While Linux doesn't honor setuid on scripts.  However, it mistakenly
behaves differently for file capabilities.

This patch fixes that behavior by making sure that get_file_caps()
begins with empty bprm->caps_*.  That way when a script is loaded,
its bprm->caps_* may be filled when binfmt_misc calls prepare_binprm(),
but they will be cleared again when binfmt_elf calls prepare_binprm()
next to read the interpreter's file capabilities.
Signed-off-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: David Howells <dhowells@redhat.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-2.6.28' of git://linux-nfs.org/~bfields/linux:
  NLM: Set address family before calling nlm_host_rebooted()
  nfsd: fix failure to set eof in readdir in some situations

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: (23 commits)
  Revert "powerpc: Sync RPA note in zImage with kernel's RPA note"
  powerpc: Fix compile errors with CONFIG_BUG=n
  powerpc: Fix format string warning in arch/powerpc/boot/main.c
  powerpc: Fix bug in kernel copy of libfdt's fdt_subnode_offset_namelen()
  powerpc: Remove duplicate DMA entry from mpc8313erdb device tree
  powerpc/cell/OProfile: Fix on-stack array size in activate spu profiling function
  powerpc/mpic: Fix regression caused by change of default IRQ affinity
  powerpc: Update remaining dma_mapping_ops to use map/unmap_page
  powerpc/pci: Fix unmapping of IO space on 64-bit
  powerpc/pci: Properly allocate bus resources for hotplug PHBs
  OF-device: Don't overwrite numa_node in device registration
  powerpc: Fix swapcontext system for VSX + old ucontext size
  powerpc: Fix compiler warning for the relocatable kernel
  powerpc: Work around ld bug in older binutils
  powerpc/ppc64/kdump: Better flag for running relocatable
  powerpc: Use is_kdump_kernel()
  powerpc: Kexec exit should not use magic numbers
  powerpc/44x: Update 44x defconfigs
  powerpc/40x: Update 40x defconfigs
  powerpc: enable heap randomization for linkstations
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: (21 commits)
  sh: fix sh2a cache entry_mask
  sh: Enable NFS root in Migo-R defconfig.
  sh: FTRACE renamed to FUNCTION_TRACER.
  sh: Fix up the shared IRQ demuxer's control bit testing logic.
  Define SCSPTR1 for SH 7751R
  sh: Add sci_rxd_in of SH4-202
  Add support usb setting on sh 7366
  sh: Change register name SCSPTR to SCSPTR2
  sh: use the new byteorder headers.
  sh: SHmedia ISA tuning fixups.
  sh: Kill off long-dead HD64465 cchip support.
  sh: Revert "SH 7366 needs SCIF_ONLY"
  sh: Simplify and lock down the ISA tuning.
  sh: sh7785lcr: Select uImage as default image target.
  sh: Add on-chip RTC support for SH7722.
  SH 7366 needs SCIF_ONLY
  gdrom: Fix compile error
  sh: Provide a sample defconfig for the UL2 (SH7366) board.
  sh: Fix FPU tuning on toolchains with mismatched multilib targets.
  sh: oprofile: Fix up the SH7750 performance counter name.
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
  sparc64: Add missing null terminating entry to bq4802_match[].
  sparc: use the new byteorder headers
  rtc-m48t59: shift zero year to 1968 on sparc (rev 2)
  dbri: check dma_alloc_coherent errors
  sparc64: remove byteshifting from out* helpers

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  delay capable() check in ext4_has_free_blocks()
  merge ext4_claim_free_blocks & ext4_has_free_blocks
  jbd2: Call the commit callback before the transaction could get dropped
  ext4: fix a bug accessing freed memory in ext4_abort
  ext3: fix a bug accessing freed memory in ext3_abort

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  libata: add whitelist for devices with known good pata-sata bridges
  sata_via: fix support for 5287
  libata: Avoid overflow in ata_tf_to_lba48() when tf->hba_lbal > 127
  ATA: remove excess kernel-doc notation

This reverts commit 91a00302, plus
commit 0dcd4401 ("powerpc: Revert CHRP
boot wrapper to real-base = 12MB on 32-bit") which depended on it.

Commit 91a00302 was causing NVRAM corruption on some pSeries machines,
for as-yet unknown reasons, so this reverts it until the cause is
identified.
Signed-off-by: Paul Mackerras <paulus@samba.org>

This makes sure we don't try to call find_bug or is_warning_bug when
CONFIG_BUG=n and CONFIG_XMON=y.  Otherwise we get these errors:

arch/powerpc/xmon/xmon.c: In function ‘print_bug_trap’:
arch/powerpc/xmon/xmon.c:1364: error: implicit declaration of function ‘find_bug’
arch/powerpc/xmon/xmon.c:1364: warning: assignment makes pointer from integer without a cast
arch/powerpc/xmon/xmon.c:1367: error: implicit declaration of function ‘is_warning_bug’
arch/powerpc/xmon/xmon.c:1374: error: dereferencing pointer to incomplete type
make[2]: *** [arch/powerpc/xmon/xmon.o] Error 1
make[1]: *** [arch/powerpc/xmon] Error 2
make: *** [sub-make] Error 2
Signed-off-by: Paul Mackerras <paulus@samba.org>

Fix format string warning in arch/powerpc/boot/main.c.  Also correct
a typo ("uncomressed") on the same line.

 BOOTCC  arch/powerpc/boot/main.o
arch/powerpc/boot/main.c: In function 'prep_kernel':
arch/powerpc/boot/main.c:65: warning: format '%08x' expects type
'unsigned int', but argument 3 has type 'long unsigned int'
Signed-off-by: Jon Smirl <jonsmirl@gmail.com>
Acked-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>

There's currently an off-by-one bug in fdt_subnode_offset_namelen()
which causes it to keep searching after it's finished the subnodes of
the given parent, and into the subnodes of siblings of the original
node which come after it in the tree.  This bug was introduced in
commit ed95d745 ("powerpc: Update
in-kernel dtc and libfdt to version 1.2.0").

A patch has already been submitted to dtc/libfdt mainline.  We don't
really want to pull in a new upstream version during the 2.6.28 cycle,
but we should still fix this bug, hence this standalone version of the
fix for the in-kernel libfdt.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Commit 57436612 added a duplicate
DMA controller node.
Signed-off-by: Mike Dyer <mike.dyer@provision-comm.com>
Signed-off-by: Kumar Gala <galak@kernel.crashing.org>

fix sh2a cache entry_mask in __flush_{purge,invalidate}_region.
Signed-off-by: Yoshihiro Shimoda <shimoda.yoshihiro@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

Signed-off-by: Kuninori Morimoto <morimoto.kuninori@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

Signed-off-by: Paul Mundt <lethal@linux-sh.org>

Correct the interrupt handler in sh4 serial device, return the correct
value and check for what is anabled in the SCSCR register. The sh7722 is
broken just sending a break using minicom.
Signed-off-by: Michael Trimarchi <trimarchimichael@yahoo.it>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

After the recent commit to kill off SCI/SCIF special casing SH 7751R
fails to compile with CONFIG_SH_RTS7751R2D set. This is because SCSPTR1
is undefined. Take the value for SCSPTR1 from the SH7751R Group Hardware
Manual.
Signed-off-by: Matt Fleming <mjf@gentoo.org>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

SH4-202 doesn't have SCSXX1. But it is treated so that there is SCSPTR1 in
current code. This patch add sci_rxd_in of SH4-202.
Signed-off-by: Nobuhiro Iwamatsu <iwamatsu.nobuhiro@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

This patch add usb setting for sh 7366
Signed-off-by: Kuninori Morimoto <morimoto.kuninori@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

This change a name of SCSPTR used in sci_rxd_in of SH5-101.
SCSPTR is not declared and will become the error.
Signed-off-by: Nobuhiro Iwamatsu <iwamatsu.nobuhiro@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

SH-5 doesn't support any elaborate ISA inheritance schemes (-dsp, -up,
etc.), so only bother with that if we are building an sh32 kernel.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

Signed-off-by: David S. Miller <davem@davemloft.net>

libata currently imposes a UDMA5 max transfer rate and 200 sector max
transfer size for SATA devices that sit behind a pata-sata bridge. Lots
of devices have known good bridges that don't need this limit applied.
The MTRON SSD disks are such devices. Transfer rates are increased by
20-30% with the restriction removed.

So add a "blacklist" entry for the MTRON devices, with a flag indicating
that the bridge is known good.
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

5287 used to be treated as vt6420 but it didn't work.  It's new family
of controllers called vt8251 which hosts four SATA ports as M/S of the
two ATA ports.  This configuration is rather peculiar in that although
the M/S devices are on the same port, each have its own SCR (or
equivalent link status/control) registers which screws up the
port-link-device hierarchy assumed by libata.  Another controller
which falls into this category is ata_piix w/ SIDPR access.

libata now has facility to deal with this class of controllers named
slave_link.  A low level driver for such controllers can just call
ata_slave_link_init() on the respective ports and libata will handle
all the difficult parts like following up with single SRST after
hardresetting both ports.

This patch creates new controller class vt8251, implements slave_link
aware init sequence and config space based SCR access for it and moves
5287 to the new class.

This patch is based on Joseph Chan's larger patch which was created
before slave_link was implemented in libata.

  http://thread.gmane.org/gmane.linux.kernel.commits.mm/40640Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Joseph Chan <JosephChan@via.com.tw>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

In ata_tf_to_lba48(), when evaluating

	(tf->hob_lbal & 0xff) << 24

the expression is promoted to signed int (since int can hold all values
of u8).  However, if hob_lbal is 128 or more, then it is treated as a
negative signed value and sign-extended when promoted to u64 to | into
sectors, which leads to the MSB 32 bits of section getting set
incorrectly.

For example, Phillip O'Donnell <phillip.odonnell@gmail.com> reported
that a 1.5GB drive caused:

    ata3.00: HPA detected: current 2930277168, native 18446744072344861488

where 2930277168 == 0xAEA87B30 and 18446744072344861488 == 0xffffffffaea87b30
which shows the problem when hob_lbal is 0xae.

Fix this by adding a cast to u64, just as is used by for hob_lbah and
hob_lbam in the function.
Reported-by: Phillip O'Donnell <phillip.odonnell@gmail.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

Remove excess kernel-doc function parameter notation from drivers/ata/:

Warning(drivers/ata/libata-core.c:1622): Excess function parameter or struct member 'fn' description in 'ata_pio_queue_task'
Warning(drivers/ata/libata-core.c:4655): Excess function parameter or struct member 'err_mask' description in 'ata_qc_complete'
Warning(drivers/ata/ata_piix.c:751): Excess function parameter or struct member 'udma' description in 'do_pata_set_dmamode'
Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

The size of the pm_signal_local array should be equal to the
number of SPUs being configured in the array.  Currently, the
array is of size 4 (NR_PHYS_CTRS) but being indexed by a for
loop from 0 to 7 (NUM_SPUS_PER_NODE).  This could potentially
cause an oops or random memory corruption since the pm_signal_local
array is on the stack.  This fixes it.
Signed-off-by: Carl Love <carll@us.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

The Freescale implementation of MPIC only allows a single CPU destination
for non-IPI interrupts.  We add a flag to the mpic_init to distinquish
these variants of MPIC.  We pull in the irq_choose_cpu from sparc64 to
select a single CPU as the destination of the interrupt.

This is to deal with the fact that the default smp affinity was
changed by commit 18404756 ("genirq:
Expose default irq affinity mask (take 3)") to be all CPUs.
Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

After the merge of the 32 and 64bit DMA code, dma_direct_ops lost
their map/unmap_single() functions but gained map/unmap_page().  This
caused a problem for Cell because Cell's dma_iommu_fixed_ops called
the dma_direct_ops if the fixed linear mapping was to be used or the
iommu ops if the dynamic window was to be used.  So in order to fix
this problem we need to update the 64bit DMA code to use
map/unmap_page.

First, we update the generic IOMMU code so that iommu_map_single()
becomes iommu_map_page() and iommu_unmap_single() becomes
iommu_unmap_page().  Then we propagate these changes up through all
the callers of these two functions and in the process update all the
dma_mapping_ops so that they have map/unmap_page rahter than
map/unmap_single.  We can do this because on 64bit there is no HIGHMEM
memory so map/unmap_page ends up performing exactly the same function
as map/unmap_single, just taking different arguments.

This has no affect on drivers because the dma_map_single_attrs() just
ends up calling the map_page() function of the appropriate
dma_mapping_ops and similarly the dma_unmap_single_attrs() calls
unmap_page().

This fixes an oops on Cell blades, which oops on boot without this
because they call dma_direct_ops.map_single, which is NULL.
Signed-off-by: Mark Nelson <markn@au1.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

A typo/thinko made us pass the wrong argument to __flush_hash_table_range
when unplugging bridges, thus not flushing all the translations for
the IO space on unplug.  The third parameter to __flush_hash_table_range
is `end', not `size'.

This causes the hypervisor to refuse unplugging slots.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Resources for PHB's that are dynamically added to a system are not
properly allocated in the resource tree.

Not having these resources allocated causes an oops when removing
the PHB when we try to release them.

The diff appears a bit messy, this is mainly due to moving everything
one tab to the left in the pcibios_allocate_bus_resources routine.
The functionality change in this routine is only that the
list_for_each_entry() loop is pulled out and moved to the necessary
calling routine.
Signed-off-by: Nathan Fontenot <nfont@austin.ibm.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Currently, the numa_node of OF-devices will be overwritten during
device_register, which simply sets the node to -1.  On cell machines,
this means that devices can't find their IOMMU, which is referenced
through the device's numa node.

Set the numa node for OF devices with no parent, and use the
lower-level device_initialize and device_add functions, so that the
node is preserved.

We can remove the call to set_dev_node in of_device_alloc, as it
will be overwritten during register.
Signed-off-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Since VSX support was added, we now have two sizes of ucontext_t;
the older, smaller size without the extra VSX state, and the new
larger size with the extra VSX state.  A program using the
sys_swapcontext system call and supplying smaller ucontext_t
structures will currently get an EINVAL error if the task has
used VSX (e.g. because of calling library code that uses VSX) and
the old_ctx argument is non-NULL (i.e. the program is asking for
its current context to be saved).  Thus the program will start
getting EINVAL errors on calls that previously worked.

This commit changes this behaviour so that we don't send an EINVAL in
this case.  It will now return the smaller context but the VSX MSR bit
will always be cleared to indicate that the ucontext_t doesn't include
the extra VSX state, even if the task has executed VSX instructions.

Both 32 and 64 bit cases are updated.

[paulus@samba.org - also fix some access_ok() and get_user() calls]

Thanks to Ben Herrenschmidt for noticing this problem.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Fixes this warning:
 arch/powerpc/kernel/setup_64.c:447:5: warning: "kernstart_addr" is not defined

which arises because PHYSICAL_START is no longer a constant when
CONFIG_RELOCATABLE=y.
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Commit 549e8152 ("powerpc: Make the
64-bit kernel as a position-independent executable") added lines to
vmlinux.lds.S to add the extra sections needed to implement a
relocatable kernel.  However, those lines seem to trigger a bug in
older versions of GNU ld (such as 2.16.1) when building a
non-relocatable kernel.  Since ld 2.16.1 is still a popular choice for
cross-toolchains, this adds an #ifdef to vmlinux.lds.S so the added
lines are only included when building a relocatable kernel.
Signed-off-by: Paul Mackerras <paulus@samba.org>

The __kdump_flag ABI is overly constraining for future development.

As of 2.6.27, the kernel entry point has 4 constraints:  Offset 0 is
the starting point for the master (boot) cpu (entered with r3 pointing
to the device tree structure), offset 0x60 is code for the slave cpus
(entered with r3 set to their device tree physical id), offset 0x20 is
used by the iseries hypervisor, and secondary cpus must be well behaved
when the first 256 bytes are copied to address 0.

Placing the __kdump_flag at 0x18 is bad because:

- It was taking the last 8 bytes before the iseries hypervisor data.
- It was 8 bytes for a boolean flag
- It had no way of identifying that the flag was present
- It does leave any room for the master to add any additional code
  before branching, which hurts debug.
- It will be unnecessarily hard for 32 bit code to be common (8 bytes)

Now that we have eliminated the use of __kdump_flag in favor of
the standard is_kdump_kernel(), this flag only controls run without
relocating the kernel to PHYSICAL_START (0), so rename it __run_at_load.

Move the flag to 0x5c, 1 word before the secondary cpu entry point at
0x60.  Initialize it with "run0" to say it will run at 0 unless it is
set to 1.  It only exists if we are relocatable.
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

linux/crash_dump.h defines is_kdump_kernel() to be used by code that
needs to know if the previous kernel crashed instead of a (clean) boot
or reboot.

This updates the just added powerpc code to use it.  This is needed
for the next commit, which will remove __kdump_flag.
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>