4 files changed, 70 insertions, 5 deletions

diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index 078fb5533541..f70bd090dacd 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -822,6 +822,7 @@ static void __init prom_send_capabilities(void)
                 /* try calling the ibm,client-architecture-support method */
                 if (call_prom_ret("call-method", 3, 2, &ret,
                                   ADDR("ibm,client-architecture-support"),
+                                  root,
                                   ADDR(ibm_architecture_vec)) == 0) {
                         /* the call exists... */
                         if (ret)
@@ -1622,6 +1623,15 @@ static int __init prom_find_machine_type(void)
                         if (strstr(p, RELOC("Power Macintosh")) ||
                             strstr(p, RELOC("MacRISC")))
                                 return PLATFORM_POWERMAC;
+#ifdef CONFIG_PPC64
+                        /* We must make sure we don't detect the IBM Cell
+                         * blades as pSeries due to some firmware issues,
+                         * so we do it here.
+                         */
+                        if (strstr(p, RELOC("IBM,CBEA")) ||
+                            strstr(p, RELOC("IBM,CPBW-1.0")))
+                                return PLATFORM_GENERIC;
+#endif /* CONFIG_PPC64 */
                         i += sl + 1;
                 }
         }
@@ -1636,7 +1646,7 @@ static int __init prom_find_machine_type(void)
                            compat, sizeof(compat)-1);
         if (len <= 0)
                 return PLATFORM_GENERIC;
-        if (strncmp(compat, RELOC("chrp"), 4))
+        if (strcmp(compat, RELOC("chrp")))
                 return PLATFORM_GENERIC;
 
         /* Default to pSeries. We need to know if we are running LPAR */
@@ -2057,10 +2067,45 @@ static void __init flatten_device_tree(void)
 
 }
 
-
-static void __init fixup_device_tree(void)
+#ifdef CONFIG_PPC_MAPLE
+/* PIBS Version 1.05.0000 04/26/2005 has an incorrect /ht/isa/ranges property.
+ * The values are bad, and it doesn't even have the right number of cells. */
+static void __init fixup_device_tree_maple(void)
 {
+        phandle isa;
+        u32 isa_ranges[6];
+
+        isa = call_prom("finddevice", 1, 1, ADDR("/ht@0/isa@4"));
+        if (!PHANDLE_VALID(isa))
+                return;
+
+        if (prom_getprop(isa, "ranges", isa_ranges, sizeof(isa_ranges))
+                == PROM_ERROR)
+                return;
+
+        if (isa_ranges[0] != 0x1 ||
+                isa_ranges[1] != 0xf4000000 ||
+                isa_ranges[2] != 0x00010000)
+                return;
+
+        prom_printf("fixing up bogus ISA range on Maple...\n");
+
+        isa_ranges[0] = 0x1;
+        isa_ranges[1] = 0x0;
+        isa_ranges[2] = 0x01002000; /* IO space; PCI device = 4 */
+        isa_ranges[3] = 0x0;
+        isa_ranges[4] = 0x0;
+        isa_ranges[5] = 0x00010000;
+        prom_setprop(isa, "/ht@0/isa@4", "ranges",
+                        isa_ranges, sizeof(isa_ranges));
+}
+#else
+#define fixup_device_tree_maple()
+#endif
+
 #if defined(CONFIG_PPC64) && defined(CONFIG_PPC_PMAC)
+static void __init fixup_device_tree_pmac(void)
+{
         phandle u3, i2c, mpic;
         u32 u3_rev;
         u32 interrupts[2];
@@ -2097,9 +2142,16 @@ static void __init fixup_device_tree(void)
         parent = (u32)mpic;
         prom_setprop(i2c, "/u3@0,f8000000/i2c@f8001000", "interrupt-parent",
                      &parent, sizeof(parent));
-#endif
 }
+#else
+#define fixup_device_tree_pmac()
+#endif
 
+static void __init fixup_device_tree(void)
+{
+        fixup_device_tree_maple();
+        fixup_device_tree_pmac();
+}
 
 static void __init prom_find_boot_cpu(void)
 {
diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
index 01e3c08cb550..8fdeca2d4597 100644
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -803,10 +803,13 @@ static int do_setcontext(struct ucontext __user *ucp, struct pt_regs *regs, int
                 if (__get_user(cmcp, &ucp->uc_regs))
                         return -EFAULT;
                 mcp = (struct mcontext __user *)(u64)cmcp;
+                /* no need to check access_ok(mcp), since mcp < 4GB */
         }
 #else
         if (__get_user(mcp, &ucp->uc_regs))
                 return -EFAULT;
+        if (!access_ok(VERIFY_READ, mcp, sizeof(*mcp)))
+                return -EFAULT;
 #endif
         restore_sigmask(&set);
         if (restore_user_regs(regs, mcp, sig))
@@ -908,13 +911,14 @@ int sys_debug_setcontext(struct ucontext __user *ctx,
 {
         struct sig_dbg_op op;
         int i;
+        unsigned char tmp;
         unsigned long new_msr = regs->msr;
 #if defined(CONFIG_4xx) || defined(CONFIG_BOOKE)
         unsigned long new_dbcr0 = current->thread.dbcr0;
 #endif
 
         for (i=0; i<ndbg; i++) {
-                if (__copy_from_user(&op, dbg, sizeof(op)))
+                if (copy_from_user(&op, dbg + i, sizeof(op)))
                         return -EFAULT;
                 switch (op.dbg_type) {
                 case SIG_DBG_SINGLE_STEPPING:
@@ -959,6 +963,11 @@ int sys_debug_setcontext(struct ucontext __user *ctx,
         current->thread.dbcr0 = new_dbcr0;
 #endif
 
+        if (!access_ok(VERIFY_READ, ctx, sizeof(*ctx))
+            || __get_user(tmp, (u8 __user *) ctx)
+            || __get_user(tmp, (u8 __user *) (ctx + 1) - 1))
+                return -EFAULT;
+
         /*
          * If we get a fault copying the context into the kernel's
          * image of the user's registers, we can't just return -EFAULT
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 27f65b95184d..c2db642f4cdd 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -182,6 +182,8 @@ static long restore_sigcontext(struct pt_regs *regs, sigset_t *set, int sig,
         err |= __get_user(msr, &sc->gp_regs[PT_MSR]);
         if (err)
                 return err;
+        if (v_regs && !access_ok(VERIFY_READ, v_regs, 34 * sizeof(vector128)))
+                return -EFAULT;
         /* Copy 33 vec registers (vr0..31 and vscr) from the stack */
         if (v_regs != 0 && (msr & MSR_VEC) != 0)
                 err |= __copy_from_user(current->thread.vr, v_regs,
diff --git a/arch/powerpc/kernel/systbl.S b/arch/powerpc/kernel/systbl.S
index cf56a1d499ff..26ed1f5ef16e 100644
--- a/arch/powerpc/kernel/systbl.S
+++ b/arch/powerpc/kernel/systbl.S
@@ -338,6 +338,8 @@ SYSCALL(symlinkat)
 SYSCALL(readlinkat)
 SYSCALL(fchmodat)
 SYSCALL(faccessat)
+COMPAT_SYS(get_robust_list)
+COMPAT_SYS(set_robust_list)
 
 /*
  * please add new calls to arch/powerpc/platforms/cell/spu_callbacks.c