The linker script cleanup that I did in commit 5d150a97 ("um: Clean up
linker script using standard macros.") (2.6.32) accidentally introduced an
ALIGN(PAGE_SIZE) when converting to use INIT_TEXT_SECTION; Richard
Weinberger reported that this causes the kernel to segfault with
CONFIG_STATIC_LINK=y.

I'm not certain why this extra alignment is a problem, but it seems likely
it is because previously

__init_begin = _stext = _text = _sinittext

and with the extra ALIGN(PAGE_SIZE), _sinittext becomes different from the
rest.  So there is likely a bug here where something is assuming that
_sinittext is the same as one of those other symbols.  But reverting the
accidental change fixes the regression, so it seems worth committing that
now.
Signed-off-by: Tim Abbott <tabbott@ksplice.com>
Reported-by: Richard Weinberger <richard@nod.at>
Cc: Jeff Dike <jdike@addtoit.com>
Tested by: Antoine Martin <antoine@nagafix.co.uk>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

sgi-xp: incoming XPC channel messages can come in after the channel's partition structures have been torn down

Under some workloads, some channel messages have been observed being
delayed on the sending side past the point where the receiving side has
been able to tear down its partition structures.

This condition is already detected in xpc_handle_activate_IRQ_uv(), but
that information is not given to xpc_handle_activate_mq_msg_uv().  As a
result, xpc_handle_activate_mq_msg_uv() assumes the structures still exist
and references them, causing a NULL-pointer deref.
Signed-off-by: Robin Holt <holt@sgi.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This fixes a issue which was introduced by fe2cc53e ("uml: track and make
up lost ticks").

timeval_to_ns() returns long long and not int.  Due to that UML's timer
did not work properlt and caused timer freezes.
Signed-off-by: Richard Weinberger <richard@nod.at>
Acked-by: Pekka Enberg <penberg@kernel.org>
Cc: Jeff Dike <jdike@addtoit.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

There is a bug in commit 6dda9d55 ("page allocator: reduce fragmentation
in buddy allocator by adding buddies that are merging to the tail of the
free lists") that means a buddy at order MAX_ORDER is checked for merging.
 A page of this order never exists so at times, an effectively random
piece of memory is being checked.

Alan Curry has reported that this is causing memory corruption in
userspace data on a PPC32 platform (http://lkml.org/lkml/2010/10/9/32).
It is not clear why this is happening.  It could be a cache coherency
problem where pages mapped in both user and kernel space are getting
different cache lines due to the bad read from kernel space
(http://lkml.org/lkml/2010/10/13/179).  It could also be that there are
some special registers being io-remapped at the end of the memmap array
and that a read has special meaning on them.  Compiler bugs have been
ruled out because the assembly before and after the patch looks relatively
harmless.

This patch fixes the problem by ensuring we are not reading a possibly
invalid location of memory.  It's not clear why the read causes corruption
but one way or the other it is a buggy read.
Signed-off-by: Mel Gorman <mel@csn.ul.ie>
Cc: Corrado Zoccolo <czoccolo@gmail.com>
Reported-by: Alan Curry <pacman@kosh.dhis.org>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Christoph Lameter <cl@linux-foundation.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This comment landed in the wrong place.

Cc: Andi Kleen <andi@firstfloor.org>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: David Miller <davem@davemloft.net>
Cc: Eric Paris <eparis@redhat.com>
Cc: Jan Engelhardt <jengelh@medozas.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

scan_lru_pages returns pfn. So, it's type should be "unsigned long"
not "int".

Note: I guess this has been work until now because memory hotplug tester's
      machine has not very big memory....
      physical address < 32bit << PAGE_SHIFT.
Reported-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Reviewed-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* git://git.infradead.org/battery-2.6:
  power_supply: Makefile cleanup
  bq27x00_battery: Add missing kfree(di->bus) in bq27x00_battery_remove()
  power_supply: Introduce maximum current property
  power_supply: Add types for USB chargers
  ds2782_battery: Fix units
  power_supply: Add driver for TWL4030/TPS65950 BCI charger
  bq20z75: Add support for more power supply properties
  wm831x_power: Add missing kfree(wm831x_power) in wm831x_power_remove()
  jz4740-battery: Add missing kfree(jz_battery) in jz_battery_remove()
  ds2760_battery: Add missing kfree(di) in ds2760_battery_remove()
  olpc_battery: Fix endian neutral breakage for s16 values
  ds2760_battery: Fix W1 and W1_SLAVE_DS2760 dependency
  pcf50633-charger: Add missing sysfs_remove_group()
  power_supply: Add driver for TI BQ20Z75 gas gauge IC
  wm831x_power: Remove duplicate chg mask
  omap: rx51: Add support for USB chargers
  power_supply: Add isp1704 charger detection driver

* 'linux_next' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/i7core: (34 commits)
  i7core_edac: return -ENODEV when devices were already probed
  i7core_edac: properly terminate pci_dev_table
  i7core_edac: Avoid PCI refcount to reach zero on successive load/reload
  i7core_edac: Fix refcount error at PCI devices
  i7core_edac: it is safe to i7core_unregister_mci() when mci=NULL
  i7core_edac: Fix an oops at i7core probe
  i7core_edac: Remove unused member channels in i7core_pvt
  i7core_edac: Remove unused arg csrow from get_dimm_config
  i7core_edac: Reduce args of i7core_register_mci
  i7core_edac: Introduce i7core_unregister_mci
  i7core_edac: Use saved pointers
  i7core_edac: Check probe counter in i7core_remove
  i7core_edac: Call pci_dev_put() when alloc_i7core_dev()  failed
  i7core_edac: Fix error path of i7core_register_mci
  i7core_edac: Fix order of lines in i7core_register_mci
  i7core_edac: Always do get/put for all devices
  i7core_edac: Introduce i7core_pci_ctl_create/release
  i7core_edac: Introduce free_i7core_dev
  i7core_edac: Introduce alloc_i7core_dev
  i7core_edac: Reduce args of i7core_get_onedevice
  ...

* 'hwpoison' of git://git.kernel.org/pub/scm/linux/kernel/git/ak/linux-mce-2.6: (22 commits)
  Add _addr_lsb field to ia64 siginfo
  Fix migration.c compilation on s390
  HWPOISON: Remove retry loop for try_to_unmap
  HWPOISON: Turn addr_valid from bitfield into char
  HWPOISON: Disable DEBUG by default
  HWPOISON: Convert pr_debugs to pr_info
  HWPOISON: Improve comments in memory-failure.c
  x86: HWPOISON: Report correct address granuality for huge hwpoison faults
  Encode huge page size for VM_FAULT_HWPOISON errors
  Fix build error with !CONFIG_MIGRATION
  hugepage: move is_hugepage_on_freelist inside ifdef to avoid warning
  Clean up __page_set_anon_rmap
  HWPOISON, hugetlb: fix unpoison for hugepage
  HWPOISON, hugetlb: soft offlining for hugepage
  HWPOSION, hugetlb: recover from free hugepage error when !MF_COUNT_INCREASED
  hugetlb: move refcounting in hugepage allocation inside hugetlb_lock
  HWPOISON, hugetlb: add free check to dequeue_hwpoison_huge_page()
  hugetlb: hugepage migration core
  hugetlb: redefine hugepage copy functions
  hugetlb: add allocate function for hugepage migration
  ...

* 'for_linus' of git://github.com/at91linux/linux-2.6-at91:
  AT91: rtc: enable built-in RTC in Kconfig for at91sam9g45 family
  at91/atmel-mci: inclusion of sd/mmc driver in at91sam9g45 chip and board
  AT91: pm: make sure that r0 is 0 when dealing with cache operations
  AT91: pm: use plain cpu_do_idle() for "wait for interrupt"
  AT91: reset: extend alternate reset procedure to several chips
  AT91: reset routine cleanup, remove not needed icache flush
  AT91: trivial: align comment of at91sam9g20_reset with one more tab
  AT91: Fix AT91SAM9G20 reset as per the errata in the data sheet
  AT91: add board support for Pcontrol_G20

* 'for-linus' of git://gitorious.org/linux-omap-dss2/linux:
  OMAP: DSS2: don't power off a panel twice
  OMAP: DSS2: OMAPFB: Allow usage of def_vrfb only for omap2,3
  OMAP: DSS2: OMAPFB: make VRFB depends on OMAP2,3
  OMAP: DSS2: OMAPFB: Allow FB_OMAP2 to build without VRFB
  arm/omap: simplify conditional
  OMAP: DSS2: DSI: Remove extra iounmap in error path
  OMAP: DSS2: Use dss_features framework on DSS2 code
  OMAP: DSS2: Introduce dss_features files
  video/omap: remove mux.h include
  ARM: omap/fb: move get_fbmem_region() to .init.text
  ARM: omap/fb: move omapfb_reserve_sram to .init.text
  ARM: omap/fb: move omap_init_fb to .init.text
  OMAP: DSS2: OMAPFB: swap front and back porches for both hsync and vsync
  OMAP: DSS2: make filter coefficient tables human readable
  OMAP: DSS2: Add SPI dependency to Kconfig of ACX565AKM panel

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq:
  [CPUFREQ]: x86, cpufreq: Mark longrun_get_policy with __cpuinit.
  [CPUFREQ] add sampling_down_factor tunable to improve ondemand performance
  [CPUFREQ] arch/x86/kernel/cpu/cpufreq: Fix unsigned return type
  [CPUFREQ] drivers/cpufreq: Adjust confusing if indentation

* 'for-2.6.37' of git://linux-nfs.org/~bfields/linux: (99 commits)
  svcrpc: svc_tcp_sendto XPT_DEAD check is redundant
  svcrpc: no need for XPT_DEAD check in svc_xprt_enqueue
  svcrpc: assume svc_delete_xprt() called only once
  svcrpc: never clear XPT_BUSY on dead xprt
  nfsd4: fix connection allocation in sequence()
  nfsd4: only require krb5 principal for NFSv4.0 callbacks
  nfsd4: move minorversion to client
  nfsd4: delay session removal till free_client
  nfsd4: separate callback change and callback probe
  nfsd4: callback program number is per-session
  nfsd4: track backchannel connections
  nfsd4: confirm only on succesful create_session
  nfsd4: make backchannel sequence number per-session
  nfsd4: use client pointer to backchannel session
  nfsd4: move callback setup into session init code
  nfsd4: don't cache seq_misordered replies
  SUNRPC: Properly initialize sock_xprt.srcaddr in all cases
  SUNRPC: Use conventional switch statement when reclassifying sockets
  sunrpc/xprtrdma: clean up workqueue usage
  sunrpc: Turn list_for_each-s into the ..._entry-s
  ...

Fix up trivial conflicts (two different deprecation notices added in
separate branches) in Documentation/feature-removal-schedule.txt

* 'nfs-for-2.6.37' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:
  net/sunrpc: Use static const char arrays
  nfs4: fix channel attribute sanity-checks
  NFSv4.1: Use more sensible names for 'initialize_mountpoint'
  NFSv4.1: pnfs: filelayout: add driver's LAYOUTGET and GETDEVICEINFO infrastructure
  NFSv4.1: pnfs: add LAYOUTGET and GETDEVICEINFO infrastructure
  NFS: client needs to maintain list of inodes with active layouts
  NFS: create and destroy inode's layout cache
  NFSv4.1: pnfs: filelayout: introduce minimal file layout driver
  NFSv4.1: pnfs: full mount/umount infrastructure
  NFS: set layout driver
  NFS: ask for layouttypes during v4 fsinfo call
  NFS: change stateid to be a union
  NFSv4.1: pnfsd, pnfs: protocol level pnfs constants
  SUNRPC: define xdr_decode_opaque_fixed
  NFSD: remove duplicate NFS4_STATEID_SIZE

Enable built-in RTC IP in Kconfig and modify comments and help messages.
RTT as RTC is still available but should not be selected in common case.
Reported-by: Yegor Yefremov <yegor_sub1@visionsystems.de>
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>

This adds the support of atmel-mci sd/mmc driver in at91sam9g45 devices and
board files. This also configures the DMA controller slave interface for
at_hdmac dmaengine driver.
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>

When using CP15 cache operations (c7), we make sure that Rd (r0)
is actually 0 as ARM 926 TRM is saying.
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>

For power management at91_pm_enter() routine, use the cpu_do_idle() for a
rock solid "wait for interrupt" implementation.
For AT91SAM9 ARM 926 based chips, we can exceed the cache line length as
we can access RAM even while in self-refresh mode.
We keep plain access to CP15 for at91rm9200 as this feature is not
available: instructions have to be in a single cache line.
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>

Several at91sam9 chips need the alternate reset procedure to be sure to halt
SDRAM smoothly before resetting the chip.
This is an extension of previous patch "Fix AT91SAM9G20 reset" to all chips
affected.
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>

Generalize assembler reset routine to allow use on several at91sam9 chips.
This patch replace double definitions of SDRAM controller registers and RSTC
registers with use of classical header files.

For this rework, we remove the not needed icache flush as it is already
done in the calling function: arm_machine_restart().

Rename at91sam9g20_reset.S to generalize to several chips.
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>

Preparing next patch with longer names
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>

If the SDRAM is not cleanly shutdown before reset it can be left driving
the bus, which then stops the bootloader booting from NAND.
Signed-off-by: Peter Horton <phorton@bitbox.co.uk>
[nicolas.ferre@atmel.com: change file header line order]
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>

Board is a carrier board for Stamp9G20, with additional peripherals
for a building automation system
Signed-off-by: Peter Gsellmann <pgsellmann@portner-elektronik.at>
[nicolas.ferre@atmel.com: remove machine_desc.io_pg_offst and .phys_io]
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>

Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

The sanity checks here are incorrect; in the worst case they allow
values that crash the client.

They're also over-reliant on the preprocessor.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

* 'for-next' of git://android.git.kernel.org/kernel/tegra:
  spi: tegra: fix error setting on timeout
  spi: add spi_tegra driver
  tegra: harmony: enable PCI Express
  tegra: add PCI Express support
  tegra: add PCI Express clocks
  [ARM] tegra: Add APB DMA support
  [ARM] tegra: Add cpufreq support
  [ARM] tegra: common: Update common clock init table
  [ARM] tegra: clock: Add dvfs support, bug fixes, and cleanups
  [ARM] tegra: Add support for reading fuses
  [ARM] tegra: gpio: Add suspend and wake support
  [ARM] tegra: pinmux: add safe values, move tegra2, add suspend
  [ARM] tegra: add suspend and mirror irqs to legacy controller
  [ARM] tegra: Add legacy irq support
  [ARM] tegra: update iomap

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/vapier/blackfin:
  Blackfin: fix inverted anomaly 05000481 logic
  Blackfin: drop unused irq_panic()/DEBUG_ICACHE_CHECK
  Blackfin: ppi/spi/twi headers: add missing __BFP undef
  Blackfin: update defconfigs
  Blackfin: bfin_twi.h: start a common TWI header
  netdev: bfin_mac: push settings to platform resources

avoids derefencing an uninitialized pointer

Change-Id: Icf528441ae481e9f6f5ddc0be32c7c217fa49701
Signed-off-by: Erik Gilling <konkers@android.com>

* 'next' of git://git.monstr.eu/linux-2.6-microblaze: (42 commits)
  microblaze: Fix build with make 3.82
  fbdev/xilinxfb: Microblaze driver support
  microblaze: Support C optimized lib functions for little-endian
  microblaze: Separate library optimized functions
  microblaze: Support timer on AXI lite
  microblaze: Add support for little-endian Microblaze
  microblaze: KGDB little endian support
  microblaze: Add PVR for endians plus detection
  net: emaclite: Add support for little-endian platforms
  microblaze: trivial: Add comment for AXI pvr
  microblaze: pci-common cleanup
  microblaze: Support early console on uart16550
  microblaze: Do not compile early console support for uartlite if is disabled
  microblaze: Setup early console dynamically
  microblaze: Rename all uartlite early printk functions
  microblaze: remove early printk uarlite console dependency from header
  microblaze: Remove additional compatible properties
  microblaze: Remove hardcoded asm instraction for PVR loading
  microblaze: Use static const char * const where possible
  microblaze: Define VMALLOC_START/END
  ...

* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: (24 commits)
  hwmon: lis3: Release resources in case of failure
  hwmon: lis3: Short explanations of platform data fields
  hwmon: lis3: Enhance lis3 selftest with IRQ line test
  hwmon: lis3: use block read to access data registers
  hwmon: lis3: Adjust fuzziness for 8 bit device
  hwmon: lis3: New parameters to platform data
  hwmon: lis3: restore axis enabled bits
  hwmon: lis3: Power on corrections
  hwmon: lis3: Update coordinates at polled device open
  hwmon: lis3: Cleanup interrupt handling
  hwmon: lis3: regulator control
  hwmon: lis3: pm_runtime support
  Kirkwood: add fan support for Network Space Max v2
  hwmon: add generic GPIO fan driver
  hwmon: (coretemp) fix reading of microcode revision (v2)
  hwmon: ({core, pkg, via-cpu}temp) remove unnecessary CONFIG_HOTPLUG_CPU ifdefs
  hwmon: (pkgtemp) align driver initialization style with coretemp
  hwmon: LTC4261 Hardware monitoring driver
  hwmon: (lis3) add axes module parameter for custom axis-mapping
  hwmon: (hp_accel) Add HP Mini 510x family support
  ...

In the MN10300 arch, we occasionally see an assertion being tripped in
alloc_cwqs() at the following line:

        /* just in case, make sure it's actually aligned */
  --->  BUG_ON(!IS_ALIGNED(wq->cpu_wq.v, align));
        return wq->cpu_wq.v ? 0 : -ENOMEM;

The values are:

        wa->cpu_wq.v => 0x902776e0
        align => 0x100

and align is calculated by the following:

        const size_t align = max_t(size_t, 1 << WORK_STRUCT_FLAG_BITS,
                                   __alignof__(unsigned long long));

This is because the pointer in question (wq->cpu_wq.v) loses some of its
lower bits to control flags, and so the object it points to must be
sufficiently aligned to avoid the need to use those bits for pointing to
things.

Currently, 4 control bits and 4 colour bits are used in normal
circumstances, plus a debugging bit if debugging is set.  This requires
the cpu_workqueue_struct struct to be at least 256 bytes aligned (or 512
bytes aligned with debugging).

PERCPU() alignment on MN13000, however, is only 32 bytes as set in
vmlinux.lds.S.  So we set this to PAGE_SIZE (4096) to match most other
arches and stick a comment in alloc_cwqs() for anyone else who triggers
the assertion.
Reported-by: Akira Takeuchi <takeuchi.akr@jp.panasonic.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Mark Salter <msalter@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The only caller (svc_send) has already checked XPT_DEAD.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

If any xprt marked DEAD is also left BUSY for the rest of its life, then
the XPT_DEAD check here is superfluous--we'll get the same result from
the XPT_BUSY check just after.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

As long as DEAD exports are left BUSY, and svc_delete_xprt is called
only with BUSY held, then svc_delete_xprt() will never be called on an
xprt that is already DEAD.
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

Once an xprt has been deleted, there's no reason to allow it to be
enqueued--at worst, that might cause the xprt to be re-added to some
global list, resulting in later corruption.

Also, note this leaves us with no need for the reference-count
manipulation here.
Reviewed-by: NeilBrown <neilb@suse.de>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>

If lis3lv02d_init_device fails, HW resources were not released
properly. In case of failure call release_resources if available.
Signed-off-by: Samu Onkalo <samu.p.onkalo@nokia.com>
Acked-by: Eric Piel <eric.piel@tremplin-utc.net>
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>

No one uses these MMRs so we didn't notice when the anomaly handling
logic was inverted.
Reported-by: Robin Getz <robin.getz@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>

This code was useful during early port development when our icache code
wasn't solid, but that ship has sailed long ago, and no code calls this
function anymore (irq_panic).  So punt it.
Signed-off-by: Mike Frysinger <vapier@gentoo.org>

Short documentation at kernel doc format.
Signed-off-by: Samu Onkalo <samu.p.onkalo@nokia.com>
Acked-by: Jonathan Cameron <jic23@cam.ac.uk>
Acked-by: Eric Piel <eric.piel@tremplin-utc.net>
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>

Configure chip to data ready mode in selftest and count received
interrupts to see that interrupt line(s) are working.
Signed-off-by: Samu Onkalo <samu.p.onkalo@nokia.com>
Acked-by: Eric Piel <eric.piel@tremplin-utc.net>
Signed-off-by: Guenter Roeck <guenter.roeck@ericsson.com>