Due to a buggy unsigned comparison, it was possible to write
beyond the end of the local store file in spufs under some
circumstances.

This rewrites the buggy function to look more like
simple_copy_from_buffer.
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Cc: Ulrich Weigand <Ulrich.Weigand@de.ibm.com>

On chip 8250 UARTs share an interrupts on existing 85xx processors.
Signed-off-by: Kumar Gala <galak@kernel.crashing.org>

Fixes image build error:

ln: accessing `arch/powerpc/boot/zImage': No such file or directory
make[1]: *** [arch/powerpc/boot/zImage] Error 1
make: *** [zImage] Error 2
Signed-off-by: Segher Boessenkool <segher@kernel.crashing.org>
Acked-by: G. Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Kumar Gala <galak@kernel.crashing.org>

Fix broken node manipulating code, and clarify inaccurate comment.
Signed-off-by: Li Yang <leoli@freescale.com>
Signed-off-by: Kumar Gala <galak@kernel.crashing.org>

This fixes a warning due to unused result from pci_enable_device() in
powermac pci.c
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

This fixes a warning due to unused return from pci_enable_device() in
powermac feature.c core99_ata100_enable() function.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

This function spews a warning due to possible use of an uninitialized
variable. This can happen on broken device-trees or when called with
a NULL argument. Makes ure we properly fail instead.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

This fixes a bug caused by changes of pointer type in
commit f1fda895.

hose->cfg_addr type is "volatile unsigned int __iomem *", so
"hose->cfg_addr + X" will not make an intended address.

This patch also adds comments for usage of cfg_addr and cfg_data in
pci_controller structure.  We use them in irregular way, and the
original code is short of explanations about them.
Signed-off-by: Kou Ishizaki <kou.ishizaki@toshiba.co.jp>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

My patch to add spu disassembly (af89fb80)
removed a newline from the xmon help that it shouldn't have, put it back.
Signed-off-by: Michael Ellerman <michael@ellerman.id.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>

970MP rev 1.0 is reported to have nonworking DEEPNAP support, we've had
bug reports of lockups on those machines. Appearantly Apple used them
on some dual-core dual-cpu systems. Rev 1.1 is OK, and that's the one
that all 4-way systems seem to use.
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Paul Mackerras <paulus@samba.org>

.. hopefully most of the resume/suspend problems introduced by the timer
and other changes are behind us.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: Fix floppy build failure.

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [DCCP]: Set RTO for newly created child socket
  [DCCP]: Correctly split CCID half connections
  [NET]: Fix compat_sock_common_getsockopt typo.
  [NET]: Revert incorrect accept queue backlog changes.
  [INET]: twcal_jiffie should be unsigned long, not int
  [GIANFAR]: Fix compile error in latest git
  [PPPOE]: Use ifindex instead of device pointer in key lookups.
  [NETFILTER]: ip6_route_me_harder should take into account mark
  [NETFILTER]: nfnetlink_log: fix reference counting
  [NETFILTER]: nfnetlink_log: fix module reference counting
  [NETFILTER]: nfnetlink_log: fix possible NULL pointer dereference
  [NETFILTER]: nfnetlink_log: fix NULL pointer dereference
  [NETFILTER]: nfnetlink_log: fix use after free
  [NETFILTER]: nfnetlink_log: fix reference leak
  [NETFILTER]: tcp conntrack: accept SYN|URG as valid
  [NETFILTER]: nf_conntrack/nf_nat: fix incorrect config ifdefs
  [NETFILTER]: conntrack: fix {nf,ip}_ct_iterate_cleanup endless loops

* 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
  [S390] cio: Call cancel_halt_clear even when actl == 0.
  [S390] cio: Use path verification to check for path state.
  [S390] cio: Fix locking when calling notify function.
  [S390] Fixed handling of access register mode faults.
  [S390] dasd: Use default recovery for SNSS requests
  [S390] check_bugs() should be inline.
  [S390] tape: Compression overwrites crypto setting
  [S390] nss: disable kexec.
  [S390] reipl: move dump_prefix_page out of text section.
  [S390] smp: disable preemption in smp_call_function/smp_call_function_on
  [S390] kprobes breaks BUG_ON

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  pata_pdc202xx_old: fix data corruption and other problems
  pata_legacy: fix io/irq mismatch
  ahci: RAID mode SATA patch for Intel ICH9M

This reverts commit 39d61db0.

The commit was buggy in multiple ways:
 - the conversion to ilog2() was incorrect to begin with
 - it tested the wrong #defines, so on all architectures but FRV you'd
   never see the bug except for constant arguments.
 - the new "get_order()" macro used its arguments multiple times, and
   didn't even parenthesize them properly
 - despite the comments, it was not true that you could use it for
   constant initializers, since not all architectures even use the
   generic page.h header file.

All of the problems are individually fixable, but it all boils down to:
better just revert it, and re-do it from scratch.

Cc: David Howells <dhowells@redhat.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Remove un-used/un-referenced local_bh_count.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Use irq_handler_t for passing clock handler routine around.
And use new rtc_time in place of hwclock_time.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

For the Freescale M5282 ColdFire,
Port UA Pin Assignment Register should set to UART mode.
Patch submitted by David Wu <davidwu@arcturusnetworks.com>.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix work queue code to support new model.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

For the Freescale M5282 ColdFire,
Port UA Pin Assignment Register should set to UART mode.
Patch submitted by David Wu <davidwu@arcturusnetworks.com>.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Remove regs arg from bad interrupt handler.
Use irq_handler_t type for handler arg of local request_irq().
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Use irq_handler_t type for passing around timer interrupt routine
in 368360 setup code.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Use irq_handler_t type for passing around timer interrupt routine.
Signed-off-by: Greg Ungerer <gerg@uclinux.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  [IA64] kexec: Use EFI_LOADER_DATA for ELF core header
  [IA64] permon use-after-free fix
  [IA64] sync compat getdents
  [IA64] always build arch/ia64/lib/xor.o
  [IA64] Remove stack hard limit on ia64
  [IA64] point saved_max_pfn to the max_pfn of the entire system
  Revert "[IA64] swiotlb abstraction (e.g. for Xen)"

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] IP27: Build fix
  [MIPS] Wire up ioprio_set and ioprio_get.
  [MIPS] Fix __raw_read_trylock() to allow multiple readers
  [MIPS] Export __copy_user_inatomic.
  [MIPS] R2 bitops compile fix for gcc < 4.0.
  [MIPS] TX39: Remove redundant tx39_blast_icache() calls
  [MIPS] Cobalt: Fix early printk
  [MIPS] SMTC: De-obscure Malta hooks.
  [MIPS] SMTC: Add fordward declarations for mm_struct and task_struct.
  [MIPS] SMTC: <asm/mips_mt.h> must include <linux/cpumask.h>
  [MIPS] SMTC: <asm/smtc_ipi.h> must include <linux/spinlock.h>
  [MIPS] Atlas, Malta: Fix build warning.

The tlclk driver is going on the MPCBL005 so I need to make the Kconfig
more more generic.  Just some text changes.
Signed-off-by: Mark Gross <mark.gross@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Based on a patch from Don Howard <dhoward@redhat.com>

When calling write() with a buffer larger than 512 bytes, the
driver's write buffer overflows, allowing to overwrite the EIP and
execute arbitrary code with kernel privileges.

In read(), there exists a similar problem, but coming from the device.
A malicous or buggy device sending more than 512 bytes can overflow
of the driver's read buffer, with the same effects as above.
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Harald Welte <laforge@gnumonks.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Suspend deadlocks when trying to unregister /sys/block/sr0.

This comes from Oliver's commit 94bebf4d
"Driver core: fix race in sysfs between sysfs_remove_file() and
read()/write()".

sysfs_write_file downs buffer->sem while calling flush_write_buffer, and
flushing that particular write buffer entails downing buffer->sem in
orphan_all_buffers, resulting in the obvious self-deadlock.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jikos/hid:
  HID blacklisting of all Code Mercenaries IOWarrior devices

* 'linus' of master.kernel.org:/pub/scm/linux/kernel/git/perex/alsa:
  [ALSA] version 1.0.14rc3
  [ALSA] cmipci - Allow to disable integrated FM port
  [ALSA] hda-codec - Fix logic error in headphone mute for Conexant codecs
  [ALSA] hda-codec - Add missing Mic Boost for AD1986A codec
  [ALSA] ac97 - Add Thinkpad X31 and R40 to AD1981x blacklist
  [ALSA] Add missing sysfs device assignment for ALSA PCI drivers
  [ALSA] hda-codec - Define pin configs for MacBooks
  [ALSA] hda-codec - Add missing Mic Boost controls for ALC262
  [ALSA] soc - WM9712 PCM volume
  [ALSA] soc - Fix WM9712 register cache entry
  [ALSA] hda-codec - Add method for configuring Mac Pro without PCI SSID
  [ALSA] hda-codec - Add LFE support on Dell M90

* git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
  [CIFS] cifs_prepare_write was incorrectly rereading page in some cases
  [CIFS] Fix set file size to zero when doing chmod to Samba 3.0.26pre
  [CIFS] Remove some unused functions/declarations
  [CIFS] New file for previous commit
  [CIFS] cifs export operations
  [CIFS] small piece missing from previous patch
  [CIFS] Fix locking problem around some cifs uses of i_size write

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc:
  sdhci: release irq during suspend
  sdhci: make isr tolerant of read errors
  mmc: require explicit support for high-speed
  ncpfs: make sure server connection survives a kill

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6:
  sis900 warning fixes
  mv643xx_eth: Place explicit port number in mv643xx_eth_platform_data
  pcnet32: Fix PCnet32 performance bug on non-coherent architecutres
  __devinit & __devexit cleanups for de2104x driver
  3c59x: Handle pci_enable_device() failure while resuming
  dmfe: Fix link detection
  dmfe: fix two bugs
  dmfe: trivial/spelling fixes
  revert "drivers/net/tulip/dmfe: support basic carrier detection"
  ucc_geth: returns NETDEV_TX_BUSY when BD ring is full
  ucc_geth: Fix BD processing
  natsemi: netpoll fixes
  bonding: Improve IGMP join processing
  bonding: only receive ARPs for us
  bonding: fix double dev_add_pack

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

A deadlock can occur for mixed irq and non-irq rwlock readers if a 2nd
reader attempts to take lock by looping around __raw_read_trylock().
Signed-off-by: Dave Johnson <djohnson+linux-mips@sw.starentnetworks.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Apply commit 0550d9d1 to c-tx39.c too.
And fix a warning in local_tx39_flush_data_cache_page().
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>