Hugetlbfs silently coerce private mappings of hugetlb files into shared
ones.  So private writable mapping has MAP_SHARED semantics.  I think, such
mappings should be disallowed.

First, such behavior allows open hugetlbfs file O_RDONLY, and overwrite it
via mmap(PROT_READ|PROT_WRITE, MAP_PRIVATE), so it is security bug.

Second, private writable mmap() should fail just because kernel does not
support this.

I belisve, it is ok to allow private readonly hugetlb mappings,
sys_mprotect() does not work with hugetlb vmas.

There is another problem.  Hugetlb mapping is always prefaulted, pages
allocated at mmap() time.  So even readonly mapping allows to enlarge the
size of the hugetlbfs file, and steal huge pages without appropriative
permissions.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Hugetlbfs mmap with MAP_PRIVATE becomes MAP_SHARED silently, but
vma->vm_flags have no VM_SHARED bit.  Reading from /dev/zero into hugetlb
area will do:

read_zero()
    read_zero_pagealigned()
        if (vma->vm_flags & VM_SHARED)
            break;                      // fallback to clear_user()
        zap_page_range();
        zeromap_page_range();

It will hit BUG_ON() in unmap_hugepage_range() if region is not huge page
aligned, or silently convert it into the private anonymous mapping.
Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This is a helper function that a few architectures already have.  This just
copies the i386 implementation to ppc64.
Signed-off-by: Dave Hansen <haveblue@us.ibm.com>
Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

With earlier setup of cpu_possible_map the number of irqstacks shrinks from
NR_CPUS to the number of possible cpus.
Signed-off-by: Nathan Lynch <nathanl@austin.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Move the initialization of the per-cpu paca->hw_cpu_id out of the Open
Firmware client boot code and into a common location which is executed
later.
Signed-off-by: Nathan Lynch <nathanl@austin.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Move all cpu map initializations to one place (except for the online map --
cpus mark themselves online as they come up).  This sets up
cpu_possible_map early enough that we can use num_possible_cpus for
allocating irqstacks instead of NR_CPUS.  Hopefully this should also help
set the stage for kexec.
Signed-off-by: Nathan Lynch <nathanl@austin.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

David Engebretsen has moved on to other things and is no longer maintaining
ppc64.  This patch adds an entry in CREDITS to note his contribution in
leading the team that did the PPC64 port originally and updates various
PPC-related MAINTAINERS entries.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Currently add_interrupt_randomness() is called at each interrupt when one
of the handlers has SA_SAMPLE_RANDOM flag, regardless whether the interrupt
is processed by that handler or not.  This results in the higher latency
and perfomance loss.

The patch fixes this behavior to avoid the unnecessary call by checking the
return value from each handler.
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

A special kprobe type which can be placed on function entry points, and
employs a simple mirroring principle to allow seamless access to the
arguments of a function being probed.  The probe handler routine should
have the same prototype as the function being probed.  Currently
implemented for x86.

The way it works is that when the probe is hit, the breakpoint handler
simply irets to the probe handler's eip while retaining register and stack
state corresponding to the function entry.  After it is done, the probe
handler calls jprobe_return() which traps again to restore processor state
and switch back to the probed function.  Linus noted correctly at KS that
we need to be careful as gcc assumes that the callee owns arguments.  We
save and restore enough stack bytes to cover argument space.

Sample Usage:
	static int jip_queue_xmit(struct sk_buff *skb, int ipfragok)
	{
		... whatever ...
		jprobe_return();
		return 0;
	}

	struct jprobe jp = {
		{.addr = (kprobe_opcode_t *) ip_queue_xmit},
		.entry = (kprobe_opcode_t *) jip_queue_xmit
	};
	register_jprobe(&jp);
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch helps developers to trap at almost any kernel code address,
specifying a handler routine to be invoked when the breakpoint is hit.  

Useful for analysing the Linux kernel by collecting debugging information
non-disruptively.  Employs single-stepping out-of-line to avoid probe
misses on SMP and may be especially useful in aiding debugging elusive
races and problems on live systems.  More elaborate dynamic tracing tools
such as DProbes can be built over the kprobes interface.


Helps developers to trap at almost any kernel code address, specifying a
handler routine to be invoked when the breakpoint is hit.  Useful for
analysing the Linux kernel by collecting debugging information
non-disruptively.  Employs single-stepping out-of-line to avoid probe
misses on SMP and may be especially useful in aiding debugging elusive
races and problems on live systems.  More elaborate dynamic tracing tools
such as DProbes can be built over the kprobes interface.

Sample usage:
	To place a probe on __blockdev_direct_IO:
	static int probe_handler(struct kprobe *p, struct pt_regs *)
	{
		... whatever ...
	}
	struct kprobe kp = {
		.addr = __blockdev_direct_IO,
		.pre_handler = probe_handler
	};
	register_kprobe(&kp);
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch provides notifiers for i386 architecture exceptions.  This patch
has been ported from x86_64 architecture as suggested by Andi Kleen.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Contributions from  Zarakin <zarakin@hotpop.com>

Intel removed two msrs: MSR_P4_IQ_ESCR_0|1 (0x3ba/0x3bb), P4 model >= 3.  See
Intel documentation Vol.  3 System Programming Guide Appendix B.

nmi_watchdog=2 oopsed at boot time and oprofile at driver load.

Avoid touching them when model >= 3.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This update only applies to Unisys' ES7000 server machines.  The patch adds
a OEM id check to verify the current machine running is actually a Unisys
type box before executing the Unisys OEM parser routine.  It also increases
the MAX_MP_BUSSES definition from 32 to 256.  On the ES7000s, bus ID
numbering can range from 0 to 255.  Without the patch, the system panics if
booted with acpi=off.

This patch has been tested and verified on an authentic ES7000 machine.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Make assign_irq_vector() non-__init always (it's called from
io_apic_set_pci_routing(), which is used in the pci_enable_device() path).
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

I had a problem when compiling a 2.6 kernel with gcc 3.5 CVS.  The
prototype for prio_tree_remove in mm/prio_tree.c is inside another
function.  gcc 3.5 gets upset and removes the function completely.
Apparently this isnt valid C, so lets fix it up.

Details can be found here:

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17205Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Nehemiah wasn't having the CX8 bit enabled before.
In fixing it up, I rewrote the code to be a little clearer.
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Ivan Kokshaysky <ink@jurassic.park.msu.ru>

 - big functions moved out of line;
 - handle dev == NULL case, which apparently means the isa device.

As before, this is needed for Jensen. This also makes the isa sound
drivers working again with recent kernels.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Patch from Ben Dooks

Register definitions, and support for modifying the
Drive Strength Control registers on the S3C2440

Signed-off-by: Ben Dooks 

Patch from Ben Dooks

Ensure we check for IRQ pending for the gettimeoffset()
function

Patch from Ben Dooks

Add the definition of timer 0's dead-zone capability

into kernel.bkbits.net:/home/davem/tg3-2.6

Need to clear one bit at a time, so if we are
clearing both 625_CORE_CLOCK and ALTCLOCK
we first clear the latter then the final
write will clear the former.
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

Otherwise we do not handle properly the case
where the switch/hub does not support auto-
negotiation.  This is what was breaking 5704
hw fiber autoneg.
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@redhat.com>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

[patch] libata: ata_piix.c PIO fix

"[libata] transfer mode cleanup" introduced bug in ata_piix.c:
previously PIO number (not mode) was passed to piix_set_piomode().
Fortunately this function is only used for (disabled) PATA support.

I bet that this is the reason why MWDMA didn't work for PATA.
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@elka.pw.edu.pl>

The ioctl32 conversion registration stubs are in ioctl32.h now.
Signed-off-by: Andrew Morton <akpm@osdl.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into hostme.bitkeeper.com:/repos/c/cifs/linux-2.5cifs

Paolo Giarrusso points out that the UML merge incorrectly
caused INITIAL_JIFFIES to be reset back to zero, instead
of the debug value for getting an early jiffies wrap.

Fix it back up.

into hostme.bitkeeper.com:/repos/c/cifs/linux-2.5cifs

This patch fixes a problem introduced when CK804 support was added.  mmio_base can only be set in the CK804 case,
else libata will attempt to iounmap mmio_base, which isn't iomapped for the non-CK804 case.  Still need the bar 5
address, so steal from host_set->ports[0]->ioaddr.scr_addr.  Jeff, let me know if this is a bad thing to do.

Fix of the debug/trace driver and removal of irq locks.

 - Only spinlocks[bh] are used now.
 - Removed obsolete direct debug /proc interface.
 - Update of internal trace features and its API.
 - Use common definition of MAX_DESCRIPTORS.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Optimizes transmit windows for improved performance and to prevent
TX underruns. Fixes driver registration error handling. Fixes ZMII
and RGMII thinkos. Fixes for MDIO handling issues from Ralph
Siemsen. Please apply.
Signed-off-by: Matt Porter <mporter@kernel.crashing.org>