into nuts.davemloft.net:/disk1/BK/net-2.6

From: Colin Leroy <colin@colino.net>

rmmod'ing pmac_zilog currently oopses because uart_unregister_driver(),
which nullifies drv->tty_driver, is called before uart_remove_one_port(),
which uses said drv->tty_driver.

The comment at top of uart_unregister_driver() specifically says we have
to have removed all our ports via uart_remove_one_port() before.

From: Frank A. Uepping

   This fixes capiminor_alloc() to assign the lowest free minor for a
   new capi_tty. Thanks to Frank A. Uepping and Tim Woods.

The syscall return path on ppc64 checks if the error is between
-LAST_ERRNO and 0, if it is, does the usual inversion along with
setting a CR bit indicating to glibc that an error occured.

However, we had an interesting bug where we used a 32 bits logica
(unsigned) comparison, thus possibly doing false positives for
valid 64 bits unsigned values whose low 32 bits happen to be in
the error range.

Fix that.

Just as there is documentation for BINFMT_MISC and Java bytecodes
support, I thought it could be interesting to add documentation on how
to add BINFMT_MISC support for directly running .NET ".exe" binaries
using the Mono CLR.

This patch fixes more cases of possible preempt issue when testing
MSR for FP or VEC bits and then doing giveup_fpu or giveup_altivec
that I missed in my previous round of fixes (bk get helps before
grepping ;)

I also change the single step and program check exceptions to not
re-enable interrupts right away on C code entry, it was useless and
would cause interesting issues with preempt & xmon

A few asm/types.h test a config variable without including
<linux/config.h> first, which can e.g. cause different sector_t
definitions. HFS fell victim to that and broke on ppc with CONFIG_LBD
enabled. I scanned all asm/types.h and added <linux/config.h> as
necessary.

 - make sure cd->buffer is always inside a page - previously if an
   entry fit perfectly in the remainder of a page, cd->buffer would
   end up pointing past the end of that page.

 - make sure num_entry_words is always correct, even on the error
   path.

This increases the DART table to use the full size.  We allocate a full
16MB page anyway, so there's no difference in memory consumption. 

Thanks to Ben for spotting this, it was left over from debugging...

This fixes a bug in the iommu allocator that causes it to behave
strangely when a fair size of the table is allocated. 

Thanks to Andrew Gallatin for finding this.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

This patch from Alan Stern <stern@rowland.harvard.edu> fixes a bug in
the current USB code that causes khubd to hang when a device is removed
from the system, thereby preventing any future USB device changes (like
adding or removing other devices) from happening.

Both Andrew and I can easily duplicate this bug against the current -bk
tree. 

It's not a perfect fix, but it works for now, and I will spend the next
week working on restructuring the code so this is handled properly.

Put the extension header helper funcs always statically into
the kernel even if ipv6 is built as a module, this is needed
for things like SELinux.

It has been dead since kernel 2.5.18.

TiVo IDE support was never merged only this option was (in 2.4.0-test2), sigh.

filldir and getdents should check return values of put_user etc. The
generic code has been fixed but the ppc64 compat versions have not.

This replaces six duplicated implementations of various quality of
sys32_mount with a shiny new compat_sys_mount().

It's been tested on parisc64 and sparc64 and fixes a bug exposed by the
latest revision of Debian's initscripts.  Thanks to Arnd Bergmann and
Dave Miller for their suggestions, fixes and testing.  Please apply.

From: Bjorn Helgaas <bjorn.helgaas@hp.com>

Remove include of <asm/setup.h> from cmdlinepart.c.  This is not be needed
for i386 (it builds fine with this patch), and ia64 doesn't supply a
setup.h.

asm/setup.h contains a hodge-podge of stuff with no real
consistency between architectures.  It appears to be
included mainly by arch-specific drivers:
	acsi (Atari disks)
	amiflop (Amiga floppy)
	z2ram (ZorroII ram disk)
	amiserial (Amiga serial)
	...
and under arch-specific #ifdefs:
	fbcon (under __mc68000__ or CONFIG_APUS)
	fonts (ditto)
	logo (CONFIG_M68K)
	...

From: Bjorn Helgaas <bjorn.helgaas@hp.com>

The problem is that we don't clear out the efi_time_t buffer before asking
EFI to fill it in.  EFI doesn't always write the entire buffer (in
particular, the alarm time only supports one second resolution, so the
nanosecond field is often untouched).

The effect is that 'cat /proc/driver/efirtc' shows garbage in the
nanoseconds part of the alarm time, and sometimes artifacts like bogus
alarm date and junk after the actual end of the text.

From: James Morris <jmorris@redhat.com>

This patch fixes a bug where the return value for a permission call is not 
checked.

The bug was introduced when I added some code in the following changeset:

<http://linux.bkbits.net:8080/linux-2.5/diffs/security/selinux/hooks.c@1.19?nav=index.html|src/|src/security|src/security/selinux|hist/security/selinux/hooks.c>

Code was added after this line:

	err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, NULL, &ad);

without adding an explicit check of 'err', which was previously returned
from the function rather than being checked.  i.e. it would drop through
to:

	out:	
 		return err;

 	}

With the new code added, err can (and typically would) be overwritten with 
a successful value, causing the permission check to not deny permission if 
needed.  The intended denial would have been logged.

The patch below fixes this problem.

From: john stultz <johnstul@us.ibm.com>

This patch ensures that cpu_khz is adjusted on cpufreq notifications even
when the tsc timesource is not in use.  It fixes the mostly cosmetic issue
when using the ACPI PM timesource of /proc/cpuinfo not being properly
updated when cpu frequency was lowered.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

System call speedup part 2.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

The purpose of this is to speed up system calls on s390.  I managed to
squeeze about 65 cycles from each system call.  This improved e.g.  getpid()
from 232 to 157 cycles.  As a nice side-effect it simplified the uaccess
functions considerably.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

s390 tape driver changes:
 - Prevent offline while device is in use.
 - Do not use bus_id string in debug feature messages.
 - Check for IS_ERR(irb) error conditions in interrupt handler.
 - Fix removing tape discipline modules.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

s390 network driver changes:
 - ctc/lcs/qeth: prevent a ccw-device to be grouped multiple times.
 - icuv: clear correct field in iucv_register_program if no userid is specified.
 - lcs: fix online/offline cycle again.
 - lcs: fix ungrouping of lcs group device. The channels of the lcs card
   should be offline afterwards.
 - lcs: don't do netif_stop_queue if no tx buffer is available, just
   return -EBUSY and drop the packets.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

z/VM monitor stream changes:
 - Correct sysctl vs. module ref-counting.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

dasd device driver changes:
 - After a state change interrupt restart all running i/o on queue
   and reset device timer.
 - Improve some debug messages.
 - Lower timeout of reserve/release/steal_lock to 2 seconds.
 - Fix BIODASDPSRD ioctl.
 - Replace ro_flag, use_diag_flag and disconnect_error_flag words by bits.
 - Use BLKPG_DEL_PARTITION ioctl instead of a call to delete_partition because
   delete_partition is not an exported function. Since dasd_destroy_partitions
   can't do blkdev_get because dasd_open would fail, keep the block device
   open as long as partitions exist. This in turn requires a different
   approach to the open vs. offline race.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

s390 core changes:
 - Fix return type of some system call functions (long vs. int).
 - Fix prototypes for compat system call handlers.
 - Correct some bugs in the compat system call wrappers.
 - Fix broken pointer arithmetic which causes problems with
   gcc 3.4 and -march=z990
 - Remove unnecessary #ifndef & optimize inline assemblies in spinlock.h.
 - Improve handling of deferred condition code 1.
 - New default configuration.

From: badari <pbadari@us.ibm.com>

I ran into an ipc hang while trying to shutdown a database.  The problem is
due to missing sem_unlock() in find_undo().

copy_from_user() returns non-zero on faults..

This fixes a problem where cy_wait_until_sent() miscalculates (calculate
-1 on a unsigned long) the "char_time" parameter passed to
schedule_timeout().

Fix that by making it a signed long, and checking for negative value.