Merge branch 'origin' into devel-stable

Conflicts:
	arch/arm/mach-mx2/devices.c
	arch/arm/mach-mx2/devices.h
	sound/soc/pxa/pxa-ssp.c

7 files changed, 473 insertions, 156 deletions

diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index e3551d20464f..d16af6a423fb 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -212,6 +212,15 @@ config CS5535_MFGPT_DEFAULT_IRQ
           want to use a different IRQ by default.  This is here for
           architectures to set as necessary.
 
+config CS5535_CLOCK_EVENT_SRC
+        tristate "CS5535/CS5536 high-res timer (MFGPT) events"
+        depends on GENERIC_TIME && GENERIC_CLOCKEVENTS && CS5535_MFGPT
+        help
+          This driver provides a clock event source based on the MFGPT
+          timer(s) in the CS5535 and CS5536 companion chips.
+          MFGPTs have a better resolution and max interval than the
+          generic PIT, and are suitable for use as high-res timers.
+
 config HP_ILO
         tristate "Channel interface driver for HP iLO/iLO2 processor"
         depends on PCI
diff --git a/drivers/misc/iwmc3200top/fw-download.c b/drivers/misc/iwmc3200top/fw-download.c
index 50d431e469f5..9dbaeb574e63 100644
--- a/drivers/misc/iwmc3200top/fw-download.c
+++ b/drivers/misc/iwmc3200top/fw-download.c
@@ -43,15 +43,14 @@ static int iwmct_fw_parser_init(struct iwmct_priv *priv, const u8 *file,
         struct iwmct_parser *parser = &priv->parser;
         struct iwmct_fw_hdr *fw_hdr = &parser->versions;
 
-        LOG_INFOEX(priv, INIT, "-->\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
 
         LOG_INFO(priv, FW_DOWNLOAD, "file_size=%zd\n", file_size);
 
         parser->file = file;
         parser->file_size = file_size;
         parser->cur_pos = 0;
-        parser->buf = NULL;
-
+        parser->entry_point = 0;
         parser->buf = kzalloc(block_size, GFP_KERNEL);
         if (!parser->buf) {
                 LOG_ERROR(priv, FW_DOWNLOAD, "kzalloc error\n");
@@ -70,7 +69,7 @@ static int iwmct_fw_parser_init(struct iwmct_priv *priv, const u8 *file,
 
         parser->cur_pos += sizeof(struct iwmct_fw_hdr);
 
-        LOG_INFOEX(priv, INIT, "<--\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
         return 0;
 }
 
@@ -113,7 +112,7 @@ static int iwmct_parse_next_section(struct iwmct_priv *priv, const u8 **p_sec,
         struct iwmct_dbg *dbg = &priv->dbg;
         struct iwmct_fw_sec_hdr *sec_hdr;
 
-        LOG_INFOEX(priv, INIT, "-->\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
 
         while (parser->cur_pos + sizeof(struct iwmct_fw_sec_hdr)
                 <= parser->file_size) {
@@ -152,7 +151,7 @@ static int iwmct_parse_next_section(struct iwmct_priv *priv, const u8 **p_sec,
                         "finished with section cur_pos=%zd\n", parser->cur_pos);
         }
 
-        LOG_INFOEX(priv, INIT, "<--\n");
+        LOG_TRACE(priv, INIT, "<--\n");
         return 0;
 }
 
@@ -167,7 +166,7 @@ static int iwmct_download_section(struct iwmct_priv *priv, const u8 *p_sec,
         int ret = 0;
         u32 cmd = 0;
 
-        LOG_INFOEX(priv, INIT, "-->\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
         LOG_INFO(priv, FW_DOWNLOAD, "Download address 0x%x size 0x%zx\n",
                                 addr, sec_size);
 
@@ -229,7 +228,7 @@ static int iwmct_download_section(struct iwmct_priv *priv, const u8 *p_sec,
                 hdr->cmd = cpu_to_le32(cmd);
                 /* send it down */
                 /* TODO: add more proper sending and error checking */
-                ret = iwmct_tx(priv, 0, parser->buf, trans_size);
+                ret = iwmct_tx(priv, parser->buf, trans_size);
                 if (ret != 0) {
                         LOG_INFO(priv, FW_DOWNLOAD,
                                 "iwmct_tx returned %d\n", ret);
@@ -251,7 +250,7 @@ static int iwmct_download_section(struct iwmct_priv *priv, const u8 *p_sec,
         if (sent < sec_size)
                 ret = -EINVAL;
 exit:
-        LOG_INFOEX(priv, INIT, "<--\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
         return ret;
 }
 
@@ -262,7 +261,7 @@ static int iwmct_kick_fw(struct iwmct_priv *priv, bool jump)
         int ret;
         u32 cmd;
 
-        LOG_INFOEX(priv, INIT, "-->\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "-->\n");
 
         memset(parser->buf, 0, parser->buf_size);
         cmd = IWMC_CMD_SIGNATURE << CMD_HDR_SIGNATURE_POS;
@@ -281,11 +280,11 @@ static int iwmct_kick_fw(struct iwmct_priv *priv, bool jump)
         LOG_HEXDUMP(FW_DOWNLOAD, parser->buf, sizeof(*hdr));
         /* send it down */
         /* TODO: add more proper sending and error checking */
-        ret = iwmct_tx(priv, 0, parser->buf, IWMC_SDIO_BLK_SIZE);
+        ret = iwmct_tx(priv, parser->buf, IWMC_SDIO_BLK_SIZE);
         if (ret)
                 LOG_INFO(priv, FW_DOWNLOAD, "iwmct_tx returned %d", ret);
 
-        LOG_INFOEX(priv, INIT, "<--\n");
+        LOG_TRACE(priv, FW_DOWNLOAD, "<--\n");
         return 0;
 }
 
@@ -298,8 +297,16 @@ int iwmct_fw_load(struct iwmct_priv *priv)
         __le32 addr;
         int ret;
 
-        /* clear parser struct */
-        memset(&priv->parser, 0, sizeof(struct iwmct_parser));
+
+        LOG_INFO(priv, FW_DOWNLOAD, "barker download request 0x%x is:\n",
+                        priv->barker);
+        LOG_INFO(priv, FW_DOWNLOAD, "*******  Top FW %s requested ********\n",
+                        (priv->barker & BARKER_DNLOAD_TOP_MSK) ? "was" : "not");
+        LOG_INFO(priv, FW_DOWNLOAD, "*******  GPS FW %s requested ********\n",
+                        (priv->barker & BARKER_DNLOAD_GPS_MSK) ? "was" : "not");
+        LOG_INFO(priv, FW_DOWNLOAD, "*******  BT FW %s requested ********\n",
+                        (priv->barker & BARKER_DNLOAD_BT_MSK) ? "was" : "not");
+
 
         /* get the firmware */
         ret = request_firmware(&raw, fw_name, &priv->func->dev);
@@ -317,6 +324,7 @@ int iwmct_fw_load(struct iwmct_priv *priv)
 
         LOG_INFO(priv, FW_DOWNLOAD, "Read firmware '%s'\n", fw_name);
 
+        /* clear parser struct */
         ret = iwmct_fw_parser_init(priv, raw->data, raw->size, priv->trans_len);
         if (ret < 0) {
                 LOG_ERROR(priv, FW_DOWNLOAD,
@@ -324,7 +332,6 @@ int iwmct_fw_load(struct iwmct_priv *priv)
                 goto exit;
         }
 
-        /* checksum  */
         if (!iwmct_checksum(priv)) {
                 LOG_ERROR(priv, FW_DOWNLOAD, "checksum error\n");
                 ret = -EINVAL;
@@ -333,23 +340,18 @@ int iwmct_fw_load(struct iwmct_priv *priv)
 
         /* download firmware to device */
         while (iwmct_parse_next_section(priv, &pdata, &len, &addr)) {
-                if (iwmct_download_section(priv, pdata, len, addr)) {
+                ret = iwmct_download_section(priv, pdata, len, addr);
+                if (ret) {
                         LOG_ERROR(priv, FW_DOWNLOAD,
                                   "%s download section failed\n", fw_name);
-                        ret = -EIO;
                         goto exit;
                 }
         }
 
-        iwmct_kick_fw(priv, !!(priv->barker & BARKER_DNLOAD_JUMP_MSK));
+        ret = iwmct_kick_fw(priv, !!(priv->barker & BARKER_DNLOAD_JUMP_MSK));
 
 exit:
         kfree(priv->parser.buf);
-
-        if (raw)
-                release_firmware(raw);
-
-        raw = NULL;
-
+        release_firmware(raw);
         return ret;
 }
diff --git a/drivers/misc/iwmc3200top/iwmc3200top.h b/drivers/misc/iwmc3200top/iwmc3200top.h
index 43bd510e1872..740ff0738ea8 100644
--- a/drivers/misc/iwmc3200top/iwmc3200top.h
+++ b/drivers/misc/iwmc3200top/iwmc3200top.h
@@ -196,9 +196,7 @@ struct iwmct_priv {
         struct list_head read_req_list;
 };
 
-extern int iwmct_tx(struct iwmct_priv *priv, unsigned int addr,
-                void *src, int count);
-
+extern int iwmct_tx(struct iwmct_priv *priv, void *src, int count);
 extern int iwmct_fw_load(struct iwmct_priv *priv);
 
 extern void iwmct_dbg_init_params(struct iwmct_priv *drv);
diff --git a/drivers/misc/iwmc3200top/log.h b/drivers/misc/iwmc3200top/log.h
index aba8121f978c..4434bb16cea7 100644
--- a/drivers/misc/iwmc3200top/log.h
+++ b/drivers/misc/iwmc3200top/log.h
@@ -37,13 +37,26 @@
 #define LOG_SEV_INFO                    3
 #define LOG_SEV_INFOEX                  4
 
-#define LOG_SEV_FILTER_ALL              \
-        (BIT(LOG_SEV_CRITICAL) |        \
-         BIT(LOG_SEV_ERROR)    |        \
-         BIT(LOG_SEV_WARNING)  |        \
-         BIT(LOG_SEV_INFO)     |        \
+/* Log levels not defined for FW */
+#define LOG_SEV_TRACE                   5
+#define LOG_SEV_DUMP                    6
+
+#define LOG_SEV_FW_FILTER_ALL           \
+        (BIT(LOG_SEV_CRITICAL)  |       \
+         BIT(LOG_SEV_ERROR)     |       \
+         BIT(LOG_SEV_WARNING)   |       \
+         BIT(LOG_SEV_INFO)      |       \
          BIT(LOG_SEV_INFOEX))
 
+#define LOG_SEV_FILTER_ALL              \
+        (BIT(LOG_SEV_CRITICAL)  |       \
+         BIT(LOG_SEV_ERROR)     |       \
+         BIT(LOG_SEV_WARNING)   |       \
+         BIT(LOG_SEV_INFO)      |       \
+         BIT(LOG_SEV_INFOEX)    |       \
+         BIT(LOG_SEV_TRACE)     |       \
+         BIT(LOG_SEV_DUMP))
+
 /* log source */
 #define LOG_SRC_INIT                    0
 #define LOG_SRC_DEBUGFS                 1
@@ -104,16 +117,16 @@ do {									\
                          __func__, __LINE__, ##args);                   \
 } while (0)
 
-#define LOG_INFOEX(priv, src, fmt, args...)                             \
+#define LOG_TRACE(priv, src, fmt, args...)                              \
 do {                                                                    \
-        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_INFOEX))       \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_TRACE))        \
                 dev_dbg(priv2dev(priv), "%s %d: " fmt,                  \
                          __func__, __LINE__, ##args);                   \
 } while (0)
 
 #define LOG_HEXDUMP(src, ptr, len)                                      \
 do {                                                                    \
-        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_INFOEX))       \
+        if (iwmct_logdefs[LOG_SRC_ ## src] & BIT(LOG_SEV_DUMP)) \
                 print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_NONE,        \
                                 16, 1, ptr, len, false);                \
 } while (0)
@@ -142,7 +155,7 @@ ssize_t store_iwmct_log_level_fw(struct device *d,
 #define LOG_ERROR(priv, src, fmt, args...)
 #define LOG_WARNING(priv, src, fmt, args...)
 #define LOG_INFO(priv, src, fmt, args...)
-#define LOG_INFOEX(priv, src, fmt, args...)
+#define LOG_TRACE(priv, src, fmt, args...)
 #define LOG_HEXDUMP(src, ptr, len)
 
 static inline void iwmct_log_top_message(struct iwmct_priv *priv,
diff --git a/drivers/misc/iwmc3200top/main.c b/drivers/misc/iwmc3200top/main.c
index fafcaa481d74..3b7292a5cea9 100644
--- a/drivers/misc/iwmc3200top/main.c
+++ b/drivers/misc/iwmc3200top/main.c
@@ -49,6 +49,20 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR(DRIVER_COPYRIGHT);
 MODULE_FIRMWARE(FW_NAME(FW_API_VER));
 
+
+static inline int __iwmct_tx(struct iwmct_priv *priv, void *src, int count)
+{
+        return sdio_memcpy_toio(priv->func, IWMC_SDIO_DATA_ADDR, src, count);
+
+}
+int iwmct_tx(struct iwmct_priv *priv, void *src, int count)
+{
+        int ret;
+        sdio_claim_host(priv->func);
+        ret =  __iwmct_tx(priv, src, count);
+        sdio_release_host(priv->func);
+        return ret;
+}
 /*
  * This workers main task is to wait for OP_OPR_ALIVE
  * from TOP FW until ALIVE_MSG_TIMOUT timeout is elapsed.
@@ -66,7 +80,7 @@ static void iwmct_rescan_worker(struct work_struct *ws)
 
         ret = bus_rescan_devices(priv->func->dev.bus);
         if (ret < 0)
-                LOG_INFO(priv, FW_DOWNLOAD, "bus_rescan_devices FAILED!!!\n");
+                LOG_INFO(priv, INIT, "bus_rescan_devices FAILED!!!\n");
 }
 
 static void op_top_message(struct iwmct_priv *priv, struct top_msg *msg)
@@ -137,7 +151,7 @@ int iwmct_send_hcmd(struct iwmct_priv *priv, u8 *cmd, u16 len)
         int ret;
         u8 *buf;
 
-        LOG_INFOEX(priv, FW_MSG, "Sending hcmd:\n");
+        LOG_TRACE(priv, FW_MSG, "Sending hcmd:\n");
 
         /* add padding to 256 for IWMC */
         ((struct top_msg *)cmd)->hdr.flags |= CMD_FLAG_PADDING_256;
@@ -158,27 +172,12 @@ int iwmct_send_hcmd(struct iwmct_priv *priv, u8 *cmd, u16 len)
         }
 
         memcpy(buf, cmd, len);
-
-        sdio_claim_host(priv->func);
-        ret = sdio_memcpy_toio(priv->func, IWMC_SDIO_DATA_ADDR, buf,
-                               FW_HCMD_BLOCK_SIZE);
-        sdio_release_host(priv->func);
+        ret = iwmct_tx(priv, buf, FW_HCMD_BLOCK_SIZE);
 
         kfree(buf);
         return ret;
 }
 
-int iwmct_tx(struct iwmct_priv *priv, unsigned int addr,
-        void *src, int count)
-{
-        int ret;
-
-        sdio_claim_host(priv->func);
-        ret = sdio_memcpy_toio(priv->func, addr, src, count);
-        sdio_release_host(priv->func);
-
-        return ret;
-}
 
 static void iwmct_irq_read_worker(struct work_struct *ws)
 {
@@ -192,7 +191,7 @@ static void iwmct_irq_read_worker(struct work_struct *ws)
 
         priv = container_of(ws, struct iwmct_priv, isr_worker);
 
-        LOG_INFO(priv, IRQ, "enter iwmct_irq_read_worker %p\n", ws);
+        LOG_TRACE(priv, IRQ, "enter iwmct_irq_read_worker %p\n", ws);
 
         /* --------------------- Handshake with device -------------------- */
         sdio_claim_host(priv->func);
@@ -273,8 +272,7 @@ static void iwmct_irq_read_worker(struct work_struct *ws)
 
                 if (barker & BARKER_DNLOAD_SYNC_MSK) {
                         /* Send the same barker back */
-                        ret = sdio_memcpy_toio(priv->func, IWMC_SDIO_DATA_ADDR,
-                                               buf, iosize);
+                        ret = __iwmct_tx(priv, buf, iosize);
                         if (ret) {
                                 LOG_ERROR(priv, IRQ,
                                          "error %d echoing barker\n", ret);
@@ -292,15 +290,6 @@ static void iwmct_irq_read_worker(struct work_struct *ws)
 
         sdio_release_host(priv->func);
 
-
-        LOG_INFO(priv, IRQ, "barker download request 0x%x is:\n", priv->barker);
-        LOG_INFO(priv, IRQ, "*******  Top FW %s requested ********\n",
-                        (priv->barker & BARKER_DNLOAD_TOP_MSK) ? "was" : "not");
-        LOG_INFO(priv, IRQ, "*******  GPS FW %s requested ********\n",
-                        (priv->barker & BARKER_DNLOAD_GPS_MSK) ? "was" : "not");
-        LOG_INFO(priv, IRQ, "*******  BT FW %s requested ********\n",
-                        (priv->barker & BARKER_DNLOAD_BT_MSK) ? "was" : "not");
-
         if (priv->dbg.fw_download)
                 iwmct_fw_load(priv);
         else
@@ -312,7 +301,7 @@ exit_release:
         sdio_release_host(priv->func);
 exit:
         kfree(buf);
-        LOG_INFO(priv, IRQ, "exit iwmct_irq_read_worker\n");
+        LOG_TRACE(priv, IRQ, "exit iwmct_irq_read_worker\n");
 }
 
 static void iwmct_irq(struct sdio_func *func)
@@ -325,12 +314,12 @@ static void iwmct_irq(struct sdio_func *func)
 
         priv = sdio_get_drvdata(func);
 
-        LOG_INFO(priv, IRQ, "enter iwmct_irq\n");
+        LOG_TRACE(priv, IRQ, "enter iwmct_irq\n");
 
         /* read the function's status register */
         val = sdio_readb(func, IWMC_SDIO_INTR_STATUS_ADDR, &ret);
 
-        LOG_INFO(priv, IRQ, "iir value = %d, ret=%d\n", val, ret);
+        LOG_TRACE(priv, IRQ, "iir value = %d, ret=%d\n", val, ret);
 
         if (!val) {
                 LOG_ERROR(priv, IRQ, "iir = 0, exiting ISR\n");
@@ -372,7 +361,7 @@ static void iwmct_irq(struct sdio_func *func)
 
         queue_work(priv->wq, &priv->isr_worker);
 
-        LOG_INFO(priv, IRQ, "exit iwmct_irq\n");
+        LOG_TRACE(priv, IRQ, "exit iwmct_irq\n");
 
         return;
 
@@ -608,8 +597,6 @@ static void iwmct_remove(struct sdio_func *func)
         struct iwmct_work_struct *read_req;
         struct iwmct_priv *priv = sdio_get_drvdata(func);
 
-        priv = sdio_get_drvdata(func);
-
         LOG_INFO(priv, INIT, "enter\n");
 
         sdio_claim_host(func);
@@ -660,7 +647,7 @@ static int __init iwmct_init(void)
 
         /* Default log filter settings */
         iwmct_log_set_filter(LOG_SRC_ALL, LOG_SEV_FILTER_RUNTIME);
-        iwmct_log_set_filter(LOG_SRC_FW_MSG, LOG_SEV_FILTER_ALL);
+        iwmct_log_set_filter(LOG_SRC_FW_MSG, LOG_SEV_FW_FILTER_ALL);
         iwmct_log_set_fw_filter(LOG_SRC_ALL, FW_LOG_SEV_FILTER_RUNTIME);
 
         rc = sdio_register_driver(&iwmct_driver);
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index 3648b23d5c92..4a0648301fdf 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -26,21 +26,9 @@
  * It is adapted from the Linux Kernel Dump Test Tool by
  * Fernando Luis Vazquez Cao <http://lkdtt.sourceforge.net>
  *
- * Usage :  insmod lkdtm.ko [recur_count={>0}] cpoint_name=<> cpoint_type=<>
- *                                                      [cpoint_count={>0}]
+ * Debugfs support added by Simon Kagstrom <simon.kagstrom@netinsight.net>
  *
- * recur_count : Recursion level for the stack overflow test. Default is 10.
- *
- * cpoint_name : Crash point where the kernel is to be crashed. It can be
- *               one of INT_HARDWARE_ENTRY, INT_HW_IRQ_EN, INT_TASKLET_ENTRY,
- *               FS_DEVRW, MEM_SWAPOUT, TIMERADD, SCSI_DISPATCH_CMD,
- *               IDE_CORE_CP
- *
- * cpoint_type : Indicates the action to be taken on hitting the crash point.
- *               It can be one of PANIC, BUG, EXCEPTION, LOOP, OVERFLOW
- *
- * cpoint_count : Indicates the number of times the crash point is to be hit
- *                to trigger an action. The default is 10.
+ * See Documentation/fault-injection/provoke-crashes.txt for instructions
  */
 
 #include <linux/kernel.h>
@@ -53,13 +41,12 @@
 #include <linux/interrupt.h>
 #include <linux/hrtimer.h>
 #include <scsi/scsi_cmnd.h>
+#include <linux/debugfs.h>
 
 #ifdef CONFIG_IDE
 #include <linux/ide.h>
 #endif
 
-#define NUM_CPOINTS 8
-#define NUM_CPOINT_TYPES 5
 #define DEFAULT_COUNT 10
 #define REC_NUM_DEFAULT 10
 
@@ -72,7 +59,8 @@ enum cname {
         MEM_SWAPOUT,
         TIMERADD,
         SCSI_DISPATCH_CMD,
-        IDE_CORE_CP
+        IDE_CORE_CP,
+        DIRECT,
 };
 
 enum ctype {
@@ -81,7 +69,11 @@ enum ctype {
         BUG,
         EXCEPTION,
         LOOP,
-        OVERFLOW
+        OVERFLOW,
+        CORRUPT_STACK,
+        UNALIGNED_LOAD_STORE_WRITE,
+        OVERWRITE_ALLOCATION,
+        WRITE_AFTER_FREE,
 };
 
 static char* cp_name[] = {
@@ -92,7 +84,8 @@ static char* cp_name[] = {
         "MEM_SWAPOUT",
         "TIMERADD",
         "SCSI_DISPATCH_CMD",
-        "IDE_CORE_CP"
+        "IDE_CORE_CP",
+        "DIRECT",
 };
 
 static char* cp_type[] = {
@@ -100,7 +93,11 @@ static char* cp_type[] = {
         "BUG",
         "EXCEPTION",
         "LOOP",
-        "OVERFLOW"
+        "OVERFLOW",
+        "CORRUPT_STACK",
+        "UNALIGNED_LOAD_STORE_WRITE",
+        "OVERWRITE_ALLOCATION",
+        "WRITE_AFTER_FREE",
 };
 
 static struct jprobe lkdtm;
@@ -193,34 +190,66 @@ int jp_generic_ide_ioctl(ide_drive_t *drive, struct file *file,
 }
 #endif
 
+/* Return the crashpoint number or NONE if the name is invalid */
+static enum ctype parse_cp_type(const char *what, size_t count)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(cp_type); i++) {
+                if (!strcmp(what, cp_type[i]))
+                        return i + 1;
+        }
+
+        return NONE;
+}
+
+static const char *cp_type_to_str(enum ctype type)
+{
+        if (type == NONE || type < 0 || type > ARRAY_SIZE(cp_type))
+                return "None";
+
+        return cp_type[type - 1];
+}
+
+static const char *cp_name_to_str(enum cname name)
+{
+        if (name == INVALID || name < 0 || name > ARRAY_SIZE(cp_name))
+                return "INVALID";
+
+        return cp_name[name - 1];
+}
+
+
 static int lkdtm_parse_commandline(void)
 {
         int i;
 
-        if (cpoint_name == NULL || cpoint_type == NULL ||
-                                        cpoint_count < 1 || recur_count < 1)
+        if (cpoint_count < 1 || recur_count < 1)
                 return -EINVAL;
 
-        for (i = 0; i < NUM_CPOINTS; ++i) {
+        count = cpoint_count;
+
+        /* No special parameters */
+        if (!cpoint_type && !cpoint_name)
+                return 0;
+
+        /* Neither or both of these need to be set */
+        if (!cpoint_type || !cpoint_name)
+                return -EINVAL;
+
+        cptype = parse_cp_type(cpoint_type, strlen(cpoint_type));
+        if (cptype == NONE)
+                return -EINVAL;
+
+        for (i = 0; i < ARRAY_SIZE(cp_name); i++) {
                 if (!strcmp(cpoint_name, cp_name[i])) {
                         cpoint = i + 1;
-                        break;
-                }
-        }
-
-        for (i = 0; i < NUM_CPOINT_TYPES; ++i) {
-                if (!strcmp(cpoint_type, cp_type[i])) {
-                        cptype = i + 1;
-                        break;
+                        return 0;
                 }
         }
 
-        if (cpoint == INVALID || cptype == NONE)
-                return -EINVAL;
-
-        count = cpoint_count;
-
-        return 0;
+        /* Could not find a valid crash point */
+        return -EINVAL;
 }
 
 static int recursive_loop(int a)
@@ -235,53 +264,92 @@ static int recursive_loop(int a)
                 return recursive_loop(a);
 }
 
-void lkdtm_handler(void)
+static void lkdtm_do_action(enum ctype which)
 {
-        printk(KERN_INFO "lkdtm : Crash point %s of type %s hit\n",
-                                         cpoint_name, cpoint_type);
-        --count;
+        switch (which) {
+        case PANIC:
+                panic("dumptest");
+                break;
+        case BUG:
+                BUG();
+                break;
+        case EXCEPTION:
+                *((int *) 0) = 0;
+                break;
+        case LOOP:
+                for (;;)
+                        ;
+                break;
+        case OVERFLOW:
+                (void) recursive_loop(0);
+                break;
+        case CORRUPT_STACK: {
+                volatile u32 data[8];
+                volatile u32 *p = data;
+
+                p[12] = 0x12345678;
+                break;
+        }
+        case UNALIGNED_LOAD_STORE_WRITE: {
+                static u8 data[5] __attribute__((aligned(4))) = {1, 2,
+                                3, 4, 5};
+                u32 *p;
+                u32 val = 0x12345678;
+
+                p = (u32 *)(data + 1);
+                if (*p == 0)
+                        val = 0x87654321;
+                *p = val;
+                 break;
+        }
+        case OVERWRITE_ALLOCATION: {
+                size_t len = 1020;
+                u32 *data = kmalloc(len, GFP_KERNEL);
+
+                data[1024 / sizeof(u32)] = 0x12345678;
+                kfree(data);
+                break;
+        }
+        case WRITE_AFTER_FREE: {
+                size_t len = 1024;
+                u32 *data = kmalloc(len, GFP_KERNEL);
+
+                kfree(data);
+                schedule();
+                memset(data, 0x78, len);
+                break;
+        }
+        case NONE:
+        default:
+                break;
+        }
+
+}
+
+static void lkdtm_handler(void)
+{
+        count--;
+        printk(KERN_INFO "lkdtm: Crash point %s of type %s hit, trigger in %d rounds\n",
+                        cp_name_to_str(cpoint), cp_type_to_str(cptype), count);
 
         if (count == 0) {
-                switch (cptype) {
-                case NONE:
-                        break;
-                case PANIC:
-                        printk(KERN_INFO "lkdtm : PANIC\n");
-                        panic("dumptest");
-                        break;
-                case BUG:
-                        printk(KERN_INFO "lkdtm : BUG\n");
-                        BUG();
-                        break;
-                case EXCEPTION:
-                        printk(KERN_INFO "lkdtm : EXCEPTION\n");
-                        *((int *) 0) = 0;
-                        break;
-                case LOOP:
-                        printk(KERN_INFO "lkdtm : LOOP\n");
-                        for (;;);
-                        break;
-                case OVERFLOW:
-                        printk(KERN_INFO "lkdtm : OVERFLOW\n");
-                        (void) recursive_loop(0);
-                        break;
-                default:
-                        break;
-                }
+                lkdtm_do_action(cptype);
                 count = cpoint_count;
         }
 }
 
-static int __init lkdtm_module_init(void)
+static int lkdtm_register_cpoint(enum cname which)
 {
         int ret;
 
-        if (lkdtm_parse_commandline() == -EINVAL) {
-                printk(KERN_INFO "lkdtm : Invalid command\n");
-                return -EINVAL;
-        }
+        cpoint = INVALID;
+        if (lkdtm.entry != NULL)
+                unregister_jprobe(&lkdtm);
 
-        switch (cpoint) {
+        switch (which) {
+        case DIRECT:
+                lkdtm_do_action(cptype);
+                return 0;
         case INT_HARDWARE_ENTRY:
                 lkdtm.kp.symbol_name = "do_IRQ";
                 lkdtm.entry = (kprobe_opcode_t*) jp_do_irq;
@@ -315,28 +383,268 @@ static int __init lkdtm_module_init(void)
                 lkdtm.kp.symbol_name = "generic_ide_ioctl";
                 lkdtm.entry = (kprobe_opcode_t*) jp_generic_ide_ioctl;
 #else
-                printk(KERN_INFO "lkdtm : Crash point not available\n");
+                printk(KERN_INFO "lkdtm: Crash point not available\n");
+                return -EINVAL;
 #endif
                 break;
         default:
-                printk(KERN_INFO "lkdtm : Invalid Crash Point\n");
-                break;
+                printk(KERN_INFO "lkdtm: Invalid Crash Point\n");
+                return -EINVAL;
         }
 
+        cpoint = which;
         if ((ret = register_jprobe(&lkdtm)) < 0) {
-                printk(KERN_INFO "lkdtm : Couldn't register jprobe\n");
-                return ret;
+                printk(KERN_INFO "lkdtm: Couldn't register jprobe\n");
+                cpoint = INVALID;
+        }
+
+        return ret;
+}
+
+static ssize_t do_register_entry(enum cname which, struct file *f,
+                const char __user *user_buf, size_t count, loff_t *off)
+{
+        char *buf;
+        int err;
+
+        if (count >= PAGE_SIZE)
+                return -EINVAL;
+
+        buf = (char *)__get_free_page(GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        if (copy_from_user(buf, user_buf, count)) {
+                free_page((unsigned long) buf);
+                return -EFAULT;
+        }
+        /* NULL-terminate and remove enter */
+        buf[count] = '\0';
+        strim(buf);
+
+        cptype = parse_cp_type(buf, count);
+        free_page((unsigned long) buf);
+
+        if (cptype == NONE)
+                return -EINVAL;
+
+        err = lkdtm_register_cpoint(which);
+        if (err < 0)
+                return err;
+
+        *off += count;
+
+        return count;
+}
+
+/* Generic read callback that just prints out the available crash types */
+static ssize_t lkdtm_debugfs_read(struct file *f, char __user *user_buf,
+                size_t count, loff_t *off)
+{
+        char *buf;
+        int i, n, out;
+
+        buf = (char *)__get_free_page(GFP_KERNEL);
+
+        n = snprintf(buf, PAGE_SIZE, "Available crash types:\n");
+        for (i = 0; i < ARRAY_SIZE(cp_type); i++)
+                n += snprintf(buf + n, PAGE_SIZE - n, "%s\n", cp_type[i]);
+        buf[n] = '\0';
+
+        out = simple_read_from_buffer(user_buf, count, off,
+                                      buf, n);
+        free_page((unsigned long) buf);
+
+        return out;
+}
+
+static int lkdtm_debugfs_open(struct inode *inode, struct file *file)
+{
+        return 0;
+}
+
+
+static ssize_t int_hardware_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(INT_HARDWARE_ENTRY, f, buf, count, off);
+}
+
+static ssize_t int_hw_irq_en(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(INT_HW_IRQ_EN, f, buf, count, off);
+}
+
+static ssize_t int_tasklet_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(INT_TASKLET_ENTRY, f, buf, count, off);
+}
+
+static ssize_t fs_devrw_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(FS_DEVRW, f, buf, count, off);
+}
+
+static ssize_t mem_swapout_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(MEM_SWAPOUT, f, buf, count, off);
+}
+
+static ssize_t timeradd_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(TIMERADD, f, buf, count, off);
+}
+
+static ssize_t scsi_dispatch_cmd_entry(struct file *f,
+                const char __user *buf, size_t count, loff_t *off)
+{
+        return do_register_entry(SCSI_DISPATCH_CMD, f, buf, count, off);
+}
+
+static ssize_t ide_core_cp_entry(struct file *f, const char __user *buf,
+                size_t count, loff_t *off)
+{
+        return do_register_entry(IDE_CORE_CP, f, buf, count, off);
+}
+
+/* Special entry to just crash directly. Available without KPROBEs */
+static ssize_t direct_entry(struct file *f, const char __user *user_buf,
+                size_t count, loff_t *off)
+{
+        enum ctype type;
+        char *buf;
+
+        if (count >= PAGE_SIZE)
+                return -EINVAL;
+        if (count < 1)
+                return -EINVAL;
+
+        buf = (char *)__get_free_page(GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+        if (copy_from_user(buf, user_buf, count)) {
+                free_page((unsigned long) buf);
+                return -EFAULT;
+        }
+        /* NULL-terminate and remove enter */
+        buf[count] = '\0';
+        strim(buf);
+
+        type = parse_cp_type(buf, count);
+        free_page((unsigned long) buf);
+        if (type == NONE)
+                return -EINVAL;
+
+        printk(KERN_INFO "lkdtm: Performing direct entry %s\n",
+                        cp_type_to_str(type));
+        lkdtm_do_action(type);
+        *off += count;
+
+        return count;
+}
+
+struct crash_entry {
+        const char *name;
+        const struct file_operations fops;
+};
+
+static const struct crash_entry crash_entries[] = {
+        {"DIRECT", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = direct_entry} },
+        {"INT_HARDWARE_ENTRY", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = int_hardware_entry} },
+        {"INT_HW_IRQ_EN", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = int_hw_irq_en} },
+        {"INT_TASKLET_ENTRY", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = int_tasklet_entry} },
+        {"FS_DEVRW", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = fs_devrw_entry} },
+        {"MEM_SWAPOUT", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = mem_swapout_entry} },
+        {"TIMERADD", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = timeradd_entry} },
+        {"SCSI_DISPATCH_CMD", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = scsi_dispatch_cmd_entry} },
+        {"IDE_CORE_CP", {.read = lkdtm_debugfs_read,
+                        .open = lkdtm_debugfs_open,
+                        .write = ide_core_cp_entry} },
+};
+
+static struct dentry *lkdtm_debugfs_root;
+
+static int __init lkdtm_module_init(void)
+{
+        int ret = -EINVAL;
+        int n_debugfs_entries = 1; /* Assume only the direct entry */
+        int i;
+
+        /* Register debugfs interface */
+        lkdtm_debugfs_root = debugfs_create_dir("provoke-crash", NULL);
+        if (!lkdtm_debugfs_root) {
+                printk(KERN_ERR "lkdtm: creating root dir failed\n");
+                return -ENODEV;
+        }
+
+#ifdef CONFIG_KPROBES
+        n_debugfs_entries = ARRAY_SIZE(crash_entries);
+#endif
+
+        for (i = 0; i < n_debugfs_entries; i++) {
+                const struct crash_entry *cur = &crash_entries[i];
+                struct dentry *de;
+
+                de = debugfs_create_file(cur->name, 0644, lkdtm_debugfs_root,
+                                NULL, &cur->fops);
+                if (de == NULL) {
+                        printk(KERN_ERR "lkdtm: could not create %s\n",
+                                        cur->name);
+                        goto out_err;
+                }
+        }
+
+        if (lkdtm_parse_commandline() == -EINVAL) {
+                printk(KERN_INFO "lkdtm: Invalid command\n");
+                goto out_err;
+        }
+
+        if (cpoint != INVALID && cptype != NONE) {
+                ret = lkdtm_register_cpoint(cpoint);
+                if (ret < 0) {
+                        printk(KERN_INFO "lkdtm: Invalid crash point %d\n",
+                                        cpoint);
+                        goto out_err;
+                }
+                printk(KERN_INFO "lkdtm: Crash point %s of type %s registered\n",
+                                cpoint_name, cpoint_type);
+        } else {
+                printk(KERN_INFO "lkdtm: No crash points registered, enable through debugfs\n");
         }
 
-        printk(KERN_INFO "lkdtm : Crash point %s of type %s registered\n",
-                                                cpoint_name, cpoint_type);
         return 0;
+
+out_err:
+        debugfs_remove_recursive(lkdtm_debugfs_root);
+        return ret;
 }
 
 static void __exit lkdtm_module_exit(void)
 {
-        unregister_jprobe(&lkdtm);
-        printk(KERN_INFO "lkdtm : Crash point unregistered\n");
+        debugfs_remove_recursive(lkdtm_debugfs_root);
+
+        unregister_jprobe(&lkdtm);
+        printk(KERN_INFO "lkdtm: Crash point unregistered\n");
 }
 
 module_init(lkdtm_module_init);
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index 16f0abda1423..57b152f8d1b9 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -475,7 +475,7 @@ xpnet_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if (skb->data[0] == 0xff) {
                 /* we are being asked to broadcast to all partitions */
-                for_each_bit(dest_partid, xpnet_broadcast_partitions,
+                for_each_set_bit(dest_partid, xpnet_broadcast_partitions,
                              xp_max_npartitions) {
 
                         xpnet_send(skb, queued_msg, start_addr, end_addr,