header_length and payload_length are filled with random data if an
unknown tcode was read from the AR buffer (i.e. if the AR buffer
contained invalid data).

We still need a better strategy to recover from this, but at least
handle_ar_packet now doesn't return out of bound buffer addresses
anymore.
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

BUG() at this place is wrong.  (Unless if the low level driver would
already do higher-level input validation of incoming request headers.)

Invalid incoming requests or bugs in the controller which corrupt the
AR-req buffer needlessly crashed the box because this is run in tasklet
context.
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: appletouch - implement reset-resume logic
  Input: i8042 - retry failed CTR writes when resuming
  Input: i8042 - add Fujitsu-Siemens Amilo Pro V2030 to nomux table
  Input: pcspkr - remove negative dependency on snd-pcsp

Manually fixed up trivial conflict in drivers/usb/core/quirks.c

Use max not min to enforce a lower limit on the max I/O size.

This bug was introduced by "fuse: fix max i/o size calculation" (commit
e5d9a0df).

Thanks to Brian Wang for noticing.
Reported-by: Brian Wang <ywang221@hotmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Acked-by: Szabolcs Szakacsits <szaka@ntfs-3g.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Added !vmlinux.lds.h to .gitignore because it would otherwise be ignored.
Signed-off-by: Eduard - Gabriel Munteanu <eduard.munteanu@linux360.ro>
Acked-by: Mathieu Desnoyers <mathieu.desnoyers@polymtl.ca>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Most users by far do not care about the exact return value (they only
really care about whether the copy succeeded in its entirety or not),
but a few special core routines actually care deeply about exactly how
many bytes were copied from user space.

And the unrolled versions of the x86-64 user copy routines would
sometimes report that it had copied more bytes than it actually had.

Very few uses actually have partial copies to begin with, but to make
this bug even harder to trigger, most x86 CPU's use the "rep string"
instructions for normal user copies, and that version didn't have this
issue.

To make it even harder to hit, the one user of this that really cared
about the return value (and used the uncached version of the copy that
doesn't use the "rep string" instructions) was the generic write
routine, which pre-populated its source, once more hiding the problem by
avoiding the exception case that triggers the bug.

In other words, very special thanks to Bron Gondwana who not only
triggered this, but created a test-program to show it, and bisected the
behavior down to commit 08291429 ("mm:
fix pagecache write deadlocks") which changed the access pattern just
enough that you can now trigger it with 'writev()' with multiple
iovec's.

That commit itself was not the cause of the bug, it just allowed all the
stars to align just right that you could trigger the problem.

[ Side note: this is just the minimal fix to make the copy routines
  (with __copy_from_user_inatomic_nocache as the particular version that
  was involved in showing this) have the right return values.

  We really should improve on the exceptional case further - to make the
  copy do a byte-accurate copy up to the exact page limit that causes it
  to fail.  As it is, the callers have to do extra work to handle the
  limit case gracefully. ]
Reported-by: Bron Gondwana <brong@fastmail.fm>
Cc: Nick Piggin <npiggin@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Andi Kleen <andi@firstfloor.org>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

 (which didn't have this problem), and since
most users that do the carethis was very hard to trigger, but

On some boxes the touchpad needs to be reinitialized after resume to make
it function again. This fixes bugzilla #10825.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

There are systems that fail in i8042_resume() with

	i8042: Can't write CTR to resume

as i8042_command(&i8042_ctr, I8042_CMD_CTL_WCTR) fails even though the
controller claimed itself to be ready before.

One retry after failing write fixes the problems on the failing systems.
Reported-by: Helmut Schaa <hschaa@novell.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mfasheh/ocfs2:
  ocfs2: Remove ->hangup() from stack glue operations.
  ocfs2: Move the call of ocfs2_hb_ctl into the stack glue.
  ocfs2: Move the hb_ctl_path sysctl into the stack glue.

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  [IA64] Fix CONFIG_IA64_SGI_UV build error
  [IA64] Update check_sal_cache_flush to use platform_send_ipi()
  [IA64] perfmon: fix async exit bug

The ->hangup() call was only used to execute ocfs2_hb_ctl.  Now that
the generic stack glue code handles this, the underlying stack drivers
don't need to know about it.
Signed-off-by: Joel Becker <joel.becker@oracle.com>
Signed-off-by: Mark Fasheh <mfasheh@suse.com>

Take o2hb_stop() out of the o2cb code and make it part of the generic
stack glue as ocfs2_leave_group().  This also allows us to remove the
ocfs2_get_hb_ctl_path() function - everything to do with hb_ctl is now
part of stackglue.c.  o2cb no longer needs a ->hangup() function.
Signed-off-by: Joel Becker <joel.becker@oracle.com>
Signed-off-by: Mark Fasheh <mfasheh@suse.com>

ocfs2 needs to call out to the hb_ctl program at unmount for all cluster
stacks.  The first step is to move the hb_ctl_path sysctl out of the
o2cb code and into the generic stack glue.
Signed-off-by: Joel Becker <joel.becker@oracle.com>
Signed-off-by: Mark Fasheh <mfasheh@suse.com>

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: (21 commits)
  [POWERPC] Turn on ATA_SFF so we get SATA_SVW back in defconfigs
  [POWERPC] Remove ppc32's export of console_drivers
  [POWERPC] Fix -Os kernel builds with newer gcc versions
  [POWERPC] Fix bootwrapper builds with newer gcc versions
  [POWERPC] Build fix for drivers/macintosh/mediabay.c
  [POWERPC] Fix warning in pseries/eeh_driver.c
  [POWERPC] Add missing of_node_put in drivers/macintosh/therm_adt746x.c
  [POWERPC] Add missing of_node_put in drivers/macintosh/smu.c
  [POWERPC] Add missing of_node_put in pseries/nvram.c
  [POWERPC] Fix return value check logic in debugfs virq_mapping setup
  [POWERPC] Fix rmb to order cacheable vs. noncacheable
  powerpc/spufs: fix missed stop-and-signal event
  powerpc/spufs: synchronize interaction between spu exception handling and time slicing
  powerpc/spufs: remove class_0_dsisr from spu exception handling
  powerpc/spufs: wait for stable spu status in spu_stopped()
  [POWERPC] bootwrapper: add simpleImage* to list of boot targets
  [POWERPC] 83xx: MPC837xRDB's VSC7385 ethernet switch isn't on the MDIO bus
  [POWERPC] Updated Freescale PPC defconfigs
  [POWERPC] 8610: Update defconfig for MPC8610 HPCD
  [POWERPC] 85xx: MPC8548CDS - Fix size of PCIe IO space
  ...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  sound: oxygen: fix NULL pointer dereference when loading snd-oxygen

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] Au1200: MMC resource size off by one
  [MIPS] TANBAC: Update defconfig
  [MIPS] Vr41xx: Initialize PCI io_map_base
  [MIPS] Malta: Always compile MTD platform device registration code.
  [MIPS] Malta: Fix build errors for 64-bit kernels
  [MIPS] Lasat: sysctl fixup
  [MIPS] Fix buggy use of kmap_coherent.
  [MIPS] Lasat: bring back from the dead
  [MIPS] vpe_id is required for VSMP and SMTC builds
  [MIPS] Export smp_call_function and smp_call_function_single.
  [MIPS] Bring the SWARM defconfig up to date
  [MIPS] Sibyte: Build RTC support as an object
  [MIPS] Fix the fix for divide by zero error in build_{clear,copy}_page
  [MIPS] Fix build for PNX platforms.
  [MIPS] Add RM200 with R5000 CPU to known ARC machines
  [MIPS] Better load address for big endian SNI RM
  [MIPS] SB1250: Initialize io_map_base
  [MIPS] Alchemy: Add au1500 reserved interrupt
  [MIPS] Export empty_zero_page for sake of the ext4 module.

This seems to have been removed accidentally in commit
ed7b1889 ("Unexport asm/page.h"), but
wasn't supposed to have been -- the original patch at
http://lkml.org/lkml/2007/10/30/144 just moved it from $(header-y) to
$(unifdef-y)
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This file is only included where it makes sense now, so there's no need
for the CONFIG_ARCH_SUPPORTS_AOUT conditional -- and that conditional is
bad, because we want to export <linux/a.out.h> to userspace.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

In commit d20894a2 ("Remove a.out
interpreter support in ELF loader"), Andi removed support for a.out
interpreters from the ELF loader, which was only ever needed for the
transition from a.out to ELF.

This removes the last traces of that support, in particular the
inclusion of <linux/a.out.h>.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

We only need it for the /sbin/loader hack for OSF/1 executables, and we
don't want to include it otherwise.

While we're at it, remove the redundant '&& CONFIG_ARCH_SUPPORTS_AOUT'
in the ifdef around that code. It's already dependent on __alpha__, and
CONFIG_ARCH_SUPPORTS_AOUT is hard-coded to 'y' there.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Kill linux/a.out.h inclusions in the MN10300 arch code.
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix build error in CONFIG_IA64_SGI_UV config. (GENERIC builds
are ok).
Signed-off-by: Jack Steiner <steiner@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

Au12x0 MMC platform device strangely claims 0x41 bytes for its
memory-mapped registers.  Make it claim the whole 0x80000 instead according
to the memory map given in the datasheets.
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

These boards need cca setup on CMDLINE.
Signed-off-by: Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Fix 64-bit Malta by using CKSEG0ADDR and correct casts.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

LASAT's sysctl interface was broken, it failed a check during boot because
a single entry had a sysctl number and the rest were unnumbered. When I
fixed it I noticed that the whole sysctl file needed a spring clean, it was
using mutexes where it wasn't needed (it's only needed to protect during
writes to the EEPROM), so I moved that stuff out and generally cleaned the
whole thing up.

So now, LASAT's sysctl/proc interface is working again.
Signed-off-by: Thomas Horsten <thomas@horsten.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Assuming the call of kmap_coherent in local_r4k_flush_cache_page doesn't
need fixing this was skipped in fcae549295bcae801ac48fc1c2030ab8cc487020.
Turns out it needed the same change after all.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

After the common MIPS CPU interrupt controller (for irq0-7) was introduced
the Lasat boards didn't get their interrupts right, so nothing worked. The
old routines need to be offset by the new 8 hardware interrupts common to
all MIPS CPU's.
Signed-off-by: Thomas Horsten <thomas@horsten.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Chris Dearman <chris@mips.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Chris Dearman <chris@mips.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 The SWARM defconfig file has not been regenerated for over a year now.
Here is a patch to bring the file up to date.  Additionally some important
and sometimes confusing changes happened meanwhile.  Here is the list of
notable corresponding updates to the configuration:

1. CPU_SB1_PASS_2_2 is now selected rather than CPU_SB1_PASS_1.  The
   latter requires a non-standard -msb1-pass1-workarounds option to be
   supported by GCC and I am told is quite rare anyway.

   [Ralf: Afaik -msb1-pass1-workarounds is available only in Monta Vista's
   special Sibyte gcc 3.0 variant and gcc 3.0 is too old to build a modern
   kernel anyway.]

2. PHYLIB and BROADCOM_PHY are both built in and NETDEV_1000 enabled as
   required by SB1250_MAC.

3. USB and USB_OHCI_HCD are enabled as there is an OHCI chip onboard.

4. TMPFS is enabled, because I use it. ;-)
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

 Build the SWARM platform library is as an object rather than an archive
so that files which only contain symbols used by initcalls and do not
provide any symbols that would pull them from an archive still work.
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Build error was caused by commit 35133692.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

RM200 with R5ks have a little bit different arcname.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Use better load address for big endian kernels to avoid clashes with
PROM / SASH.
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Correctly initialize io_map_base for the SB1250 PCI controller as required
for proper iomap support.  Based on a proposal from Daniel Jacobowitz.
Signed-off-by: Maciej W. Rozycki <macro@linux-mips.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

In the conversion done in the commits

  95c4eb3ef4484ca85da5c98780d358cffd546b90
  9d360ab4

  [MIPS] Alchemy: Renumber interrupts so irq_cpu can work.

one reserved interrupt on au1500 was missed. this broke the au1000 ethernet
driver.
Signed-off-by: Bruno Randolf <br1@einfach.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>