Merge arch/ppc64/kernel/vio.c into arch/powerpc/kernel/vio.c, update
the Makefiles to make it work, and make ARCH=ppc64 still work.

Michael's version put vio.c in arch/powerpc/sysedv but after consolting
Paulus, this one puts it in arch/powerpc/kernel.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

Previously it claimed 7MB starting at the 9M point and loaded the
kernel there.  That meant that prom_init put the flattened device
tree above 16M.  On the 601 that caused the early device tree scan
to fail, since only 16MB are mapped with BATs on the 601.  Moving
this down to 8MB allows prom_init to put the flattened device tree
between 15M and 16M, so it works on the 601.
Signed-off-by: Paul Mackerras <paulus@samba.org>

Old powermacs have a number of differences from current machines:
- there is no interrupt tree in the device tree, just interrupt
  or AAPL,interrupt properties
- the chosen node in the device tree is called /chosen@0
- the OF claim method doesn't map the memory, so we have to do
  an explicit map call as well
- there is no /chosen/cpu property on SMP machines
- the NVRAM isn't structured as a set of partitions.

This adapts the merged powermac support code to cope with these
issues.
Signed-off-by: Paul Mackerras <paulus@samba.org>

The 601 doesn't have the timebase register; instead it has an RTCL
register that counts nanoseconds and wraps at 1000000000, and an
RTCU register that counts seconds.  This makes the necessary changes
for the merged time code to use the RTCL/U registers when the kernel
is running on a 601.
Signed-off-by: Paul Mackerras <paulus@samba.org>

This switches the ARCH=ppc64 build to use arch/powerpc/platforms/powermac
instead of arch/ppc64/kernel/pmac*, and deletes the latter set of files.
Signed-off-by: Paul Mackerras <paulus@samba.org>

This brings in a lot of changes from arch/ppc64/kernel/pmac_*.c to
arch/powerpc/platforms/powermac/*.c and makes various minor tweaks
elsewhere.  On the powermac we now initialize ppc_md by copying
the whole pmac_md structure into it, which required some changes in
the ordering of initializations of individual fields of it.
Signed-off-by: Paul Mackerras <paulus@samba.org>

Previously it ignored the return value from ppc_md.set_rtc_time,
but in fact the functions that that can point to do return a
useful error code, so return it from set_rtc_time().
Signed-off-by: Paul Mackerras <paulus@samba.org>

... for consistency with ppc32, and because this way is neater.
Signed-off-by: Paul Mackerras <paulus@samba.org>

Moved init_boot_display from arch/ppc64/kernel/pmac_setup.c to
arch/ppc64/kernel/btext.c and declared it in asm-ppc64/btext.h.
Call it from init_early rather than pmac_init_early.
Signed-off-by: Paul Mackerras <paulus@samba.org>

... for consistency with ppc32 and to make the powermac merge easier.
Also make it use just a single resource in the host bridge for multiple
consecutive elements of the ranges property.
Signed-off-by: Paul Mackerras <paulus@samba.org>

This moves smp_space_timers from arch/ppc64/kernel/smp.c to
arch/powerpc/kernel/time.c and makes it initialize last_jiffy[]
instead of paca[].next_jiffy_update_tb, since last_jiffy[] is
now what the time code uses.  It also declares smp_space_timers
in include/asm-powerpc/time.h and gets rid of an ifdef in
div128_by_32.
Signed-off-by: Paul Mackerras <paulus@samba.org>

An error in merging led to 32-bit processes getting the wrong link
register value on entry to RT signal handlers, and the wrong stack
chain as well.  This fixes it.
Signed-off-by: Paul Mackerras <paulus@samba.org>

... instead of exporting it in arch/*/kernel/ppc_ksyms.c.
Signed-off-by: Paul Mackerras <paulus@samba.org>

Not sure how it slipped by, but here's a trivial typo fix for powernow.
Signed-off-by: Chris Wright <chrisw@osdl.org>
[ It's "nurter" backwards.. Maybe we have a hillbilly The Shining fan? ]
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

When I originally moved exit_itimers into __exit_signal, that was the only
place where we could reliably know it was the last thread in the group
dying, without races.  Since then we've gotten the signal_struct.live
counter, and do_exit can reliably do group-wide cleanup work.

This patch moves the call to do_exit, where it's made without locks.  This
avoids the deadlock issues that the old __exit_signal code's comment talks
about, and the one that Oleg found recently with process CPU timers.

[ This replaces e03d13e9, which is why
  it was just reverted. ]
Signed-off-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Revert commit e03d13e9, to be replaced
by a much nicer fix from Roland.

AMD recently discovered that on some hardware, there is a race condition
possible when a C-state change request goes onto the bus at the same
time as a P-state change request.

Both requests happen, but the southbridge hardware only acknowledges the
C-state change.  The PowerNow! driver is then stuck in a loop, waiting
for the P-state change acknowledgement.  The driver eventually times
out, but can no longer perform P-state changes.

It turns out the solution is to resend the P-state change, which the
southbridge will acknowledge normally.

Thanks to Johannes Winkelmann for reporting this and testing the fix.
Signed-off-by: Mark Langsdorf <mark.langsdorf@amd.com>
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This fixes a stupid typo bug in the iSeries hash table code.

When we place a hash PTE in the secondary bucket, instead of setting the
SECONDARY flag bit, as we should, we (redundantly) set the VALID flag.

This was introduced with the patch abolishing bitfields from the hash
table code.  Mea culpa, oops.  It hasn't been noticed until now because
in practice we don't hit the secondary bucket terribly often.
Signed-off-by: David Gibson <dwg@au1.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The wrong state emission routines were being called for G550, and
consistent maps weren't correctly mapped...
Signed-off-by: Dave Airlie <airlied@linux.ie>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

While working on 64K pages, I found this little buglet in our
update_mmu_cache() implementation.

The code calls __hash_page() passing it an "access" parameter (the type
of access that triggers the hash) containing the bits _PAGE_RW and
_PAGE_USER of the linux PTE.  The latter is useless in this case and the
former is wrong.  In fact, if we have a writeable PTE and we pass
_PAGE_RW to hash_page(), it will set _PAGE_DIRTY (since we track dirty
that way, by hash faulting !dirty) which is not what we want.

In fact, the correct fix is to always pass 0. That means that only
read-only or already dirty read write PTEs will be preloaded. The
(hopefully rare) case of a non dirty read write PTE can't be preloaded
this way, it will have to fault in hash_page on the actual access.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This fixes a typo in the div128_by_32 function used in the timekeeping
calculations on ppc64.  If you look at the code it's quite obvious
that we need (rb + c) rather than (rb + b).  The "b" is clearly just a
typo.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This fixes handling of the phy identifiers in mptsas.
Signed-off-by: Eric Moore <Eric.Moore@lsil.com>
[ split it a pre-2.6.14 portion from Eric's bigger patch ]
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The merge of syscalls.c & sys_ppc32.c (30286ef6)
broke mmap, if the mmap returned a 64 bit address.

do_mmap2 was taking the return value from do_mmap_pgoff (an unsigned long), and
storing it in an int, before returning it to sys_mmap as an unsigned long. So
we were losing the high bits of the address.

You would have thought the compiler could catch this for us ...
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>

The patch to make process.c work for 32-bit and 64-bit
(06d67d54) broke some 64-bit binaries.
We were blowing away load_addr in gpr[2], so we weren't properly relocating
the entry point.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Merge ppc32 and ppc64 versions of thread_info.h.  They were pretty
similar already, the chief changes are:

	- Instead of inline asm to implement current_thread_info(),
which needs to be different for ppc32 and ppc64, we use C with an
asm("r1") register variable.  gcc turns it into the same asm as we
used to have for both platforms.
	- We replace ppc32's 'local_flags' with the ppc64
'syscall_noerror' field.  The noerror flag was in fact the only thing
in the local_flags field anyway, so the ppc64 approach is simpler, and
means we only need a load-immediate/store instead of load/mask/store
when clearing the flag.
	- In readiness for 64k pages, when THREAD_SIZE will be less
than a page, ppc64 used kmalloc() rather than get_free_pages() to
allocate the kernel stack.  With this patch we do the same for ppc32,
since there's no strong reason not to.
	- For ppc64, we no longer export THREAD_SHIFT and THREAD_SIZE
via asm-offsets, thread_info.h can now be safely included in asm, as
on ppc32.

Built and booted on G4 Powerbook (ARCH=ppc and ARCH=powerpc) and
Power5 (ARCH=ppc64 and ARCH=powerpc).
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>

In the merge tree, commit 0458060c
broke boot on some machines because the initialization of conswitchp
was moved to arch/powerpc/kernel/setup_64.c, but a corresponding copy
was not added to arch/ppc64/kernel/setup.c.  This patch fixes it.
Signed-off-by: David Gibson <dwg@au1.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Ben Dooks

From: Guillaume Gourat <guillaume.gourat@nexvision.fr>

Add MASK definitions for DCLK0 and DCLK1
Signed-off-by: Guillaume Gourat <guillaume.gourat@nexvision.fr>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Ben Dooks

The current Simtec BAST nand area timings are a little
too slow to be obtained by a 2410 running at 266MHz,
so reduce the timings slightly to bring them into the
acceptable range.
Signed-off-by: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Ben Dooks

Avoid the possiblity that if the board is using
a 16.9334 or higher crystal with a high PLL
multiplier, then the pll value could overflow
the capability of an int.

Also fix the value types of the intermediate
variables to unsigned int.

Rewrite of patch from Guillaume Gourat
Signed-off-by: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Patch from Matt Reimer

Adds an I2S platform_device for PXA. I2S is used to interface
with sound chips on systems like iPAQ h1910/h2200/hx4700 and
Asus 716.

Signed-off-by: mreimer@vpop.net
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

It is legitimate to call tcp_fragment with len == skb->len since
that is done for FIN packets and the FIN flag counts as one byte.
So we should only check for the len > skb->len case.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>

Turns out the problem has nothing to do with use-after-free or double-free.
It's just that we're not clearing the CB area and DCCP unlike TCP uses a CB
format that's incompatible with IP.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Ian McDonald <imcdnzl@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>

icmp_send doesn't use skb->sk at all so even if skb->sk has already
been freed it can't cause crash there (it would've crashed somewhere
else first, e.g., ip_queue_xmit).

I found a double-free on an skb that could explain this though.
dccp_sendmsg and dccp_write_xmit are a little confused as to what
should free the packet when something goes wrong.  Sometimes they
both go for the ball and end up in each other's way.

This patch makes dccp_write_xmit always free the packet no matter
what.  This makes sense since dccp_transmit_skb which in turn comes
from the fact that ip_queue_xmit always frees the packet.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>

David S. Miller <davem@davemloft.net> wrote:
> One thing you can probably do for this bug is to mark data packets
> explicitly somehow, perhaps in the SKB control block DCCP already
> uses for other data.  Put some boolean in there, set it true for
> data packets.  Then change the test in dccp_transmit_skb() as
> appropriate to test the boolean flag instead of "skb_cloned(skb)".

I agree.  In fact we already have that flag, it's called skb->sk.
So here is patch to test that instead of skb_cloned().
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Ian McDonald <imcdnzl@gmail.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>

This reverts commit 3359b54c and
replaces it with a cleaner version that is purely based on page table
operations, so that the synchronization between inode size and hugetlb
mappings becomes moot.
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

I had the sense of the test for when to use the old 601-style RTC
registers inverted.  pmac_calibrate_decr and via_calibrate_decr
weren't setting ppc_tb_freq, on which all the further calculations
depended.  Lastly, update_gtod was losing the top 32 bits of
the new tb_to_xs value.
Signed-off-by: Paul Mackerras <paulus@samba.org>