* 'merge' of master.kernel.org:/pub/scm/linux/kernel/git/paulus/powerpc:
  [POWERPC] Make sure __cpu_preinit_ppc970 gets called on 970GX processors
  [POWERPC] Fix CHRP platforms with only 8259
  [POWERPC] IPIC: Fix spinlock recursion in set_irq_handler
  [POWERPC] Fix the UCC rx/tx clock of QE
  [POWERPC] cell: update defconfig
  [POWERPC] spufs: fix another off-by-one bug in spufs_mbox_read
  [POWERPC] spufs: fix signal2 file to report signal2
  [POWERPC] Fix device_is_compatible() const warning
  [POWERPC] Cell timebase bug workaround
  [POWERPC] Support feature fixups in modules
  [POWERPC] Support feature fixups in vdso's
  [POWERPC] Support nested cpu feature sections
  [POWERPC] Consolidate feature fixup code
  [POWERPC] Fix hang in start_ldr if _end or _edata is unaligned
  [POWERPC] Fix spelling errors in ucc_fast.c and ucc_slow.c
  [POWERPC] Don't require execute perms on wrapper when building zImage.initrd
  [POWERPC] Add 970GX cputable entry
  [POWERPC] Fix build breakage with CONFIG_PPC32
  [POWERPC] Fix compiler warning message on get_property call
  [POWERPC] Simplify stolen time calculation

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 3902/1: Enable GPIO81-84 on PXA255
  [ARM] Comment out missing configuration symbols
  [ARM] 3898/1: corgi_bl fix module loading
  [ARM] 3897/1: corgi_bl fix module compiling
  [ARM] Fix breakage in 7281c248

Add check for 970GX for __cpu_preinit_ppc970.
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Paul Mackerras <paulus@samba.org>

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [DCCP]: Update documentation references.
  [ATM] horizon: read_bia() needs to be __devinit
  [NETFILTER]: Fix ip6_tables extension header bypass bug
  [NETFILTER]: Fix ip6_tables protocol bypass bug
  [XFRM]: Fix xfrm_state accounting
  [IPV4] ipconfig: fix RARP ic_servaddr breakage

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

 * when we have stop/sysrq/go, we get pt_regs of whatever executes
   mc_work_proc().  Would be better to see what we had at the time of
   interrupt that got us stop.

 * stop/stop/stop.....  will give stack overflow.  Shouldn't allow stop
   from mconsole_stop().

 * stop/stop/go leaves us inside mconsole_stop() with
	os_set_fd_block(req->originating_fd, 0);
	reactivate_fd(req->originating_fd, MCONSOLE_IRQ);
   just done by nested mconsole_stop().  Ditto.

 * once we'd seen stop, there's a period when INTR commands are executed
   out of order (as they should; we might have the things stuck badly
   enough to never reach mconsole_stop(), but still not badly enough to
   block mconsole_interrupt(); in that situation we _want_ things like
   "cad" to be executed immediately).  Once we enter monsole_stop(), all
   INTR commands will be executed in order, mixed with PROC ones.  We'd
   better let user see that such change of behaviour has happened.
   (Suggested by lennert).

 * stack footprint of monsole_interrupt() is an atrocity; AFAICS we can
   safely make struct mc_request req; static in function there.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Keith Packard <keithp@neko.keithp.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

On CHRP platforms with only a 8259 controller, we should set the
default IRQ host to the 8259 driver's one for the IRQ probing
fallbacks to work in case the IRQ tree is incorrect (like on
Pegasos for example). Without this fix, we get a bunch of WARN_ON's
during boot.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

This causes ipic_set_irq_type to set the handler directly rather
than call set_irq_handler, which causes spinlock recursion because
the lock is already held when ipic_set_irq_type is called.

I'm also not convinced that ipic_set_irq_type should be changing the
handler at all.  There seem to be several controllers that don't and
several that do.  Those that do would break what appears to be a common
usage of calling set_irq_chip_and_handler followed by set_irq_type, if a
non-standard handler were to be used.  OTOH, irq_create_of_mapping()
doesn't set the handler, but only calls set_irq_type().

This patch gets things working in the spinlock-debugging-enabled case,
but I'm curious as to where the handler setting is ideally supposed to be
done.  I don't see any documentation on set_irq_type() that clarifies
what the semantics are supposed to be.
Signed-off-by: Scott Wood <scottwood@freescale.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

MPC8323EMDS board ethernet interface with RMII uses the CLK16 divisor
for the rx and tx clock, but the ucc_set_qe_mux_rxtx() function doesn't
handle the CLK16 setting of the CMXUCR3 and CMXUCR4 registers.  This
fixes it.
Signed-off-by: Dave Liu <daveliu@freescale.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

===================================================================
Signed-off-by: Paul Mackerras <paulus@samba.org>

Currently, spufs_mbox_read transfers more bytes than requested on a
read.  If you ask for four bytes, you get eight.  This fixes it to
transfer the largest multiple of four bytes that is less than or equal
to the number you asked for.

Note: one nasty property of this file in spufs is that you can only
read multiples of four bytes in the first place, since there is no way
to atomically put back a few bytes into the hardware register.  Thus,
reading less than four bytes returns -EINVAL.  Asking for more than
four returns the largest possible multiple of four.
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

This fixes the /signal2 file to actually give signal2 data.
Signed-off-by: Dwayne Grant Mcconnell <decimal@us.ibm.com>
Signed-off-by: Arnd Bergmann <arnd.bergmann@de.ibm.com>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Fix a const'ification related warning with device_is_compatible()
and friends related to get_property() not properly having const
on it's input device node argument.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

The Cell CPU timebase has an erratum. When reading the entire 64 bits
of the timebase with one mftb instruction, there is a handful of cycles
window during which one might read a value with the low order 32 bits
already reset to 0x00000000 but the high order bits not yet incremeted
by one. This fixes it by reading the timebase again until the low order
32 bits is no longer 0. That might introduce occasional latencies if
hitting mftb just at the wrong time, but no more than 70ns on a cell
blade, and that was considered acceptable.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Paul Mackerras <paulus@samba.org>

This patch adds support for feature fixups in modules. This involves
adding support for R_PPC64_REL64 relocs to the 64 bits module loader.
It also modifies modpost.c to ignore the powerpc fixup sections (or it
would warn when used in .init.text).
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Paul Mackerras <paulus@samba.org>

This patch reworks the feature fixup mecanism so vdso's can be fixed up.
The main issue was that the construct:

        .long   label  (or .llong on 64 bits)

will not work in the case of a shared library like the vdso. It will
generate an empty placeholder in the fixup table along with a reloc,
which is not something we can deal with in the vdso.

The idea here (thanks Alan Modra !) is to instead use something like:

1:
        .long   label - 1b

That is, the feature fixup tables no longer contain addresses of bits of
code to patch, but offsets of such code from the fixup table entry
itself. That is properly resolved by ld when building the .so's. I've
modified the fixup mecanism generically to use that method for the rest
of the kernel as well.

Another trick is that the 32 bits vDSO included in the 64 bits kernel
need to have a table in the 64 bits format. However, gas does not
support 32 bits code with a statement of the form:

        .llong  label - 1b  (Or even just .llong label)

That is, it cannot emit the right fixup/relocation for the linker to use
to assign a 32 bits address to an .llong field. Thus, in the specific
case of the 32 bits vdso built as part of the 64 bits kernel, we are
using a modified macro that generates:

        .long   0xffffffff
        .llong  label - 1b

Note that is assumes that the value is negative which is enforced by
the .lds (those offsets are always negative as the .text is always
before the fixup table and gas doesn't support emiting the reloc the
other way around).
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Paul Mackerras <paulus@samba.org>

This patch adds some macros that can be used with an explicit label in
order to nest cpu features. This should be used very careful but is
necessary for the upcoming cell TB fixup.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Paul Mackerras <paulus@samba.org>

There are currently two versions of the functions for applying the
feature fixups, one for CPU features and one for firmware features. In
addition, they are both in assembly and with separate implementations
for 32 and 64 bits. identify_cpu() is also implemented in assembly and
separately for 32 and 64 bits.

This patch replaces them with a pair of C functions. The call sites are
slightly moved on ppc64 as well to be called from C instead of from
assembly, though it's a very small change, and thus shouldn't cause any
problem.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Quick fix for lack of memset(__bss_start, 0, _end-__bss_start) in
load_kernel().  If edata is unaligned, the loop will overwrite all
memory because r3 and r4 will never be equal.
Signed-off-by: Olaf Hering <olaf@aepfle.de>
Signed-off-by: Paul Mackerras <paulus@samba.org>

Updates the references to spec documents throughout the code, taking into
account that

* the DCCP, CCID 2, and CCID 3 drafts all became RFCs in March this year

* RFC 1063 was obsoleted by RFC 1191

* draft-ietf-tcpimpl-pmtud-0x.txt was published as an Informational
  RFC, RFC 2923 on 2000-09-22.

All references verified.
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Thanks to Randy Dunlap.
Signed-off-by: David S. Miller <davem@davemloft.net>

As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible
to a fragmentation attack causing false negatives on extension header matches.

When extension headers occur in the non-first fragment after the fragment
header (possibly with an incorrect nexthdr value in the fragment header)
a rule looking for this extension header will never match.

Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.
Since all extension headers are before the protocol header this makes sure
an extension header is either not present or in the first fragment, where
we can properly parse it.

With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

As reported by Mark Dowd <Mark_Dowd@McAfee.com>, ip6_tables is susceptible
to a fragmentation attack causing false negatives on protocol matches.

When the protocol header doesn't follow the fragment header immediately,
the fragment header contains the protocol number of the next extension
header. When the extension header and the protocol header are sent in
a second fragment a rule like "ip6tables .. -p udp -j DROP" will never
match.

Drop fragments that are at offset 0 and don't contain the final protocol
header regardless of the ruleset, since this should not happen normally.

With help from Yasuyuki KOZAKAI <yasuyuki.kozakai@toshiba.co.jp>.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

xfrm_state_num needs to be increased for XFRM_STATE_ACQ states created
by xfrm_state_find() to prevent the counter from going negative when
the state is destroyed.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

memcpy 4 bytes to address of auto unsigned long variable followed
by comparison with u32 is a bloody bad idea.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>

The PXA255 has 84 GPIO lines available.  This patch allows access to 81-84
Signed-off-by: Craig Hughes <craig@gumstix.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

HAS_TOUCHSCREEN_ADS7843_LH7 and HAS_TOUCHSCREEN_ADC_LH7 are referenced
but not defined in the LH7A40x configuration.  Comment them out to
prevent them causing warnings.

Marc Singer said:

   Feel free to remove the Kconfig lines.  I'll add it back with
   the rest of the config entries.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Fix module loading:
corgi_bl: module license 'GPLv2' taints kernel.
corgi_bl: Unknown symbol platform_driver_unregister
corgi_bl: Unknown symbol __symbol_get
corgi_bl: Unknown symbol platform_driver_register

Cc: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: pHilipp Zabel <philipp.zabel@gmail.com>
Signed-off-by: Anton Vorontsov <cbou@mail.ru>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Fix module compiling:
WARNING: drivers/video/backlight/corgi_bl.o - Section mismatch:
reference to .init.text: from .data between '$d' (at offset 0x0) and
'bl_mutex'

Cc: Richard Purdie <rpurdie@rpsys.net>
Signed-off-by: Anton Vorontsov <cbou@mail.ru>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

A couple of missing semicolons.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog: (33 commits)
  [WATCHDOG] remove experimental on iTCO_wdt.c
  [WATCHDOG] Atmel AT91RM9200 rename.
  [WATCHDOG] includes for sample watchdog program.
  [WATCHDOG] watchdog/iTCO_wdt: fix bug related to gcc uninit warning
  [WATCHDOG] add ich8 support to iTCO_wdt.c (patch 2)
  [WATCHDOG] add ich8 support to iTCO_wdt.c
  [WATCHDOG] ioremap balanced with iounmap for drivers/char/watchdog/s3c2410_wdt.c
  [WATCHDOG] w83697hf/hg WDT driver - Kconfig patch
  [WATCHDOG] w83697hf/hg WDT driver - autodetect patch
  [WATCHDOG] w83697hf/hg WDT driver - patch 16
  [WATCHDOG] w83697hf/hg WDT driver - patch 15
  [WATCHDOG] w83697hf/hg WDT driver - patch 14
  [WATCHDOG] w83697hf/hg WDT driver - patch 13
  [WATCHDOG] w83697hf/hg WDT driver - patch 12
  [WATCHDOG] w83697hf/hg WDT driver - patch 11
  [WATCHDOG] w83697hf/hg WDT driver - patch 10
  [WATCHDOG] w83697hf/hg WDT driver - patch 9
  [WATCHDOG] w83697hf/hg WDT driver - patch 8
  [WATCHDOG] w83697hf/hg WDT driver - patch 7
  [WATCHDOG] w83697hf/hg WDT driver - patch 6
  ...

In commit 4e8a5201 ("[PKT_SCHED] netem:
Orphan SKB when adding to queue.") Davem mistakenly also included a
temporary diff in his tree that disabled the pci_fixup_video VGA quirk,
which broke sparc64.

This reverts that part of the commit. Sayeth Davem:

  "Greg KH has a patch coming to you soon which will move that VGA code
   back into x86/x86_64/IA64 specific areas and will fix the sparc64
   problem properly."

Special thanks to Claudio Martins <ctpm@ist.utl.pt> for noticing the
error in the first place.

Cc: Claudio Martins <ctpm@ist.utl.pt>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Eliminate more __must_check madness.

The return code from device_for_each_child() depends on the values
which the helper function returns.  If the helper function always
returns zero, it's utterly pointless to check the return code from
device_for_each_child().

The only code which knows if the return value should be checked is
the caller itself, so forcing the return code to always be checked
is silly.  Hence, remove the __must_check annotation.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

* 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/perex/alsa:
  [ALSA] hda-intel - Add check of MSI availabity
  [ALSA] version 1.0.13
  [ALSA] Fix addition of user-defined boolean controls
  [ALSA] Fix AC97 power-saving mode
  [ALSA] Fix re-use of va_list
  [ALSA] hda_intel: add ATI RS690 HDMI audio support
  [ALSA] hda-codec - Add model entry for ASUS U5F laptop
  [ALSA] Fix dependency of snd-adlib driver in Kconfig
  [ALSA] Various fixes for suspend/resume of ALSA PCI drivers
  [ALSA] hda-codec - Fix assignment of PCM devices for Realtek codecs
  [ALSA] sound/isa/opti9xx/opti92x-ad1848.c: check kmalloc() return value
  [ALSA] sound/isa/ad1816a/ad1816a.c: check kmalloc() return value
  [ALSA] sound/isa/cmi8330.c: check kmalloc() return value
  [ALSA] sound/isa/gus/interwave.c: check kmalloc() return value

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6:
  JFS: pageno needs to be long

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [PKT_SCHED] netem: Orphan SKB when adding to queue.
  [NET]: kernel-doc fix for sock.h
  [NET]: Reduce sizeof(struct flowi) by 20 bytes.
  [IPv6] fib: initialize tb6_lock in common place to give lockdep a key
  [ATM] nicstar: Fix a bogus casting warning
  [ATM] firestream: handle thrown error
  [ATM]: No need to return void
  [ATM]: handle sysfs errors
  [DCCP] ipv6: Fix opt_skb leak.
  [DCCP]: Fix Oops in DCCPv6