next_port should be between sysctl_local_port_range[0] and [1].
However, it is initially set to a random value with get_random_bytes().  
If the value is negative when treated as a signed integer, next_port
can end up outside the expected range because of the result of the % 
operator being negative.
Signed-off-by: Sean Hefty <sean.hefty@intel.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

The code in __mlx4_ib_modify_qp() overwrites context->params1 after
the RNR retry parameter is ORed in, which results in the RNR retry
parameter always being set to 0.  Fix this by moving where we OR in
the value to later in the function, after the initial assignment of
context->params1.

Found by the Mellanox firmware group.
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

If a dMPT entry has the PA flag (direct physical address) set, then
the (unused) MTT base address field has to be set to 0.
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

HCA firmware with incompatible changes to the FW commmand interface is
coming soon.  Add a check of the interface revision during
initialization and bail out if the firmware advertises a revision that
the driver doesn't know about.  This will avoid strange failures later
if the driver goes on using the wrong interface revision. 
Signed-off-by: Roland Dreier <rolandd@cisco.com>

s/signifant/significant/
Signed-off-by: Roland Dreier <rolandd@cisco.com>

We need to pass the same dev_id to free_irq() and request_irq().  When
using MSI-X, the MLX4_EQ_CATAS interrupt uses a different dev_id from
the other interrupts.
Signed-off-by: Roland Dreier <rolandd@cisco.com>

We may call mlx4_dispatch_event() before mlx4_register_device() is
called for a device, because for example a catastrophic error happens
immediately after we enable interrupts.  Therefore priv->ctx_list and
priv->ctx_lock need to be initialized earlier.

This bug was actually exposed by the MSI-X bug that returned IRQ numbers 
to drivers in reverse order, so that the first FW command 
interrupt looked to mlx4 like a catastrophic error.
Signed-off-by: Roland Dreier <rolandd@cisco.com>

The reserved6 field should be 64 bits, not just 16 bits.  Without
this, the structure does not match the hardware layout on 32-bit
architectures: the db_rec_addr field ends up at offset 52 instead of
offset 56.  The bug slipped by because the alignment of __be64 members
ends up putting it in the right place on x86-64.
Signed-off-by: Eli Cohen <eli@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [VIDEO] sunxvr500fb: Fix pseudo_palette array size
  [VIDEO] sunxvr2500fb: Fix pseudo_palette array size
  [VIDEO] ffb: The pseudo_palette is only 16 elements long
  [VIDEO]: Fix section mismatch warning in promcon.
  [ATA]: Back out bogus (SPARC64 && !PCI) Kconfig depends.
  [SPARC64]: Fill in gaps in non-PCI dma_*() NOP implementation.
  [SPARC64]: Fix {mc,smt}_capable().
  [SPARC64]: Make core and sibling groups equal on UltraSPARC-IV.
  [SPARC64]: Proper multi-core scheduling support.
  [SPARC64]: Provide mmu statistics via sysfs.
  [SPARC64]: Fix service channel hypervisor function names.
  [SPARC64]: Export basic cpu properties via sysfs.
  [SPARC64]: Move topology init code into new file, sysfs.c

* 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] Fix building of COFF zImages
  [POWERPC] spufs: Fix error handling in spufs_fill_dir()
  [POWERPC] Add table of contents to booting-without-of.txt
  [POWERPC] spufs: Don't yield nosched context
  [POWERPC] Fix typo in booting-without-of-txt section numbering
  [POWERPC] scc_sio: Fix link failure
  [POWERPC] cbe_cpufreq: Limit frequency via cpufreq notifier chain
  [POWERPC] Fix pci_setup_phb_io_dynamic for pci_iomap
  [POWERPC] spufs scheduler: Fix wakeup races
  [POWERPC] spufs: Synchronize pte invalidation vs ps close
  [POWERPC] spufs: Free mm if spufs_fill_dir() failed
  [POWERPC] spufs: Fix gang destroy leaks
  [POWERPC] spufs: Hook up spufs_release_mem
  [POWERPC] spufs: Refuse to load the module when not running on cell
  [POWERPC] pasemi: Fix iommu + 64K PAGE_SIZE bug

This patch should get a few birds.  It prevents sigaction calls from
clearing TIF_SIGPENDING in other threads, which could leak -ERESTART*.
And It fixes ptrace_stop not to clear it, which done at the syscall exit
stop could leak -ERESTART*.  It probably removes the harm from signalfd,
at least assuming it never calls dequeue_signal on kernel threads that
might have used block_all_signals.
Signed-off-by: Roland McGrath <roland@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Satoru Takeuchi <takeuchi_satoru@jp.fujitsu.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

scripts/checkpatch.pl should be executable, make it so.
Signed-off-by: Andy Whitcroft <apw@shadowen.org>
Acked-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Joel Schopp <jschopp@austin.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The COFF zImage (for booting oldworld powermacs) wasn't being built
correctly because the procedure descriptor in crt0.S for the zImage
entry point wasn't declared as .globl, and therefore wasn't getting
pulled in from wrapper.a by the linker.  This adds the necessary
.globl statement.
Signed-off-by: Paul Mackerras <paulus@samba.org>

The error path in spufs_fill_dir() is broken. If d_alloc_name() or
spufs_new_file() fails, spufs_prune_dir() is getting called. At this time
dir->inode is not set and a NULL pointer is dereferenced by mutex_lock().
This bugfix replaces spufs_prune_dir() with a shorter version that does
not touch dir->inode but simply removes all children.
Signed-off-by: Sebastian Siewior <bigeasy@linux.vnet.ibm.com>
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Acked-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Add table of contents.
Signed-off-by: Stuart Yoder <stuart.yoder@freescale.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Nosched context sould never be scheduled out, thus we must not
deactivate them in spu_yield ever.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Fix typo in section numbering.
Signed-off-by: Stuart Yoder <stuart.yoder@freescale.com>
Acked-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>

scc_sio.o should only be built if the txx9 serial driver is actually
built into the kernel.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>

--
Signed-off-by: Paul Mackerras <paulus@samba.org>

... and get rid of cpufreq_set_policy call that caused a build
failure due interfering commits.
Signed-off-by: Thomas Renninger <trenn@suse.de>
Signed-off-by: Christian Krafft <krafft@de.ibm.com>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

We had a problem on a system with only dynamically allocated
PCI buses (using of_pci_phb_driver) in combination with libata.
This setup ended up having no "primary" phb, which means
that pci_io_base never got initialized and all IO port
numbers are 64 bit numbers, which is larger than the
PIO_MASK limit.
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Fix the race between checking for contexts on the runqueue and actually
waking them in spu_deactive and spu_yield.

The guts of spu_reschedule are split into a new helper called
grab_runnable_context which shows if there is a runnable thread below
a specified priority and if yes removes if from the runqueue and uses
it.  This function is used by the new __spu_deactivate hepler shared
by preemption and spu_yield to grab a new context before deactivating
a specified priority and if yes removes if from the runqueue and uses
it.  This function is used by the new __spu_deactivate hepler shared
by preemption and spu_yield to grab a new context before deactivating
the old one.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Make sure the mapping_lock also protects access to the various address_space
pointers used for tearing down the ptes on a spu context switch.

Because unmap_mapping_range can sleep we need to turn mapping_lock from
a spinlock into a sleeping mutex.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

In case spufs_fill_dir() fails only put_spu_context()
gets called for cleanup and the acquired mm_struct never gets freed.
Signed-off-by: Sebastian Siewior <bigeasy@linux.vnet.ibm.com>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Previously, closing a SPE gang that still has contexts would trigger
a WARN_ON, and leak the allocated gang.

This change fixes the problem by using the gang's reference counts to
destroy the gang instead. The gangs will persist until their last
reference (be it context or open file handle) is gone.

Also, avoid using statements with side-effects in a WARN_ON().
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Currently spufs_mem_release and the mem file doesn't have any release
method hooked up, leading to leaks everytime is used.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

As noticed by David Woodhouse, it's currently possible to mount
spufs on any machine, which means that it actually will get
mounted by fedora.
This refuses to load the module on platforms that have no
support for SPUs.

Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

The powerpc iommu code was refactored by Linas back in the 2.6.20 time
frame to map 4K pages from the generic code, but I had forgotten to go
back and fix my platform driver before submitting it.
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Paul Mackerras <paulus@samba.org>

- the pseudo_palette is only 16 elements long.
- the pseudo_palette has only 16 elements. Do not write if regno (the array
  index) is more than 15.
Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

- the pseudo_palette is only 16 elements long.
- the pseudo_palette has only 16 elements. Do not write if regno (the array
  index) is more than 15.
Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The pseudo_palette is only 16 elements long.
Signed-off-by: Antonino Daplas <adaplas@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Fix the following warnings in promcon:
WARNING: o-sparc64/drivers/video/console/built-in.o(.text+0x480): Section mismatch: reference to .init.data:promfont_unitable (between 'promcon_init_unimap' and 'promcon_init')
WARNING: o-sparc64/drivers/video/console/built-in.o(.text+0x488): Section mismatch: reference to .init.data:promfont_unitable (between 'promcon_init_unimap' and 'promcon_init')
WARNING: o-sparc64/drivers/video/console/built-in.o(.text+0x48c): Section mismatch: reference to .init.data:promfont_unicount (between 'promcon_init_unimap' and 'promcon_init')
WARNING: o-sparc64/drivers/video/console/built-in.o(.text+0x490): Section mismatch: reference to .init.data:promfont_unicount (between 'promcon_init_unimap' and 'promcon_init')

The warnings happens because the function: promcon_init_unimap()
references promfont_unitable and promfont_unicount which are marked
__initdata by the conmakehash command in the drivers/video/console/Makefile

Fix the warning by removing the __initdata marker on the two variables.
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

It's not just sun4v hypervisor platforms that should return true
for this, sun4u with UltraSPARC-IV should return true too.
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

The scheduling domain hierarchy is:

   all cpus -->
      cpus that share an instruction cache -->
          cpus that share an integer execution unit
Signed-off-by: David S. Miller <davem@davemloft.net>

If the system supports hypervisor based statistics, allow them to
be fetched, enabled, and disabled via sysfs.

Enable and disable via the boolean:

/sys/devices/systems/cpu/cpuN/mmustat_enable

Statistic values are provided under:

/sys/devices/systems/cpu/cpuN/mmu_status/
Signed-off-by: David S. Miller <davem@davemloft.net>

sed 's/scv/svc/'
Signed-off-by: David S. Miller <davem@davemloft.net>

Cache sizes, udelay_val, and clock_tick.
Signed-off-by: David S. Miller <davem@davemloft.net>

Also, use per-cpu data for struct cpu.  Calling kmalloc for
each cpu in topology_init() is just plain clumsy.
Signed-off-by: David S. Miller <davem@davemloft.net>