: Nick Piggin <nickpiggin@yahoo.com.au>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

into nuts.davemloft.net:/disk1/BK/sparc-2.6

The implementation is a nop on sparc64, we always return
true, but we have to add at least a (void) reference to
the arguments to avoid compiler/checker warnings.
Signed-off-by: David S. Miller <davem@davemloft.net>

No need for these enormous inline asm statements.
Signed-off-by: David S. Miller <davem@davemloft.net>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Previous PCI9 patch had a #endif placed wrong for some unknown reason (was
correct in local tree) This fixes it.
Signed-off-by: Rune Torgersen <runet@innovsys.com>
Signed-off-by: Tom Rini <trini@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

We weren't binding new worker threads to their cpu when onlining.  Using
preempt and the debug version of smp_processor_id found this.
Signed-off-by: Nathan Lynch <ntl@pobox.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This gets rid of a bug found in some IRQ handling logic, after tripping
a debug assertion.  Basically, a recent patch called the wrong routine to
unlink a QH.  Net result, it wasn't allowing for the case that some other
QH was already being unlinked.  This patch uses the correct routine; the
names are confusingly similar, and the effect is often identical.

The consequence of using the wrong routine was that the driver could
lose one of the pending unlinks (probably wedging some activity) and
treat the other one as completed before it was safe to do so (which
probably wouldn't oops, but could cause other nasty corruption).

From: Brian Murphy <brian@murphy.dk>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

This patch is clearly needed for us to be in compliance with the USB spec.
It adds the mandated recovery-time delay following a port reset.
Regardless of anything else we do to alter the device initialization
sequence, this is necessary.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Turns out that a workaround for a different EHCI chip trips up at
least one NForce4 board.  Neither controller can multiply right.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: David S. Miller <davem@davemloft.net>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

From: Art Haas

The current GCC cvs code does not like the include/linux/fb.h file:

In file included from drivers/video/aty/atyfb_base.c:63:
include/linux/fb.h:865: error: array type has incomplete element type

This error is due to recent changes in GCC. A thread discussing this
change can be found by following the link below:

http://gcc.gnu.org/ml/gcc/2005-02/msg00053.html

The patch moves the array declaration after the definition of the
fb_modelist structure, and with this small change GCC is happy once
again.
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

- Fix printing of running list, do not stop at first
  not-running device, instead scan them all.
- Do not free SKB before final access via show_results()
Signed-off-by: David S. Miller <davem@davemloft.net>

into nuts.davemloft.net:/disk1/BK/sparc-2.6

Errors should not be ignored, so add __must_check
tag to this function as well.
Signed-off-by: David S. Miller <davem@davemloft.net>

It appears that access to the PLL registers of the radeon chip is
unreliable while the card is in "legacy VGA" text mode. I don't have a
good explanation yet, it might be the BIOS mucking around behind my
back. This fixes the lockup by moving the code that enables/disables the
dynamic power management to after the mode is set.

I'm still waiting for a proper explanation from ATI...
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

CMSG reception needs to occur even if msg_name is not
set.
Signed-off-by: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch adds a net_device argument to ifdown.  After all,
it's a bit silly to notify someone of an ifdown event without
telling them what which device it was for :)
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

We checked the wrong byte, causing the touchpad
to lose sync if an absolute packet is received
after a relative packet with negative Y displacement.
Signed-off-by: Dmitry Torokhov <dtor_core@ameritech.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Noted while going through the n_tty code: that buffer check
used to check against the size of the temporary kernel buffer,
but since the tty layer was changed to use kernel buffers
though-out, the kernel buffer array became just a pointer, and
the check was limiting the opost blocksize to the size of a
pointer, which makes no sense.

Just remove it, since now the whole buffer is always in kernel
space.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

The NTTY code can get confused by 4kB chunks, apparently
because n_tty_receive_room() will claim to have more room
than n_tty_receive_buf() can actually accept.

Until somebody figures out what the real n_tty_receive_room()
logic should be, let's just limit it to a safe 2kB.

Thanks go to Andreas Schwab for finding a test-case.

Signed-off-by: Olaf Hering <olh@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

On Sparc, if the user does not specify a mode option, we
should use the PROM probed values in default_var always.
Signed-off-by: David S. Miller <davem@davemloft.net>