KVM shadow page tables are always in pae mode, regardless of the guest
setting.  This means that a guest pde (mapping 4MB of memory) is mapped
to two shadow pdes (mapping 2MB each).

When the guest writes to a pte or pde, we intercept the write and emulate it.
We also remove any shadowed mappings corresponding to the write.  Since the
mmu did not account for the doubling in the number of pdes, it removed the
wrong entry, resulting in a mismatch between shadow page tables and guest
page tables, followed shortly by guest memory corruption.

This patch fixes the problem by detecting the special case of writing to
a non-pae pde and adjusting the address and number of shadow pdes zapped
accordingly.
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Avi Kivity <avi@qumranet.com>

The vmx code currently treats the guest's sysenter support msrs as 32-bit
values, which breaks 32-bit compat mode userspace on 64-bit guests.  Fix by
using the native word width of the machine.
Signed-off-by: Avi Kivity <avi@qumranet.com>

Otherwise, the core module thinks the arch module is loaded, and won't
let you reload it after you've fixed the bug.
Signed-off-by: Avi Kivity <avi@qumranet.com>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: Use Kconfig.preempt

* master.kernel.org:/pub/scm/linux/kernel/git/bart/ide-2.6:
  ide: remove CONFIG_IDEDMA_{ICS,PCI}_AUTO config options
  ide: don't allow DMA to be enabled if CONFIG_IDEDMA_{ICS,PCI}_AUTO=n
  scc_pata: dependency fix
  jmicron: make ide jmicron driver play nice with libata ones
  ide: remove static prototypes from include/asm-mips/mach-au1x00/au1xxx_ide.h
  ide: au1xxx: fix use of mixed declarations and code
  cmd64x: fix recovery time calculation (take 3)

* 'for-linus' of git://one.firstfloor.org/home/andi/git/linux-2.6:
  [PATCH] x86: Export _proxy_pda for gcc 4.2
  [PATCH] i386: Don't use the TSC in sched_clock if unstable
  [PATCH] x86-64: fix section mismatch warnings
  [PATCH] i386: Enforce GPLness of VMI ROM
  [PATCH] x86-64: wire up compat sched_rr_get_interval(2)
  [PATCH] i386: Update defconfig
  [PATCH] x86-64: Update defconfig

Signed-off-by: David S. Miller <davem@davemloft.net>

All modern distributions have been setting these options to "y" for ages.
(additionally "n" cases have been obsoleted for few years).  Therefore use
DMA by default and remove CONFIG_IDEDMA_{ICS,PCI}_AUTO (also remove no longer
needed CONFIG_IDEDMA_AUTO).  This fixes DMA support for rare configurations
where CONFIG_IDEDMA_{ICS,PCI}_AUTO was set to "n" but "hdparm -d 1" was used
to enable DMA support and which were forced to PIO mode by "ide: don't allow
DMA to be enabled if CONFIG_IDEDMA_{ICS,PCI}_AUTO=n" patch.  There is no
functionality loss because "ide=nodma" kernel option is still available.

Cc: Patrick Horn <phrh@yahoo.com>
Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Cc: Russell King <rmk+lkml@arm.linux.org.uk>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

For CONFIG_IDEDMA_{ICS,PCI}_AUTO=n and/or "ide=nodma" option the host/device
are not programmed for DMA and it is also explicitly disabled by ide_set_dma()
(->ide_dma_check returns "-1").  However the code responsible for manually
enabling DMA ("hdparm -d 1") has a bug which results in DMA being erroneously
enabled - ide_set_dma() incorrectly passes "0" return value to set_using_dma().
This may work if BIOS/firmware configured the host/device for DMA and chipset
allows independent configuration of DMA/PIO modes but won't work after suspend
and is generally unsafe on many chipsets (possibly including data corruption
if the same registers are used for DMA/PIO timings).

This patch fixes kernel bugzilla bug #8169 (piix host driver fixes for
setting PIO mode exposed the problem described above).  The side-effect of
the fix is that some rare configuration may be forced to PIO mode when DMA
mode was previously used - this is addressed by the next patch which removes
CONFIG_IDEDMA_{PCI,ICS}_AUTO config option completely.

Thanks goes out to Patrick Horn for reporting the issue, narrowing it down
to the specific commit and testing the fix.  Also thanks to Sergei Shtylyov
for help in debugging the problem.

Cc: Patrick Horn <phrh@yahoo.com>
Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Cc: Russell King <rmk+lkml@arm.linux.org.uk>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

This patch fixes:
* the dependency of scc_pata on BLK_DEV_IDEDMA_PCI
* incorrect link to ide-core
* move scc_pata from ide/ppc to ide/pci
Signed-off-by: Kou Ishizaki <kou.ishizaki@toshiba.co.jp>
Signed-off-by: Akira Iguchi <akira2.iguchi@toshiba.co.jp>
Cc: Al Viro <viro@ftp.linux.org.uk>,
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

When libata is configured, the device is configured such that SATA and
PATA ports live in separate functions with different programming
interfaces.  pata_jmicron and ide jmicron drivers can drive only the
PATA part.

This patch makes jmicron match PCI class code such that it doesn't
attach itself to the SATA part preventing the proper ahci driver from
attaching.

This change is suggested by Bartlomiej.
Signed-off-by: Tejun Heo <htejun@gmail.com>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: justin@jmicron.com
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

This patch removes the static prototypes from the au1xxx_ide.h, some of
them were not even implemented. Also, they caused build breakage since
they differed from the functions actually implemented in
drivers/ide/mips/au1xxx-ide.c.
Signed-off-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

drivers/ide/mips/au1xxx-ide.c:684: warning: ISO C90 forbids mixed declarations and code
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

The driver wrongly takes the address setup time into account when calculating
the PIO recovery time -- this leads to slight overclocking of the PIO modes 0
and 1 (so, the prayers failed to help, as usual :-).  Rework the code to be
calculating recovery clock count as a difference between the total cycle count
and the active count (we don't need to calculate the recovery time itself since
it's not specified for the PIO modes 0 to 2, and for modes 3 and 4 this formula
gives enough recovery time anyway in the chip's supported PCI frequency range).

This patch has been inspired by reading the datasheets and looking at what the
libata driver does; it has been compile-tested only (as usual :-) but anyway,
the new code gives the same or longer recovery times than the old one...
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

I finally found a dual core box, which survives suspend/resume without
crashing in the middle of nowhere. Sigh, I never figured out from the
code and the bug reports what's going on.

The observed hangs are caused by a stale state transition of the clock
event devices, which keeps the RCU synchronization away from completion,
when the non boot CPU is brought back up.

The suspend/resume in oneshot mode needs the similar care as the
periodic mode during suspend to RAM. My assumption that the state
transitions during the different shutdown/bringups of s2disk would go
through the periodic boot phase and then switch over to highres resp.
nohz mode were simply wrong.

Add the appropriate suspend / resume handling for the non periodic
modes.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [IPV6]: ipv6_fl_socklist is inadvertently shared.
  [TCP]: Fix tcp_mem[] initialization.
  [NET]: Copy mac_len in skb_clone() as well
  [IPV4]: Do not disable preemption in trie_leaf_remove().

* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: Get DEBUG_PAGEALLOC working again.

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] Kconfig: Move missplaced NR_CPUS default from SMTC to VSMP.
  [MIPS] Lockdep: Fix recursion bug.
  [MIPS] RTLX: Handle copy_*_user return values.
  [MIPS] RTLX: Protect rtlx_{read,write} with mutex.
  [MIPS] RTLX: Harden against compiler reordering and optimization.
  [MIPS] RTLX: Don't use volatile; it's fragile.
  [MIPS] Lasat: Downgrade 64-bit kernel from experimental to broken.
  [MIPS] Compat: Fix build if CONFIG_SYSVIPC is disabled.
  [CHAR] lcd: Fix two warnings.
  [MIPS] FPU ownership management & preemption fixes
  [MIPS] Check FCSR for pending interrupts, alternative version
  [MIPS] IP27, IP35: Fix warnings.

The maximum seconds value we can handle on 32bit is LONG_MAX.

Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix typo in sync_constant_test_bit()'s name, so sync_bitops.h is consistent
with bitops.h
Signed-off-by: Jeremy Fitzhardinge <jeremy@xensource.com>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Acked-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The set_cs field of struct s3c24xx_spi is declared as returning a int but
the value returned but set_cs is never fixed.  Moreover, the default
function for set_cs and the set_cs defintion in the platform data are
returning void.

I'm proposing to change the prototype to void (*set_cs)(...). By doing
this, I'm also fixing 2 build warnings:

  drivers/spi/spi_s3c24xx.c: In function 's3c24xx_spi_probe':
  drivers/spi/spi_s3c24xx.c:330: warning: assignment from incompatible pointer type
  drivers/spi/spi_s3c24xx.c:335: warning: assignment from incompatible pointer type
Signed-off-by: Arnaud Patard <arnaud.patard@rtp-net.org>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This bug was seen on ppc64, but it could have occurred on any
architecture with a page size of 64k or above.  The problem is that in
fs/binfmt_elf.c:randomize_stack_top() randomizes the stack to within
0x7ff pages.  On 4k page machines, this is 8MB; on 64k page boxes, this
is 128MB.

The problem is that the new binary layout (selected in
arch_pick_mmap_layout) places the mapping segment 128MB or the stack
rlimit away from the top of the process memory, whichever is larger.  If
you chose an rlimit of less than 128MB (most defaults are in the 8Mb
range) then you can end up having your entire stack randomized away.

The fix is to make randomize_stack_top() only steal at most 8MB, which this
patch does.  However, I have to point out that even with this, your stack
rlimit might not be exactly what you get if it's > 128MB, because you're
still losing the random offset of up to 8MB.

The true fix should be to leave an explicit gap for the randomization plus
a buffer when determining mmap_base, but that would involve fixing all the
architectures.

Cc: Arjan van de Ven <arjan@infradead.org>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fixes a bogus lockdep warning which causes lockdep to disable itself.
Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Looking at oom_kill.c, found that the intention to not kill the selected
process if any of its children/siblings has OOM_DISABLE set, is not being
met.
Signed-off-by: Ankita Garg <ankita@in.ibm.com>
Acked-by: Nick Piggin <npiggin@suse.de>
Acked-by: William Irwin <wli@holomorphy.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Remove the misleading "Presently only useful on the IA-64 platform" text
from the EFI partition Kconfig.

EFI partitions are also used by Apple on their Intel-based machines and
thus you need EFI partition support if you (for example) want to attach
such a machine in target disk mode.
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Acked-by: Matt Domsch <Matt_Domsch@dell.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Testing of -rt by IBM uncovered a locking bug in wake_futex_pi(): the PI
state needs to be locked before we access it.
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Acked-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Chuck Ebbert <cebbert@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: Marcel Selhorst <tpm@selhorst.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Initialise the SAK member of the vc_cons variable on all virtual terminals,
not only the first one.  This prevents an oops when trying Sysrq-C on e.g.
the second virtual terminal:

  kernel BUG at kernel/workqueue.c:212!
  invalid opcode: 0000 [1] SMP
  CPU 0
  Modules linked in: i915 drm deflate zlib_deflate twofish twofish_common serpent blowfish des ce
  Pid: 0, comm: swapper Not tainted 2.6.21-rc3-default #15
  RIP: 0010:[<ffffffff8028c955>]  [<ffffffff8028c955>] queue_work+0x32/0x51
  RSP: 0018:ffffffff805fada8  EFLAGS: 00010013
  RAX: ffffffff80683f38 RBX: ffffffff804ae700 RCX: 0000000000000000
  RDX: 0000000000000000 RSI: ffffffff80683f30 RDI: ffff81000134a840
  RBP: 0000000000000001 R08: 0000000000000005 R09: 0000000000000002
  R10: ffffffff805990e0 R11: ffff810037f4c0f0 R12: 000000000000006b
  R13: ffff81007aa23000 R14: 0000000000000001 R15: 0000000000000096
  FS:  0000000000000000(0000) GS:ffffffff804d8000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
  CR2: 00002b72026e9000 CR3: 0000000079175000 CR4: 00000000000006e0
  Process swapper (pid: 0, threadinfo ffffffff8059e000, task ffffffff80490840)
  Stack:  0000000000000096 ffffffff803635db ffffffff805fadf8 0000000000000001
   ffff8100013c2e40 0000000000000025 ffff81007c931c00 ffff81007aa23000
   0000000000000001 ffffffff8035e3ee 0000000000000092 ffff810037cc8000
  Call Trace:
   <IRQ>  [<ffffffff803635db>] __handle_sysrq+0x98/0x129
   [<ffffffff8035e3ee>] kbd_event+0x32e/0x56a
   [<ffffffff8037d502>] input_event+0x422/0x44a
   [<ffffffff80381d71>] atkbd_interrupt+0x449/0x503
   [<ffffffff8037a42d>] serio_interrupt+0x37/0x6f
   [<ffffffff8037affb>] i8042_interrupt+0x1f4/0x20a
   [<ffffffff8026bd20>] smp_send_timer_broadcast_ipi+0x2d/0x4e
   [<ffffffff8020eee5>] handle_IRQ_event+0x25/0x53
   [<ffffffff802a924c>] handle_edge_irq+0xe4/0x128
   [<ffffffff802562ac>] call_softirq+0x1c/0x28
   [<ffffffff802632eb>] do_IRQ+0x6c/0xd3
   [<ffffffff8024f4e7>] mwait_idle+0x0/0x45
   [<ffffffff80255631>] ret_from_intr+0x0/0xa
   <EOI>  [<ffffffff80248a4d>] datagram_poll+0x0/0xc8
   [<ffffffff8024f529>] mwait_idle+0x42/0x45
   [<ffffffff80242c05>] cpu_idle+0x8b/0xae
   [<ffffffff805a8779>] start_kernel+0x2b9/0x2c5
   [<ffffffff805a815e>] _sinittext+0x15e/0x162

  Code: 0f 0b eb fe 48 8b 07 48 63 d2 48 f7 d0 48 8b 3c d0 e8 13 ff
  RIP  [<ffffffff8028c955>] queue_work+0x32/0x51
   RSP <ffffffff805fada8>
  Kernel panic - not syncing: Aiee, killing interrupt handler!
Signed-off-by: Bernhard Walle <bwalle@suse.de>
Acked-by: Eric Biederman <ebiederm@xmission.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

We need vid_which_vrm and vid_from_reg in the w83793 module.
Signed-off-by: Stefano Brivio <stefano.brivio@polimi.it>
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Looks like we need a check in nfs_getattr() for a regular file. It makes
no sense to call nfs_sync_mapping_range() on anything else. I think that
should fix your problem: it will stop the NFS client from interfering
with dirty pages on that inode's mapping.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Acked-by: Olof Johansson <olof@lixom.net>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The current NFS client congestion logic is severly broken, it marks the
backing device congested during each nfs_writepages() call but doesn't
mirror this in nfs_writepage() which makes for deadlocks.  Also it
implements its own waitqueue.

Replace this by a more regular congestion implementation that puts a cap on
the number of active writeback pages and uses the bdi congestion waitqueue.

Also always use an interruptible wait since it makes sense to be able to
SIGKILL the process even for mounts without 'intr'.
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Trond Myklebust <trond.myklebust@fys.uio.no>
Cc: Christoph Lameter <clameter@engr.sgi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The only error code which comes from the partition checkers is -1, when
they finds an EIO.  As per the discussion, ENOMEM values were ignored,
as they might scare the users.

So, with the current code, we end up returning -1 and not EIO for the
ioctl() calls.  Which doesn't give any clue to the user of what went
wrong.
Signed-off-by: Suzuki K P <suzuki@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

When the console is in VT_AUTO+KD_GRAPHICS mode, switching to the
SUSPEND_CONSOLE fails, resulting in vt_waitactive() waiting indefinitely or
until the task is interrupted.  This patch tests if a console switch can
occur in set_console() and returns early if a console switch is not
possible.

[akpm@linux-foundation.org: cleanup]
Signed-off-by: Andrew Johnson <ajohnson@intrinsyc.com>
Acked-by: Pavel Machek <pavel@ucw.cz>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

smbfs allocates rq_trans2buffer to handle server's multi transaction2 response
messages.  As struct smb_request may be reused, rq_trans2buffer is freed
before each new request.  However if last servers's response is not multi but
single trans2 message then new rq_trans2buffer is not allocated but last
smb_rput still tries to free it again.

To prevent this issue rq_trans2buffer pointer should be set to NULL after
kfree.
Signed-off-by: Vasily Averin <vvs@sw.ru>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Frame buffer device drivers that cannot be built as modules must depend on
`FB = y'.  Correct the 3 remaining offenders.
Signed-off-by: Geert Uytterhoeven <Geert.Uytterhoeven@sonycom.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

ecryptfs_d_release() first dereferences a pointer (via
ecryptfs_dentry_to_lower()) and then afterwards checks to see if the
pointer it just dereferenced is NULL (via ecryptfs_dentry_to_private()).

This patch moves all of the work done on the dereferenced pointer inside a
block governed by the condition that the pointer is non-NULL.
Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit f4304ab2 (HZ free NTP) moved the
access to wall_to_monotonic in hrtimer_get_softirq_time() out of the
xtime_lock protection.

Move it back into the seq_lock section.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: John Stultz <johnstul@us.ibm.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Prevents a potential oops with CONFIG_SPI_DEBUG given flakey hardware or
incorrect configuration.
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

hrtimer_forward() does not check for the possible overflow of
timer->expires.  This can happen on 64 bit machines with large interval
values and results currently in an endless loop in the softirq because the
expiry value becomes negative and therefor the timer is expired all the
time.

Check for this condition and set the expiry value to the max.  expiry time
in the future.  The fix should be applied to stable kernel series as well.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

SavagePrintRegs() requires struct savagefb_par.
Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>