* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: (47 commits)
[MAINTAINERS] The ham radio code now has website at http://www.linux-ax25.org.
[MIPS] Use __ffs() instead of ffs() for waybit calculation.
[MIPS] Fix Makefile bugs for MIPS32/MIPS64 R1 and R2.
[MIPS] Handle IDE PIO cache aliases on SMP.
[MIPS] Make mips_srs_init static.
[MIPS] MIPS boards: Set HZ to 100.
[MIPS] kgdb: Let gcc compute the array size itself.
[MIPS] FPU affinity for MT ASE.
[MIPS] MT: Improved multithreading support.
[MIPS] kpsd and other AP/SP improvements.
[MIPS] R2: Instruction hazard barrier.
[MIPS] Fix genrtc compilation.
[MIPS] R2: Implement shadow register allocation without spinlock.
[MIPS] Fix VR41xx build errors.
[MIPS] Fix tx49_blast_icache32_page_indexed.
[MIPS] Enable SCHED_NO_NO_OMIT_FRAME_POINTER for MIPS.
[MIPS] Use "R" constraint for cache_op.
[MIPS] Rewrite all the assembler interrupt handlers to C.
[MIPS] Fix the crime against humanity that mipsIRQ.S is.
[MIPS] Fixup damage done by 22a9835c350782a5c3257343713932af3ac92ee0.
...

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[NET]: Remove redundant NULL checks before [kv]free
unaligned access in sk_run_filter()
[IPV6]: Clean up hop-by-hop options handler.
[IPV6] XFRM: Fix decoding session with preceding extension header(s).
[IPV6] XFRM: Don't use old copy of pointer after pskb_may_pull().
[IPV6]: Ensure to have hop-by-hop options in our header of &sk_buff.
[TCP]: Fix truesize underflow

* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
[SPARC64]: Fix dependencies of HUGETLB_PAGE_SIZE_64K

Redundant NULL check before kfree removal
from net/

Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

* master.kernel.org:/pub/scm/linux/kernel/git/davej/cpufreq:
[CPUFREQ] powernow-k8.c: fix a check-after-use
[CPUFREQ] Remove duplicate check in powernow-k8
[CPUFREQ] drivers/cpufreq/cpufreq.c: static functions mustn't be exported
[CPUFREQ] If max_freq got reduced (e.g. by _PPC) a write to sysfs scaling_governor let cpufreq core stuck at low max_freq for ever
[CPUFREQ] x86_64: Proper null pointer check in powernow_k8_get
[CPUFREQ] x86_64: Revert earlier powernow-k8 change
[CPUFREQ] Update LART site URL
[CPUFREQ] Remove pointless check in conservative governor.
[CPUFREQ] trailing whitespace removal de-jour.
[CPUFREQ] extra debugging in cpufreq_add_dev()

This patch fixes dependencies of HUGETLB_PAGE_SIZE_64K

Signed-off-by: Jean-Luc L�ger <jean-luc.leger@dspnet.fr.eu.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch fixes unaligned access warnings noticed on IA64
in sk_run_filter(). 'ptr' can be unaligned.

Signed-off-By: Dmitry Mishin <dim@openvz.org>
Signed-off-By: Kirill Korotaev <dev@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

This fixes kernel builds with gcc 3.2 (not 64-bit, that is looking like
it is beyond recovery) and 3.3. With these bugs fixed we now also can
get undo 3b4c4996a0c24da9e6f8be764e3950b756b18cc0 and similar bits for
SMTC that were added in 79cc8007b93838a670b164b8a55ab3e735a12a8b.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

* master.kernel.org:/home/rmk/linux-2.6-arm:
[ARM] 3479/1: Corgi SSP: Fix potential concurrent access problem
[ARM] 3478/1: SharpSL SCOOP: Fix potenial build failure

This patch fixes a check-after-use introduced by commit
4211a30349e8d2b724cfb4ce2584604f5e59c299 and spotted by the Coverity checker.

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Dave Jones <davej@redhat.com>

Came up through a quick grep for other cases similar to the ftruncate()
one in commit 0a489cb3b6a7b277030cdbc97c2c65905db94536.

Also, add a comment, so that people who read the code understand why we
do what looks like a no-op.

(Again, this won't actually matter to any sane user, since libc will
save and restore the register gcc stomps on, but it's still wrong to
stomp on it)

Signed-off-by: Linus Torvalds <torvalds@osdl.org>

- Removed unused argument (nhoff) for ipv6_parse_hopopts().
- Make ipv6_parse_hopopts() to align with other extension header
handlers.
- Removed pointless assignment (hdr), which is not used afterwards.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Patch from Richard Purdie

corgi_ssp_probe() should not access GPDR directly but should use
pxa_gpio_mode() which has appropriate locking and other safeguards.

Signed-off-by: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Remove a duplicate NULL pointer check introduced by commit
4211a30349e8d2b724cfb4ce2584604f5e59c299

Signed-off-by: Tobias Klauser <tklauser@nuerscht.ch>
Signed-off-by: Dave Jones <davej@redhat.com>

Gcc thinks it owns the incoming argument stack, but that's not true for
"asmlinkage" functions, and it corrupts the caller-set-up argument stack
when it pushes the third argument onto the stack. Which can result in
%ebx getting corrupted in user space.

Now, normally nobody sane would ever notice, since libc will save and
restore %ebx anyway over the system call, but it's still wrong.

I'd much rather have "asmlinkage" tell gcc directly that it doesn't own
the stack, but no such attribute exists, so we're stuck with our hacky
manual "prevent_tail_call()" macro once more (we've had the same issue
before with sys_waitpid() and sys_wait4()).

Thanks to Hans-Werner Hilse <hilse@sub.uni-goettingen.de> for reporting
the issue and testing the fix.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>

We did not correctly decode session with preceding extension
header(s). This was because we had already pulled preceding
headers, skb->nh.raw + 40 + 1 - skb->data was minus, and
pskb_may_pull() failed.

We now have IP6CB(skb)->nhoff and skb->h.raw, and we can
start parsing / decoding upper layer protocol from current
position.

Tracked down by Noriaki TAKAMIYA <takamiya@po.ntts.co.jp>
and tested by Kazunori Miyazawa <kazunori@miyazawa.org>.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Nothing outside traps.c uses it.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Patch from Richard Purdie

Move platform_scoop_config from the SharpSL scoop PCMCIA driver to
the SCOOP driver. This avoids build failures when PCMCIA is not built
or is modular (scoop.c itself cannot be modular).

Signed-off-by: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

This patch removes the EXPORT_SYMBOL_GPL of the static function cpufreq_parse_governor().

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Signed-off-by: Dave Jones <davej@redhat.com>

* 'drm-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
drm: Fix further issues in drivers/char/drm/via_irq.c
drivers/char/drm/drm_memory.c: possible cleanups
drm: deline a few large inlines in DRM code
drm: remove master setting from add/remove context
drm: drm_pci needs dma-mapping.h
[PATCH] drm: Fix issue reported by Coverity in drivers/char/drm/via_irq.c

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

1000Hz will bring an FPGA CPU down on it's knees and it's even worse on
multithreaded cores.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

grow_ary() should not copy struct ipc_id_ary (it copies new->p, not
new). Due to this, memcpy() src pointer could hit unmapped vmalloc page
when near page boundary.

Found during OpenVZ stress testing

Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The previous patch had bugs (locking and refcount).

This one could also be related to the latest DELL reports.
But they only slip into this if a user prog (e.g. powersave daemon does when
AC got (un) plugged due to a scheme change) echos something to
/sys/../cpufreq/scaling_governor
while the frequencies got limited by BIOS.

This one works:

Subject: Max freq stucks at low freq if reduced by _PPC and sysfs gov access

The problem is reproducable by(if machine is limiting freqs via BIOS):
- Unplugging AC -> max freq gets limited
- echo ${governor} >/sys/.../cpufreq/scaling_governor (policy->user_data.max
gets overridden with policy->max and will never come up again.)

This patch exchanged the cpufreq_set_policy call to __cpufreq_set_policy and
duplicated it's functionality but did not override user_data.max.
The same happens with overridding min/max values. If freqs are limited and
you override the min freq value, the max freq global value will also get
stuck to the limited freq, even if BIOS allows all freqs again.
Last scenario does only happen if BIOS does not reduce the frequency
to the lowest value (should never happen, just for correctness...)

drivers/cpufreq/cpufreq.c | 17 +++++++++++++++--
1 files changed, 15 insertions(+), 2 deletions(-)

Signed-off-by: Thomas Renninger <trenn@suse.de>
Signed-off-by: "Pallipadi, Venkatesh" <venkatesh.pallipadi@intel.com>
Signed-off-by: Dave Jones <davej@redhat.com>

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix de-reference of 'dev_priv' before NULL check.

Signed-off-by: Jayachandran C. <c.jayachandran@gmail.com>
Cc: Dave Airlie <airlied@linux.ie>
Signed-off-by: Andrew Morton <akpm@osdl.org>

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

This is the same method as used in the serial driver.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

madvise_remove needs to respect file and mmap protections.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
[ Will the real CVE-2006-1524 stand up, please.. ]
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

tee was already there for some reason for native 64bit, but
sys_sync_file_range was missing. Also add it to the compat layer.

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

- #if 0 the following unused global function:
- drm_ioremap_nocache()

- make the following needlessly global functions static:
- agp_remap()
- drm_lookup_map()

Signed-off-by: Adrian Bunk <bunk@stusta.de>
Cc: Dave Airlie <airlied@linux.ie>
Signed-off-by: Andrew Morton <akpm@osdl.org>

There is a problem with the TSO packet trimming code. The cause of
this lies in the tcp_fragment() function.

When we allocate a fragment for a completely non-linear packet the
truesize is calculated for a payload length of zero. This means that
truesize could in fact be less than the real payload length.

When that happens the TSO packet trimming can cause truesize to become
negative. This in turn can cause sk_forward_alloc to be -n * PAGE_SIZE
which would trigger the warning.

I've copied the code DaveM used in tso_fragment which should work here.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[IPV4]: ip_route_input panic fix

This prevents crashes on dual core system when enough ticks are lost.

Replaces earlier patch by me.

(Duplicate null data check in powernowk8_get() removed -- davej)

arch/i386/kernel/cpu/cpufreq/powernow-k8.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)

Signed-off-by: Thomas Renninger <trenn@suse.de>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Dave Jones <davej@redhat.com>

Needed for some big Opteron systems to compute a numa hash function
They have more than 12 bits significant address.

TBD switch this over to dynamic allocation or use better hash

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch moves a few large functions from drm_memory.h
to drm_memory.c, with the following effect:

text data bss dec hex filename
46305 1304 20 47629 ba0d new/drm.ko
46367 1304 20 47691 ba4b org/drm.ko
12969 1372 0 14341 3805 new/i810.ko
14712 1372 0 16084 3ed4 org/i810.ko
16447 1364 0 17811 4593 new/i830.ko
18198 1364 0 19562 4c6a org/i830.ko
11875 1324 0 13199 338f new/i915.ko
13025 1324 0 14349 380d org/i915.ko
23936 29288 0 53224 cfe8 new/mga.ko
27280 29288 0 56568 dcf8 org/mga.ko

Please apply.

Signed-off-by: Denis Vlasenko <vda@ilport.com.ua>
Signed-off-by: Dave Airlie <airlied@linux.ie>

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/stable-2.6:
[PATCH] shmat: stop mprotect from giving write permission to a readonly attachment (CVE-2006-1524)
[PATCH] cciss: bug fix for crash when running hpacucli
[PATCH] ext3: Fix missed mutex unlock
[PATCH] Fix block device symlink name
[PATCH] isd200: limit to BLK_DEV_IDE

This fixes http://bugzilla.kernel.org/show_bug.cgi?id=6388
The bug is caused by ip_route_input dereferencing skb->nh.protocol of
the dummy skb passed dow from inet_rtm_getroute (Thanks Thomas for seeing
it). It only happens if the route requested is for a multicast IP
address.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

(Better fix to be applied in next patch)

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Dave Jones <davej@redhat.com>

o Start booting into the capture kernel after an Oops if system is in a
unrecoverable state. System will boot into the capture kernel, if one is
pre-loaded by the user, and capture the kernel core dump.

o One of the following conditions should be true to trigger the booting of
capture kernel.
- panic_on_oops is set.
- pid of current thread is 0
- pid of current thread is 1
- Oops happened inside interrupt context.

Signed-off-by: Vivek Goyal <vgoyal@in.ibm.com>
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Clients can do this in the miniglx setups.

Signed-off-by: Dave Airlie <airlied@linux.ie>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

SYM2 driver uses it.

Signed-off-by: David S. Miller <davem@davemloft.net>

I found that all of 2.4 and 2.6 have been letting mprotect give write
permission to a readonly attachment of shared memory, whether or not IPC
would give the caller that permission.

SUS says "The behaviour of this function [mprotect] is unspecified if the
mapping was not established by a call to mmap", but I don't think we can
interpret that as allowing it to subvert IPC permissions.

I haven't tried 2.2, but the 2.2.26 source looks like it gets it right; and
the patch below reproduces that behaviour - mprotect cannot be used to add
write permission to a shared memory segment attached readonly.

This patch is simple, and I'm sure it's what we should have done in 2.4.0:
if you want to go on to switch write permission on and off with mprotect,
just don't attach the segment readonly in the first place.

However, we could have accumulated apps which attach readonly (even though
they would be permitted to attach read/write), and which subsequently use
mprotect to switch write permission on and off: it's not unreasonable.

I was going to add a second ipcperms check in do_shmat, to check for
writable when readonly, and if not writable find_vma and clear VM_MAYWRITE.
But security_ipc_permission might do auditing, and it seems wrong to
report an attempt for write permission when there has been none. Or we
could flag the vma as SHM, note the shmid or shp in vm_private_data, and
then get mprotect to check.

But the patch below is a lot simpler: I'd rather stick with it, if we can
convince ourselves somehow that it'll be safe.

Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

* master.kernel.org:/home/rmk/linux-2.6-serial:
[SERIAL] Update serial driver documentation

Update LART site URL.

The LART website moved to http://www.lartmaker.nl/. This patch
updates the URL in CpuFreq specific files.

Signed-off-by: Erik Mouw <erik@bitwizard.nl>
Signed-off-by: Dave Jones <davej@redhat.com>

The patch I submitted earlier to fix disabled LAPIC handling in ACPI
was mismerged for some reason I still don't quite understand. Parts
of it was applied to the wrong function.

This patch fixes it up.

Cc: len.brown@intel.com

Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

On alpha:

WARNING: "dma_free_coherent" [drivers/char/drm/drm.ko] undefined!
WARNING: "dma_alloc_coherent" [drivers/char/drm/drm.ko] undefined!

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Dave Airlie <airlied@linux.ie>

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Fix a crash when running hpacucli with multiple logical volumes on a cciss
controller. We were not properly initializing the disk->queue and causing
a fault.

Thanks to Hasso Tepper for reporting the problem. Thanks to Steve Cameron
for root causing the problem. Most of the patch just moves things around.
The fix is a one-liner.

Signed-off-by: Mike Miller <mike.miller@hp.com>
Signed-off-by: Stephen Cameron <steve.cameron@hp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

* master.kernel.org:/home/rmk/linux-2.6-arm:
[ARM] 3477/1: ARM EABI: undefine removed syscalls
[ARM] 3475/1: S3C2410: fix spelling mistake in SMDK partition table
[ARM] 3474/1: S3C2440: USB rate writes wrong var to CLKDIVN

Improve serial driver documentation:
- Remove CVS id.
- Update pointer to reference driver documentation.
- Add comments about new uart_write_console function.
- Add TIOCM_LOOP modem control bit description.
- Add commentry about enable_ms method being called multiple times.
- Add commentry about startup/shutdown method calling.
- Mention that dereferencing port->info after shutdown is invalid.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>