* master.kernel.org:/home/rmk/linux-2.6-arm:
ARM: 6205/1: perf: ensure counter delta is treated as unsigned
ARM: 6202/1: Do not ARM_DMA_MEM_BUFFERABLE on RealView boards with L210/L220
ARM: 6201/1: RealView: Do not use outer_sync() on ARM11MPCore boards with L220
ARM: 6195/1: OMAP3: pmu: make CPU_HAS_PMU dependent on OMAP3_EMU
ARM: 6194/1: change definition of cpu_relax() for ARM11MPCore
ARM: 6193/1: RealView: Align the machine_desc.phys_io to 1MB section
ARM: 6192/1: VExpress: Align the machine_desc.phys_io to 1MB section
ARM: 6188/1: Add a config option for the ARM11MPCore DMA cache maintenance workaround
ARM: 6187/1: The v6_dma_inv_range() function must preserve data on SMP
ARM: 6186/1: Avoid the CONSISTENT_DMA_SIZE warning on noMMU builds
ARM: mx3: mx31lilly: fix build error for !CONFIG_USB_ULPI
[ARM] mmp: fix build failure due to IRQ_PMU depends on ARCH_PXA
[ARM] pxa/mioa701: fix camera regression
[ARM] pxa/z2: fix flash layout to final version
[ARM] pxa/z2: fix missing include in battery driver
[ARM] pxa: fix incorrect gpio type in udc_pxa2xx.h

* 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
perf, x86: Fix incorrect branches event on AMD CPUs
perf tools: Fix find tids routine by excluding "." and ".."
x86: Send a SIGTRAP for user icebp traps

Hardware performance counters on ARM are 32-bits wide but atomic64_t
variables are used to represent counter data in the hw_perf_event structure.

The armpmu_event_update function right-shifts a signed 64-bit delta variable
and adds the result to the event count. This can lead to shifting in sign-bits
if the MSB of the 32-bit counter value is set. This results in perf output
such as:

Performance counter stats for 'sleep 20':

18446744073460670464 cycles <-- 0xFFFFFFFFF12A6000
7783773 instructions # 0.000 IPC
465 context-switches
161 page-faults
1172393 branches

20.154242147 seconds time elapsed

This patch ensures that the delta value is treated as unsigned so that the
right shift sets the upper bits to zero.

Cc: <stable@kernel.org>
Acked-by: Jamie Iles <jamie.iles@picochip.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

We should initialize the module dynamic debug datastructures
only after determining that the module is not loaded yet. This
fixes a bug that introduced in 2.6.35-rc2, where when a trying
to load a module twice, we also load it's dynamic printing data
twice which causes all sorts of nasty issues. Also handle
the dynamic debug cleanup later on failure.

Signed-off-by: Yehuda Sadeh <yehuda@hq.newdream.net>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> (removed a #ifdef)
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

While doing some performance counter validation tests on some
assembly language programs I noticed that the "branches:u"
count was very wrong on AMD machines.

It looks like the wrong event was selected.

Signed-off-by: Vince Weaver <vweaver1@eecs.utk.edu>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Robert Richter <robert.richter@amd.com>
Cc: Borislav Petkov <borislav.petkov@amd.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: <stable@kernel.org>
LKML-Reference: <alpine.DEB.2.00.1007011526010.23160@cl320.eecs.utk.edu>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

RealView boards with certain revisions of the L210/L220 cache controller
may have issues (hardware deadlock) with the mandatory barriers (DSB
followed by an L2 cache sync) when ARM_DMA_MEM_BUFFERABLE is enabled.
The patch disables ARM_DMA_MEM_BUFFERABLE for these boards.

Tested-by: Linus Walleij <linus.walleij@stericsson.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

* 'for-linus' of git://oss.sgi.com/xfs/xfs:
xfs: remove block number from inode lookup code
xfs: rename XFS_IGET_BULKSTAT to XFS_IGET_UNTRUSTED
xfs: validate untrusted inode numbers during lookup
xfs: always use iget in bulkstat
xfs: prevent swapext from operating on write-only files

Introduce a filter function to skip "." and ".." directories when calculating
tid number, otherwise tid 0 will be included in the all_tid result array.

Cc: Ingo Molnar <mingo@elte.hu>
LKML-Reference: <4C185F68.1020505@cn.fujitsu.com>
Signed-off-by: Gui Jianfeng <guijianfeng@cn.fujitsu.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

RealView boards with certain revisions of the L220 cache controller (ARM11*
processors only) may have issues (hardware deadlock) with the recent changes to
the mb() barrier implementation (DSB followed by an L2 cache sync). The patch
redefines the RealView ARM11MPCore mandatory barriers without the outer_sync()
call.

Cc: <stable@kernel.org>
Tested-by: Linus Walleij <linus.walleij@stericsson.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

* 'merge-devicetree' of git://git.secretlab.ca/git/linux-2.6:
of/dma: fix build breakage in ppc4xx adma driver

The block number comes from bulkstat based inode lookups to shortcut
the mapping calculations. We ar enot able to trust anything from
bulkstat, so drop the block number as well so that the correct
lookups and mappings are always done.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>

Before we had a generic breakpoint layer, x86 used to send a
sigtrap for any debug event that happened in userspace,
except if it was caused by lazy dr7 switches.

Currently we only send such signal for single step or breakpoint
events.

However, there are three other kind of debug exceptions:

- debug register access detected: trigger an exception if the
next instruction touches the debug registers. We don't use
it.
- task switch, but we don't use tss.
- icebp/int01 trap. This instruction (0xf1) is undocumented and
generates an int 1 exception. Unlike single step through TF
flag, it doesn't set the single step origin of the exception
in dr6.

icebp then used to be reported in userspace using trap signals
but this have been incidentally broken with the new breakpoint
code. Reenable this. Since this is the only debug event that
doesn't set anything in dr6, this is all we have to check.

This fixes a regression in Wine where World Of Warcraft got broken
as it uses this for software protection checks purposes. And
probably other apps do.

Reported-and-tested-by: Alexandre Julliard <julliard@winehq.org>
Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Prasad <prasad@linux.vnet.ibm.com>
Cc: 2.6.33.x 2.6.34.x <stable@kernel.org>

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/i7core:
MAINTAINERS: Add an entry for i7core_edac
i7core_edac: Avoid doing multiple probes for the same card
i7core_edac: Properly discover the first QPI device

Convert ppc4xx adma driver to use new node pointer location

Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Acked-by: Anatolij Gustschin <agust@denx.de>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>

Inode numbers may come from somewhere external to the filesystem
(e.g. file handles, bulkstat information) and so are inherently
untrusted. Rename the flag we use for these lookups to make it
obvious we are doing a lookup of an untrusted inode number and need
to verify it completely before trying to read it from disk.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>

The header file include/linux/tracepoint.h may be included without
include/linux/errno.h and then the compiler will fail on building for
undelcared ENOSYS. This patch fixes this problem via including <linux/errno.h>
to include/linux/tracepoint.h.

Signed-off-by: Wu Zhangjin <wuzhangjin@gmail.com>
LKML-Reference: <1277118549-622-1-git-send-email-wuzhangjin@gmail.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

arch/arm/mach-mx3/built-in.o: In function `mx31lilly_board_init':
mach-kzm_arm11_01.c:(.init.text+0x674): undefined reference to `otg_ulpi_create'
mach-kzm_arm11_01.c:(.init.text+0x68c): undefined reference to `otg_ulpi_create'
mach-kzm_arm11_01.c:(.init.text+0x744): undefined reference to `mxc_ulpi_access_ops'
make: *** [.tmp_vmlinux1] Error 1

Signed-off-by: Daniel Mack <daniel@caiaq.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

* 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6:
kbuild: Propagate LOCALVERSION= down to scripts/setlocalversion
kbuild: Clean up and speed up the localversion logic

While here, fixes the mailing list for i5400_edac

Acked-by: Doug Thompson <dougthompson@xmission.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

* 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
sched: Cure nr_iowait_cpu() users
init: Fix comment
init, sched: Fix race between init and kthreadd

When we decode a handle or do a bulkstat lookup, we are using an
inode number we cannot trust to be valid. If we are deleting inode
chunks from disk (default noikeep mode), then we cannot trust the on
disk inode buffer for any given inode number to correctly reflect
whether the inode has been unlinked as the di_mode nor the
generation number may have been updated on disk.

This is due to the fact that when we delete an inode chunk, we do
not write the clusters back to disk when they are removed - instead
we mark them stale to avoid them being written back potentially over
the top of something that has been subsequently allocated at that
location. The result is that we can have locations of disk that look
like they contain valid inodes but in reality do not. Hence we
cannot simply convert the inode number to a block number and read
the location from disk to determine if the inode is valid or not.

As a result, and XFS_IGET_BULKSTAT lookup needs to actually look the
inode up in the inode allocation btree to determine if the inode
number is valid or not.

It should be noted even on ikeep filesystems, there is the
possibility that blocks on disk may look like valid inode clusters.
e.g. if there are filesystem images hosted on the filesystem. Hence
even for ikeep filesystems we really need to validate that the inode
number is valid before issuing the inode buffer read.

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>

At exit, perf record will kill the process it was profiling by sending a
SIGTERM to child_pid (if it had been initialised), but in certain situations
child_pid may be 0 and perf would mistakenly kill more processes than intended.

child_pid is set to the return of fork() to either 0 or the pid of the child.
Ordinarily this would not present an issue as the child calls execvp to spawn
the process to be profiled and would therefore never run it's sig_atexit and
never attempt to kill pid 0.

However, if a nonexistant binary had been passed in to perf record the call to
execvp would fail and child_pid would be left set to 0. The child would then
exit and it's atexit handler, finding that child_pid was initialised to 0,
would call kill(0, SIGTERM), resulting in every process within it's process
group being killed.

In the case that perf was being run directly from the shell this typically
would not be an issue as the shell isolates the process. However, if perf was
being called from another program it could kill unexpected processes, which may
even include X.

This patch changes the logic of the test for whether child_pid was initialised
to only consider positive pids as valid, thereby never attempting to kill pid
0.

Cc: David S. Miller <davem@davemloft.net>
Cc: Frédéric Weisbecker <fweisbec@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tom Zanussi <tzanussi@gmail.com>
LKML-Reference: <1276072680-17378-1-git-send-email-imunsie@au1.ibm.com>
Signed-off-by: Ian Munsie <imunsie@au1.ibm.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

CPU performance event counters on v7 cores will only operate
if either the NIDEN or DBGEN signals are driven high.

For the OMAP3 platform, these signals are driven low by default
but DBGEN can be asserted by selecting the OMAP3_EMU Kconfig option,
which enables the virtual clock for hardware debugging peripherals.

Acked-by: Jean Pihet <jpihet@mvista.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

PMU is not tested and enabled on MMP architecture at this moment,
the device IRQ number, IRQ_PMU depends on ARCH_PXA. Build PMU only
for ARCH_PXA.

Signed-off-by: Jonathan Cameron <jic23@cam.ac.uk>
Signed-off-by: Eric Miao <eric.y.miao@gmail.com>

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6:
Staging: rtl8192u_usb: Add LG device ID 043e:7a01
Staging: rtl8192s_usb: Remove duplicate device ID
Staging: rt2870: add device id for Zyxel NWD-270N
Staging: comedi: fix read past end of array in cb_pcidda_attach()
Staging: rtl8192su: add device ids
Staging: rtl8192su: remove device ids
Staging: rtl8187se: Fix compile warnings in 2.6.35-rc2
Staging: wlags49_h2: Fix build error when CONFIG_SYSFS is not set
Staging: wlags49_h2: add missing <linux/string.h> for strlen
Staging: hv: fix hv_utils module to properly autoload
staging: hv: Fix race condition on vmbus channel initialization
Staging: comedi: drivers: adl_pci9111: Fix AI commands in TRIG_FOLLOW case
Staging: mrst-touchscreen: fix dereferencing free memory
Staging: batman-adv: fix function prototype
Staging: batman-adv: return -EFAULT on copy_to_user errors
staging: usbip: usbip_common: kill rx thread on tx thread creation error.

Conflicts:
Makefile

As Nehalem/Nehalem-EP/Westmere devices uses several devices for the same
functionality (memory controller), the default way of proping devices doesn't
work. So, instead of a per-device probe, all devices should be probed at once.

This means that we should block any new attempt of probe, otherwise, it will
try to register the same device several times.

Acked-by: Doug Thompson <dougthompson@xmission.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
amd64_edac: Fix syndrome calculation on K8

Commit 0224cf4c5e (sched: Intoduce get_cpu_iowait_time_us())
broke things by not making sure preemption was indeed disabled
by the callers of nr_iowait_cpu() which took the iowait value of
the current cpu.

This resulted in a heap of preempt warnings. Cure this by making
nr_iowait_cpu() take a cpu number and fix up the callers to pass
in the right number.

Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Arjan van de Ven <arjan@infradead.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Cc: Rafael J. Wysocki <rjw@sisk.pl>
Cc: Maxim Levitsky <maximlevitsky@gmail.com>
Cc: Len Brown <len.brown@intel.com>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Jiri Slaby <jslaby@suse.cz>
Cc: linux-pm@lists.linux-foundation.org
LKML-Reference: <1277968037.1868.120.camel@laptop>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

The non-coherent bulkstat versionsthat look directly at the inode
buffers causes various problems with performance optimizations that
make increased use of just logging inodes. This patch makes bulkstat
always use iget, which should be fast enough for normal use with the
radix-tree based inode cache introduced a while ago.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Dave Chinner <dchinner@redhat.com>

Move them to a session->dead_threads list just like we do with maps that
are replaced, because we may have hist_entries pointing to them.

This fixes a bug when inserting maps for a new thread that reused the
TID, mixing maps for two different threads, causing an endless loop.

The code for insering maps should be made more robust but for .35 this
is the minimalistic patch.

Reported-by: Ingo Molnar <mingo@elte.hu>
Cc: David S. Miller <davem@davemloft.net>
Cc: Frédéric Weisbecker <fweisbec@gmail.com>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Tom Zanussi <tzanussi@gmail.com>
LKML-Reference: <new-submission>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Linux expects that if a CPU modifies a memory location, then that
modification will eventually become visible to other CPUs in the system.

On an ARM11MPCore processor, loads are prioritised over stores so it is
possible for a store operation to be postponed if a polling loop immediately
follows it. If the variable being polled indirectly depends on the outstanding
store [for example, another CPU may be polling the variable that is pending
modification] then there is the potential for deadlock if interrupts are
disabled. This deadlock occurs in the KGDB testsuire when executing on an
SMP ARM11MPCore configuration.

This patch changes the definition of cpu_relax() to smp_mb() for ARMv6 cores,
forcing a flushing of the write buffer on SMP systems before the next load
takes place. If the Kernel is not compiled for SMP support, this will expand
to a barrier() as before.

Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Since commit a48c24a696f0d93c49f913b7818e9819612b1f4e, the
camera is not working anymore.

After the v4l2 migration, the mt9m111 camera board
information was not passed to the i2c layer anymore, but
stored for future use of v4l2 (through soc_camera).

Because mioa701_i2c_devices[] was tagged as "__initdata",
and because after the v4l2 migration, the new structure
"iclink" references it, the mt9m111 driver is not probed
anymore, as part of "iclink" is not valid (discarded after
kernel init).

Although there is not compilation error, nor runtime oops,
this patch restores a working camera on the mioa701 board.

Signed-off-by: Robert Jarzmik <robert.jarzmik@free.fr>
Acked-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Eric Miao <eric.y.miao@gmail.com>

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6: (22 commits)
USB: gadget: f_mass_storage: stale common->fsg value bug fix
USB: gadget: f_mass_storage: fixed fs descriptors not being updated
USB: musb: Enable the maximum supported burst mode for DMA
USB: musb: fix Blackfin ulpi stubs
USB: MUSB: make non-OMAP platforms build with CONFIG_PM=y
USB: musb_core: make disconnect and suspend interrupts work again
USB: obey the sysfs power/wakeup setting
USB: gadget eth: Fix calculate CRC32 in EEM
USB: qcserial: fix a memory leak in qcprobe error path
USB: gadget/printer, fix sleep inside atomic
USB: isp1362-hcd, fix double lock
USB: serial: ftdi: correct merge conflict with CONTEC id
USB: fix oops in usb_sg_init()
USB: s3c2410: deactivate endpoints before gadget unbinding
USB: ehci-mxc: bail out on transceiver problems
USB: otg/ulpi: bail out on read errors
usb: musb: Fix a bug by making suspend interrupt available in device mode
USB: r8a66597: Fix failure in change of status
USB: xHCI: Fix bug in link TRB activation change.
USB: gadget: g_fs: possible invalid pointer reference bug fixed
...

Add another device ID as listed in the vendor driver version
0003.0825.2009.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

In the commit below the version string handling was modified, adding
a '+' where no other version information was supplied:

commit 85a256d8e0116c8f5ad276730830f5d4d473344d
Author: David Rientjes <rientjes@google.com>
Date: Wed Jan 13 13:01:05 2010 -0800

From the commit the intent was as below:

- when CONFIG_LOCALVERSION_AUTO is disabled, a `+' is appended if the
repository has been revised beyond a tagged commit and LOCALVERSION=
was not passed to "make".

However if the user supplies an empty LOCALVERSION on the command line
the plus suffix is still added. This form is useful in the case where
the build environment knows that the version as specified is correct and
complete but does not correspond to a specific tag.

This patch changes the implementation to match the documentation
such that specifying LOCALVERSION= on the build line is sufficient
to suppress any suffix.

Signed-off-by: Andy Whitcroft <apw@canonical.com>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: Michal Marek <mmarek@suse.cz>

Variables given on the make commandline are not exported to $(shell
...) commands, so run the setlocalversion script in the make rule
directly.

Signed-off-by: Michal Marek <mmarek@suse.cz>

On Nehalem/Nehalem-EP/Westmere, the first QPI device is the last PCI bus.
The last bus is generally at 0x3f or 0xff, but there are also other systems
using different setups. For example, HP Z800 has 0x7f as the last bus.

This patch adds a logic to discover the last bus, dynamically detecting it
at runtime.

Acked-by: Doug Thompson <dougthompson@xmission.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel:
drm/i915: fix page flip finish vs. prepare on plane B
drm/i915: change default panel fitting mode to preserve aspect ratio
drm/i915: fix uninitialized variable warning in i915_setup_compression()
drm/i915: take struct_mutex in i915_dma_cleanup()
drm/i915: Fix CRT hotplug regression in 2.6.35-rc1
i915: fix ironlake edp panel setup (v4)
drm/i915: don't access FW_BLC_SELF on 965G
drm/i915: Account for space on the ring buffer consumed whilst wrapping.
drm/i915: gen3 page flipping fixes
drm/i915: don't queue flips during a flip pending event
drm/i915: Fix incorrect intel_ring_begin size in BSD ringbuffer.
drm/i915: Turn on 945 self-refresh only if single CRTC is active
drm/i915/gen4: Fix interrupt setup ordering
drm/i915: Use RSEN instead of HTPLG for tfp410 monitor detection.
drm/i915: Move non-phys cursors into the GTT
Revert "drm/i915: Don't enable pipe/plane/VCO early (wait for DPMS on)."

(Included the "fix page flip finish vs. prepare on plane B" patch from
Jesse on top of the pull request from Eric. -- Linus)

When calculating the DCT channel from the syndrome we need to know the
syndrome type (x4 vs x8). On F10h, this is read out from extended PCI
cfg space register F3x180 while on K8 we only support x4 syndromes and
don't have extended PCI config space anyway.

Make the code accessing F3x180 F10h only and fall back to x4 syndromes
on everything else.

Cc: <stable@kernel.org> # .33.x .34.x
Reported-by: Jeffrey Merkey <jeffmerkey@gmail.com>
Signed-off-by: Borislav Petkov <borislav.petkov@amd.com>

Apparently "pid-1" confuses people...

Requested-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: torvalds@linux-foundation.org
Cc: randy.dunlap@oracle.com
Cc: Ilya Loginov <isloginov@gmail.com>
LKML-Reference: <1277887031.1868.82.camel@laptop>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

This patch prevents user "foo" from using the SWAPEXT ioctl to swap
a write-only file owned by user "bar" into a file owned by "foo" and
subsequently reading it. It does so by checking that the file
descriptors passed to the ioctl are also opened for reading.

Signed-off-by: Dan Rosenberg <dan.j.rosenberg@gmail.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>

When not aligned, random bits could be written in the initial page table
by the __create_page_tables() function.

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

This patch fixes flash layout to it's final version. Also, I fixed the
authorship information of this file as it's been totally reworked since Ken
released his last version.

Signed-off-by: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: Eric Miao <eric.y.miao@gmail.com>

* git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
serial: cpm_uart: implement the cpm_uart_early_write() function for console poll

On fsg_unbind the common->fsg pointer was not NULLed if the
unbound fsg_dev instance was the current one. As an effect,
the incorrect pointer was preserved in all further operations
which caused do_set_interface to reference an invalid region.

This commit fixes this by raising an exception in fsg_bind
which will change the common->fsg pointer. This also requires
an wait queue so that the thread in fsg_bind can wait till the
worker thread handles the exception.

This commit removes also a config and new_config fields of
fsg_common as they are no longer needed since fsg can be
used to determine whether function is active or not.

Moreover, this commit removes possible race condition where
the fsg field was modified in both the worker thread and
form various other contexts. This is fixed by replacing
prev_fsg with new_fsg. At this point, fsg is assigned only
in worker thread.

Signed-off-by: Michal Nazarewicz <m.nazarewicz@samsung.com>
Cc: Kyungmin Park <kyungmin.park@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Alan <alan@clueserver.org> writes:

> program: /home/alan/GitTrees/linux-2.6-mid-ref/scripts/mod/modpost -o
> Module.symvers -S vmlinux.o
>
> Program received signal SIGSEGV, Segmentation fault.

It just hit me.
It's the offset calculation in reloc_location() which overflows:
return (void *)elf->hdr + sechdrs[section].sh_offset +
(r->r_offset - sechdrs[section].sh_addr);

E.g. for the first rodata r entry:
r->r_offset < sechdrs[section].sh_addr
and the expression in the parenthesis produces 0xFFFFFFE0 or something
equally wise.

Reported-by: Alan <alan@clueserver.org>
Signed-off-by: Krzysztof Hałasa <khc@pm.waw.pl>
Tested-by: Alan <alan@clueserver.org>
Signed-off-by: Michal Marek <mmarek@suse.cz>

Now that we run scripts/setlocalversion during every build, it makes
sense to move all the localversion logic there. This cleans up the
toplevel Makefile and also makes sure that the script is called only
once in 'make prepare' (previously, it would be called every time due to
a variable expansion in an ifneq statement). No user-visible change is
intended, unless one runs the setlocalversion script directly.

Reported-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Greg Thelen <gthelen@google.com>
Cc: Nico Schottelius <nico-linuxsetlocalversion@schottelius.org>
Signed-off-by: Michal Marek <mmarek@suse.cz>

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
ata_generic: implement ATA_GEN_* flags and force enable DMA on MBP 7,1
ahci,ata_generic: let ata_generic handle new MBP w/ MCP89
libahci: Fix bug in storing EM messages

The refreshed patch had a copy & paste bug.

Reported-by: Simon Farnsworth <simon.farnsworth@onelan.com>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Ilya reported that on a very slow machine he could reliably
reproduce a race between forking init and kthreadd. We first
fork init so that it obtains pid-1, however since the scheduler
is already fully running at this point it can preempt and run
the init thread before we spawn and set kthreadd_task.

The init thread can then attempt spawning kthreads without
kthreadd being present which results in an OOPS.

Reported-by: Ilya Loginov <isloginov@gmail.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
LKML-Reference: <1277736661.3561.110.camel@laptop>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

When processing events we want to give visual feedback to the user when
using the newt browser, so there are ui_progress calls in
__perf_session__process_events, but those should check if newt is being
used.

Reported-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Tested-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
Cc: Frédéric Weisbecker <fweisbec@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>,
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: Stephane Eranian <eranian@google.com>
Cc: Tom Zanussi <tzanussi@gmail.com>
LKML-Reference: <20100609123530.GB9471@ghostprotocols.net>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

With the addition of the code to shrink the kernel tracepoint
infrastructure, we lost kprobes being traced by perf. The reason
is that I tested if the "tp_event->class->perf_probe" existed before
enabling it. This prevents "ftrace only" events (like the function
trace events) from being enabled by perf.

Unfortunately, kprobe events do not use perf_probe. This causes
kprobes to be missed by perf. To fix this, we add the test to
see if "tp_event->class->reg" exists as well as perf_probe.

Normal trace events have only "perf_probe" but no "reg" function,
and kprobes and syscalls have the "reg" but no "perf_probe".
The ftrace unique events do not have either, so this is a valid
test. If a kprobe or syscall is not to be probed by perf, the
"reg" function is called anyway, and will return a failure and
prevent perf from probing it.

Reported-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Tested-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>