[IB] uverbs: Close some exploitable races

Al Viro pointed out that the current IB userspace verbs interface
allows userspace to cause mischief by closing file descriptors before
we're ready, or issuing the same command twice at the same time.  This
patch closes those races, and fixes other obvious problems such as a
module reference leak.

Some other interface bogosities will require an ABI change to fix
properly, so I'm deferring those fixes until 2.6.15.

Signed-off-by: Roland Dreier <rolandd@cisco.com>

[IB] mthca: Fix off by one bug in mthca_map_cmd

The loop in mthca_map_cmd() would fill one entry past the end of the
mailbox buffer before calling the firmware command.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

[IB] mthca: fix off by one in clr_int calculation

We should use the first word of the clear interrupt register if
the bit we're after is < 32, not < 31.

Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

[IB] mthca: Fix doorbell record resource leak

If we allocate a bunch of doorbell records and then free them, we'll
end up with completely empty pages, which we then free.  However, when
we come back to allocate more doorbell pages, we have to reallocate
those empty pages rather than always trying to take a slot that we've
never used.  If we don't, we eventually use up every slot and fail to
allocate a doorbell record, even though we have plenty of free space.

Signed-off-by: Roland Dreier <rolandd@cisco.com>

[NETFILTER] ip_conntrack: Update event cache when status changes

The GRE, SCTP and TCP protocol helpers did not call
ip_conntrack_event_cache() when updating ct->status.  This patch adds
the respective calls.

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[IRDA]: *irttp cleanup

* Remove useless comment.
* Remove useless assertions.
* Remove useless comparison.

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

[IRDA]: Fix memory leak in irttp_init()

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

[NET]: Protect neigh_stat_seq_fops by CONFIG_PROC_FS

From: Amos Waterland <apw@us.ibm.com>

If CONFIG_PROC_FS is not selected, the compiler emits this warning:

 net/core/neighbour.c:64: warning: `neigh_stat_seq_fops' defined but not used

Which is correct, because neigh_stat_seq_fops is in fact only
initialized and used by code that is protected by CONFIG_PROC_FS.  So
this patch fixes that up.

Signed-off-by: Amos Waterland <apw@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[NETFILTER]: Fix ip[6]t_NFQUEUE Kconfig dependency

We have to introduce a separate Kconfig menu entry for the NFQUEUE targets.
They cannot "just" depend on nfnetlink_queue, since nfnetlink_queue could
be linked into the kernel, whereas iptables can be a module.

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge master.kernel.org:/home/rmk/linux-2.6-ucb

Merge master.kernel.org:/home/rmk/linux-2.6-serial

Merge master.kernel.org:/home/rmk/linux-2.6-arm

[PATCH] Input: check switch bitmap when matching handlers

The wwitch bitmap was added to input_device_id structure and we should
check it when matching handlers and input devices.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[ARM] Fix compiler warnings for memcpy_toio/memcpy_fromio/memset_io

Add 'volatile' to the __iomem pointers for these functions as
per x86.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

[MFD] Fix "bious one-bit signed bitfield" errors

ucb1x00-ts declared a couple of one-bit 'int' bitfields.
Make them unsigned.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

[SERIAL] Remove unused variable in clps711x.c

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Merge branch 'upstream' from /linux/kernel/git/jgarzik/libata-dev

Merge branch 'upstream-fixes' from /linux/kernel/git/jgarzik/netdev-2.6

[PATCH] skge: fix Yukon-Lite A0 workaround

This is one of those workarounds sucked over from sk98lin driver.
The skge driver needs to detect the Yukon-Lite A0 chip properly,
and turn of Rx FIFO Flush.

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

Merge /spare/repo/linux-2.6/

Merge master.kernel.org:/home/rmk/linux-2.6-arm

[ARM] Fix context switch with ARMv6 + TLS

We accidentally corrupted the TLS value when clearing out the ARMv6
exclusive monitor.  Avoid doing so.

Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

[PATCH] revert oversized kmalloc check

As davem points out, this wasn't such a great idea.  There may be some code
which does:

size = 1024*1024;
while (kmalloc(size, ...) == 0)
size /= 2;

which will now explode.

Cc: "David S. Miller" <davem@davemloft.net>
Cc: Christoph Lameter <christoph@lameter.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] documentation: sparse no longer uses bk, but git

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] ipmi_msghandler: inconsistent spin_lock usage

I found an inconsistent spin_lock usage in ipmi_smi_msg_received.

Signed-off-by: Hironobu Ishii <hishii@soft.fujitsu.com>
Cc: Corey Minyard <minyard@acm.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] ppc64: Fix huge pages MMU mapping bug

Current kernel has a couple of sneaky bugs in the ppc64 hugetlb code that
cause huge pages to be potentially left stale in the hash table and TLBs
(improperly invalidated), with all the nasty consequences that can have.

One is that we forgot to set the "secondary" bit in the hash PTEs when
hashing a huge page in the secondary bucket (fortunately very rare).

The other one is on non-LPAR machines (like Apple G5s), flush_hash_range()
which is used to flush a batch of PTEs simply did not work for huge pages.
Historically, our huge page code didn't batch, but this was changed without
fixing this routine.  This patch fixes both.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] atyfb c99 fix

- fix this:

  drivers/video/aty/xlinit.c: In function `atyfb_xl_init':
  drivers/video/aty/xlinit.c:256: warning: ISO C90 forbids mixed declarations and code

- repair some kooky coding style

- Use ARRAY_SIZE()

Cc: Tom 'spot' Callaway <tcallawa@redhat.com>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] hisax: remove URB_ASYNC_UNLINK

usb_unlink_urb is always async now, so URB_ASYNC_UNLINK was removed from
core USB and we must do as well.

Signed-off-by: Karsten Keil <kkeil@suse.de>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Make sure SIGKILL gets proper respect

Bhavesh P. Davda <bhavesh@avaya.com> noticed that SIGKILL wouldn't
properly kill a process under just the right cicumstances: a stopped
task that already had another signal queued would get the SIGKILL
queued onto the shared queue, and there it would remain until SIGCONT.

This simplifies the signal acceptance logic, and fixes the bug in the
process.

Losely based on an earlier patch by Bhavesh.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] cifs: Add support for suspend

cifsd had been preventing software suspend from completing.

Signed-off-by: pavel@suse.de
Signed-off-by: Steve French <sfrench@us.ibm.com> lightly modified
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] pci: fixup parent subordinate busnr

I believe the change that broke things is introduction of
pci_fixup_parent_subordinate_busnr().

The patch here does two things:
- hunk #1 should fix the problems you've seen when you boot without
  additional "pci" kernel options;
- hunk #2 supposedly fixes boot with "pci=assign-busses" option which
  otherwise hangs Acer TM81xx machines as reported.

Please try this with and without "pci=assign-busses". If it boots,
I'd like to see 'lspci -vvx' for both cases.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Merge branch 'for-linus' of /linux/kernel/git/shaggy/jfs-2.6

[PATCH] 8390 Tx fix for non i386 machines

While this is true, E8390_CMD is zero on i386, and thus there should be no
effect for these machines.  Machines like Mac, Amiga etc. which use Alan's
clever register mapping may have a non-zero E8390_CMD and result in bogus
"transmitter busy" type messages from this bug.

Fixes BUG# 3991.

[SCTP]: Fix SCTP_SHUTDOWN notifications.

Fix to allow SCTP_SHUTDOWN notifications to be received on 1-1 style
SCTP SOCK_STREAM sockets.

Add SCTP_SHUTDOWN notification to the receive queue before updating
the state of the association.

Signed-off-by: Sridhar Samudrala <sri@us.ibm.com>
Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

[NETFILTER] Fix conntrack event cache deadlock/oops

This patch fixes a number of bugs.  It cannot be reasonably split up in
multiple fixes, since all bugs interact with each other and affect the same
function:

Bug #1:
The event cache code cannot be called while a lock is held.  Therefore, the
call to ip_conntrack_event_cache() within ip_ct_refresh_acct() needs to be
moved outside of the locked section.  This fixes a number of 2.6.14-rcX
oops and deadlock reports.

Bug #2:
We used to call ct_add_counters() for unconfirmed connections without
holding a lock.  Since the add operations are not atomic, we could race
with another CPU.

Bug #3:
ip_ct_refresh_acct() lost REFRESH events in some cases where refresh
(and the corresponding event) are desired, but no accounting shall be
performed.  Both, evenst and accounting implicitly depended on the skb
parameter bein non-null.   We now re-introduce a non-accounting
"ip_ct_refresh()" variant to explicitly state the desired behaviour.

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[NETFILTER] remove unneeded structure definition from conntrack helper

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[NETFILTER] Fix sparse endian warnings in pptp helper

Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[NETFILTER] fix DEBUG statement in PPTP helper

As noted by Alexey Dobriyan, the DEBUGP statement prints the wrong
callID.

Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[BRIDGE]: TSO fix in br_dev_queue_push_xmit

Signed-off-by: Vlad Drukker <vlad@storewiz.com>
Acked-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

[TCP]: Adjust Reno SACK estimate in tcp_fragment

Since the introduction of TSO pcount a year ago, it has been possible
for tcp_fragment() to cause packets_out to decrease.  Prior to that,
tcp_retrans_try_collapse() was the only way for that to happen on the
retransmission path.

When this happens with Reno, it is possible for sasked_out to become
invalid because it is only an estimate and not tied to any particular
packet on the retransmission queue.

Therefore we need to adjust sacked_out as well as left_out in the Reno
case.  The following patch does exactly that.

This bug is pretty difficult to trigger in practice though since you
need a SACKless peer with a retransmission that occurs just as the
cached MTU value expires.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

[PATCH] Add dm-snapshot tutorial in Documentation

I've recently discovered the real functionality of device-mapper snapshots,
and since they are not well known, I've decided to write some docs for
them.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] NFS: fix client oops when debugging is on

nfs_readpage_release() causes an oops while accessing a file with NFS
debugging turned on (echo 32767 > /proc/sys/sunrpc/nfs_debug) and a kernel
built with CONFIG_DEBUG_SLAB.

This patch moves the debugging statement above nfs_release_request() to
avoid accessing freed memory.

Signed-off-by: Nick Wilson <njw@osdl.org>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] Fix bd_claim() error code.

Problem: In some circumstances, bd_claim() is returning the wrong error
code.

If we try to swapon an unused block device that isn't swap formatted, we
get -EINVAL.  But if that same block device is already mounted, we instead
get -EBUSY, even though it still isn't a valid swap device.

This issue came up on the busybox list trying to get the error message
from "swapon -a" right.  If a swap device is already enabled, we get -EBUSY,
and we shouldn't report this as an error.  But we can't distinguish the two
-EBUSY conditions, which are very different errors.

In the code, bd_claim() returns either 0 or -EBUSY, but in this case busy
means "somebody other than sys_swapon has already claimed this", and
_that_ means this block device can't be a valid swap device.  So return
-EINVAL there.

Signed-off-by: Rob Landley <rob@landley.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] ext3: EXT3_DEBUG build fixes

Fix some warnings and a build error when EXT3_DEBUG is enabled.

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] oss: don't concatenate __FUNCTION__ with strings

It's deprecated. Use "%s", __FUNCTION__ instead.

Signed-off-by: Clemens Buchacher <drizzd@aon.at>
Signed-off-by: Maximilian Attems <janitor@sternwelten.at>
Signed-off-by: Domen Puncer <domen@coderock.org>
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] xtensa: remove io_remap_page_range and minor clean-ups

Remove io_remap_page_range() from all of Linux 2.6.x (as requested and
suggested by Randy Dunlap) and minor clean-ups.

Signed-off-by: Chris Zankel <chris@zankel.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] uml: replace printk with "stack-friendly" printf - to report console failure

User get *a lot* confused when consoles don't work but we don't report
anything.  And, as reported in the comment, using printk to report "your
console doesn't work" isn't likely to go that far.

Fix the problem on the base of this: stack consumption by host printf().  Use
kernel sprintf() and os_write_file, using a wild guess that one page will be
enough for the message, to preallocate the buffer with kmalloc().

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] uml: use GFP_ATOMIC for allocations under spinlocks.

setup_initial_poll is only called with sigio_lock() held, so use appropriate
allocation.

Also, parse_chan() can also be called when holding a spinlock (see line_open()
 -> parse_chan_pair()).

I have sporadic problems (spinlock taken twice, with spinlock debugging on UP)
which could be caused by a sequence like "take spinlock, alloc and go to
sleep, take again the spinlock in the other thread".

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] uml: Fix GFP_ flags usage

GFP_ATOMIC | GFP_KERNEL is meaningless and won't work.  Actually it never
worked, even in 2.4.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] uml: avoid fixing faults while atomic

Following i386, we should maybe refuse trying to fault in pages when we're
doing atomic operations, because to handle the fault we could need to take
already taken spinlocks.

Also, if we're doing an atomic operation (in the sense of in_atomic()) we're
surely in kernel mode and we're surely going to handle adequately the failed
fault, so it's safe to behave this way.

Currently, on UML SMP is rarely used, and we don't support PREEMPT, so this is
unlikely to create problems right now, but it might in the future.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] uml: run mconsole "sysrq" in process context

Things are breaking horribly with sysrq called in interrupt context.  I want
to try to fix it, but probably this is simpler.  To tell the truth, sysrq is
normally run in interrupt context, so there shouldn't be any problem.

There's also a warning from the fault handler because it's run in atomic
context (I have a patch for that, only I deferred it).  This is why I'm doing
this.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] uml: fix condition in tlb flush

Avoid setting w = 0 twice.  Spotted this (trivial) thing which is needed for
another patch.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] uml: fix hang in TT mode on fault

The current code doesn't handle well general protection faults on the host -
it thinks that cr2 is always the address of a page fault.  While actually, on
general protection faults, that address is not accessible, so we'd better
assume we couldn't satisfy the fault.  Currently instead we think we've fixed
it, so we go back, retry the instruction and fault again endlessly.

This leads to the kernel hanging when doing copy_from_user(dest, -1, ...) in
TT mode, since reading *(-1) causes a GFP, and we don't support kernel
preemption.

Thanks to Luo Xin for testing UML with LTP and reporting the failures he got.

Cc: Luo Xin <luothing@sina.com>
Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] uml: don't redundantly mark pte as newpage in pte_modify

pte_modify marks a page as needing flush, which is redundant because the
resulting PTE is still set with set_pte, which already handles that.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] strlcat: use for uml umid.c

Simplify the code by using strlcat() instead of strncat() and manual
appending.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] uml: don't remove umid files in conflict case

Only remove the UML pidfile and management socket if we created them.
Currently in case two UMLs are started with the same umid, the second will
remove the first's ones.

Probably we should also panic() at that point, not sure however.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade@yahoo.it>
Cc: Jeff Dike <jdike@addtoit.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] swsusp: fix comments

Fix comments in swsusp.

Signed-off-by: Pavel Machek <pavel@suse.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] __kmalloc: Generate BUG if size requested is too large.

I had an issue on ia64 where I got a bug in kernel/workqueue because
kzalloc returned a NULL pointer due to the task structure getting too big
for the slab allocator.  Usually these cases are caught by the kmalloc
macro in include/linux/slab.h.

Compilation will fail if a too big value is passed to kmalloc.

However, kzalloc uses __kmalloc which has no check for that.  This patch
makes __kmalloc bug if a too large entity is requested.

Signed-off-by: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] mesh scsi: fix error handling

The PowerMac mesh SCSI driver had some missing error handling which would
trigger warnings due to lack of handling of return value from
scsi_add_host.  This fixes it.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: James Bottomley <James.Bottomley@SteelEye.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] atiixp_modem printk fixes

Correctly identify atiixp_modem in its error messages.

Signed-off-by: Chuck Ebbert <76306.1226@compuserve.com>
Cc: Vojtech Pavlik <vojtech@suse.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] corrections to top-level README

Corrections to the recent top-level README changes.

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] ppc64: SMU driver update & i2c support

The SMU is the "system controller" chip used by Apple recent G5 machines
including the iMac G5.  It drives things like fans, i2c busses, real time
clock, etc...

The current kernel contains a very crude driver that doesn't do much more
than reading the real time clock synchronously.  This is a completely
rewritten driver that provides interrupt based command queuing, a userland
interface, and an i2c/smbus driver for accessing the devices hanging off
the SMU i2c busses like temperature sensors.  This driver is a basic block
for upcoming work on thermal control for those machines, among others.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Jean Delvare <khali@linux-fr.org>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] ppc64: Fix 64bit ptrace DABR support

Fix my stupid bug in the 64bit version of PTRACE_SET_DEBUGREG.

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] ppc64: Fix build with iommu debug enabled

Fix build when iommu debug is enabled.

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] ppc64: Fix LPAR regression

The recent iommu fix broke booting on some POWER4 and POWER5 LPAR boxes.

It looks like we have been calling the non LPAR iommu_dev_setup on LPAR
machines for a while. The recent iommu fix caused that code path to
fail.

It looks like we just need to hook up the devices iommu_table to the
parents one, so do that instead of calling iommu_dev_setup_pSeries and
crossing the streams.

Signed-off-by: Anton Blanchard <anton@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] ext3: ext3_show_options fix

EXT3_MOUNT_DATA_FLAGS is not a boolean. This fixes it.

Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] slab: fix handling of pages from foreign NUMA nodes

The numa slab allocator may allocate pages from foreign nodes onto the
lists for a particular node if a node runs out of memory.  Inspecting the
slab->nodeid field will not reflect that the page is now in use for the
slabs of another node.

This patch fixes that issue by adding a node field to free_block so that
the caller can indicate which node currently uses a slab.

Also removes the check for the current node from kmalloc_cache_node since
the process may shift later to another node which may lead to an allocation
on another node than intended.

Signed-off-by: Christoph Lameter <clameter@sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] swsusp: do not trigger BUG_ON() if there is not enough memory

The following patch makes swsusp avoid triggering the BUG_ON() in
swsusp_suspend() if there is not enough memory for suspend.

Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Cc: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] hdaps: small update.

- Handle dmi_system_check() elegantly, now that my bugfix is upstream.

- Add support for the X41 and R52.

- Cleanup some comments do I do not have to keep updating them with each
  new whitelisted laptop.

Signed-off-by: Robert Love <rml@novell.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] Fix mmap() of /dev/hpet

The address passed to io_remap_pfn_range() in hpet_mmap() does not need to
be converted using __pa(): it is already a physical address.  This bug was
found and the patch suggested by Clay Harris.

I introduced this particular bug when making io_remap_pfn_range changes a
few months ago.  In fact mmap()ing /dev/hpet has *never* previously worked:
before my changes __pa() was being executed on an ioremap()ed virtual
address, which is also invalid.

Signed-off-by: Keir Fraser <keir@xensource.com>
Cc: Robert Picco <Robert.Picco@hp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] slab: alpha inlining fix

It is essential that index_of() be inlined.  But alpha undoes the gcc
inlining hackery and index_of() ends up out-of-line.  So fiddle with things
to make that function inline again.

Cc: Richard Henderson <rth@twiddle.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] alpha: fix kernel panic during SysRq-b

acquire_console_sem() does BUG() in interrupt context now, as in the case
of SysRq-b.

Cc: Richard Henderson <rth@twiddle.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] SOFTWARE_SUSPEND needs HOTPLUG_CPU on SMP

Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Acked-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] ppc32: fix build with oprofile

Current -git tree doesn't build when enabling oprofile on a non-bookE CPU
(like on a PowerMac for example).  While there is no performance counter
support for these CPUs implemented yet, it's still nice to be able to use
the timer based sampling, and that got broken.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] DEBUG redefined in drivers/mtd/devices/docecc.c

Fix namespace clash:

drivers/mtd/devices/docecc.c:43:1: warning: "DEBUG" redefined
In file included from drivers/mtd/devices/docecc.c:40:
include/linux/mtd/mtd.h:219:1: warning: this is the location of the previous definition

Signed-off-by: Grant Coady <gcoady@gmail.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] Rename vprintk define in bttpvp.h

Rename the (apparently) bttv intern #define vprintk to verbprintk to
resolve a name clash.

Reason: vprintk() is defined in include/linux/kernel.h similar to printk
but with a va_list argument.

(akpm: I changed it to bttv_printk)

Cc: Mauro Carvalho Chehab <mchehab@brturbo.com.br>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] v9fs: don't free root dentry & inode if error occurs in v9fs_get_sb

If error occurs while in v9fs_get_sb after it calles sget, the dentry object
of the root and its inode may be freed twice -- once while handling the error
in v9fs_get_sb, and second time when v9fs_get_sb calles deactivate_super
(which in turn calls v9fs_kill_super)

The patch removes the unnecessary code that frees the root dentry and its
inode.

Signed-off-by: Latchesar Ionkov <lucho@ionkov.net>
Cc: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] v9fs: replace strlen on newly allocated by __getname buffers to PATH_MAX

v9fs_vfs_readlink allocates space for the link using __getname and
errorneously uses strlen on the newly allocated buffer to check if the buffer
passed by the user is bigger than the one returned by __getname.

The patch replaces the strlen usage to PATH_MAX, which is the actual size of
the buffers returned by __getname.

Signed-off-by: Latchesar Ionkov <lucho@ionkov.net>
Cc: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] v9fs: make copy of the transport prototype instead of using it directly

When a new session is created it uses a template object of the specified
transport type to instantiate its own copy.  The code for the making a copy of
the template object was lost, and the object itself is attached to the v9fs
session.  This leads to many sessions using the same transport instead of
having their own copy.

The patch puts back the code that makes a copy of the template object.

Signed-off-by: Latchesar Ionkov <lucho@ionkov.net>
Cc: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] v9fs: allocate the Rwalk qid array from the right conv buffer

When v9fs_deserealize_fcall deserializes a Rwalk message, it incorrectly
allocates space for the qid array in the source instead of the destination
buffer.

Signed-off-by: Latchesar Ionkov <lucho@ionkov.net>
Cc: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] v9fs: make conv functions to check for conv buffer overflow

buf_check_size function checks if the conv buffer has enough space for the
performed operation, but it doesn't return the result back to the calling
function, only logs an error in the log.

The report-back-error functionality was lost when buf_check_size was
converted from macro to inline function. The return in the macro used to
exit from the functions that include it, after the conversion it just exits
from the inline function itself.

The patch makes buf_check_size to return flag and all functions that use
it check if they should perform the operation, or exit.

Signed-off-by: Latchesar Ionkov <lucho@ionkov.net>
Cc: Eric Van Hensbergen <ericvh@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] Update maintainers list with the kprobes maintainers

This patch updates the maintainers list with kprobes maintainers.

Signed-of-by: Prasanna S Panchamukhi <prasanna@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] suspend: cleanup calling of power off methods.

In the lead up to 2.6.13 I fixed a large number of reboot problems by
making the calling conventions consistent.  Despite checking and double
checking my work it appears I missed an obvious one.

The S4 suspend code for PM_DISK_PLATFORM was also calling device_shutdown
without setting system_state, and was not calling the appropriate
reboot_notifier.

This patch fixes the bug by replacing the call of device_suspend with
kernel_poweroff_prepare.

Various forms of this failure have been fixed and tracked for a while.

Thanks for tracking this down go to: Alexey Starikovskiy, Meelis Roos
<mroos@linux.ee>, Nigel Cunningham <ncunningham@cyclades.com>, Pierre
Ossman <drzeus-list@drzeus.cx>

History of this bug is at:
http://bugme.osdl.org/show_bug.cgi?id=4320

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] reboot: comment and factor the main reboot functions

In the lead up to 2.6.13 I fixed a large number of reboot problems by
making the calling conventions consistent.  Despite checking and double
checking my work it appears I missed an obvious one.

This first patch simply refactors the reboot routines so all of the
preparation for various kinds of reboots are in their own functions.
Making it very hard to get the various kinds of reboot out of sync.

Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] proc_task_root_link c99 fix

fs/proc/base.c: In function `proc_task_root_link':
fs/proc/base.c:364: warning: ISO C90 forbids mixed declarations and code

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Merge branch 'release' of /linux/kernel/git/aegl/linux-2.6

[IA64] MCA recovery verify pfn_valid

Verify the pfn is valid before calling pfn_to_page(),
and cut isolation message if nothing was done.

Signed-off-by: Hidetoshi Seto <seto.hidetoshi@jp.fujitsu.com>
Acked-by: Russ Anderson <rja@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

[IA64] Wire in the MCA/INIT handler stacks

Wire the MCA/INIT handler stacks into DTR[2] and track them in
IA64_KR(CURRENT_STACK).  This gives the MCA/INIT handler stacks the
same TLB status as normal kernel stacks.  Reload the old CURRENT_STACK
data on return from OS to SAL.

Signed-off-by: Keith Owens <kaos@sgi.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

[IA64] Fix simscsi for new SCSI midlayer

The sd driver now uses scsi_execute_req() for almost everything.
scsi_execute_req() converts requests into scatterlists.

Fix the HP SCSI disk simulator to understand scatterlists for
more commands.

Without this patch the current kernel will not boot on the simulator
(the disks are always detected as having no sectors, and so cannot be
mounted).

Signed-off-by: Peter Chubb <peterc@gelato.unsw.edu.au>
Signed-off-by: Tony Luck <tony.luck@intel.com>

[PATCH] ppc32: Fix configuration of PCI IO space on MPC85xx platform

For platforms that don't have PCI IO at 0 the outbound window
registers were not being properly configured.

Signed-off-by: Andrew Klossner <andrew@cesa.opbu.xerox.com>
Signed-off-by: Kumar K. Gala <kumar.gala@freescale.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] USB: Update Documentation/usb/URB.txt

This patch (as564) updates Documentation/usb/URB.txt, bringing it roughly
up to the current level.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] ub: Comment out unconditional stall clear

This code appears to be more trouble than it's worth, considering that
no normal users reload drivers. So, we comment it for now. It is not
removed outright for the benefit of hackers (that is, myself).

Signed-off-by: Pete Zaitcev <zaitcev@yahoo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] USB: Add Novatel CDMA Wireless PC card IDs to airprime

USB: Add device id's for Novatel Wireless CDMA wireless PC card.
     The Novatel CDMA card behaves the same as the AirPrime by providing
     a USB serial port.

Signed-off-by: David Hollis <dhollis@davehollis.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] usb/serial/option.c: Increase input buffer size

The card sometimes sends >2000 bytes in one single chunk. Ouch.

Signed-Off-By: Matthias Urlichs <smurf@smurf.noris.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] USB: fix pegasus driver

Addresses some small bugs in the pegasus ethernet-over-USB driver.
Specifically, malformed long packets from the adapter could cause a kernel
panic; the interrupt interval calculation was inappropriate for high-speed
devices; the return code from read_mii_word was tested incorrectly; and
failure to unlink outstanding URBs before freeing them could lead to kernel
panics when unloading the driver.

Signed-off-by: Kevin Vigor <kevin@realmsys.com>
Cc: Petko Manolov <petkan@users.sourceforge.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] USB: sl811-hcd minor fixes

Three minor sl811-hcd fixes:

 - Elminate memory leak on one (rare) disable/shutdown path.

 - For periodic transfers that don't need to be scheduled, update
   urb->start_frame to represent the transfer phase correctly.

 - Report the (single) port as removable, by default.

Since no drivers yet use start_frame or that part of the hub descriptor,
only that leak is likely to ever matter.

Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
 drivers/usb/host/sl811-hcd.c |   16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

[PATCH] USB: fix pxa2xx_udc compile warnings

This patch fixes several types in the PXA25x udc driver and hence fixes
several compiler warnings.

Signed-off-by: Richard Purdie <rpurdie@rpsys.net>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] USB: ftdi_sio: allow baud rate to be changed without raising RTS and DTR

I'm using a 2 port USB RS232 dongle to connect to a serial-IR cradle for
a bar code reader). Detecting the baudrate of the serial-IR involves
keeping DTR low while changing baudrate.

This works using normal 16550A serial ports as well as the FTDI driver
version 1.4.0 (Linux 2.6.8) but stopped working with the change to
"ensure RTS and DTR are raised when changing baudrate" introduced in
version 1.4.1 (Linux 2.6.9).

The attached patch fixes this, so RTS and DTR is only raised when
changing baudrate iff the previous baudrate was B0.

Signed-off-by: Peter Favrholdt <pfavr@how.dk>
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] USB: more device IDs for Option card driver

Added support for HUAWEI E600 and Audiovox AirCard

User reports say that these devices work without driver modification.

Signed-off-by: Matthias Urlichs <smurf@smurf.noris.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

[PATCH] ub: fix burning cds

This patch fixes a few problems with ub and cleans up a couple of things:

 - Bump UB_MAX_REQ_SG, this allows to burn CDs
 - Drop initialization of urb.transfer_flags,
   now that URB_UNLINK_ASYNC is gone
 - Add forgotten processing of stalls at GetMaxLUN
 - Remove a few more P3-tagged printks whose time has come
 - Correct comment about ZIP-100

Signed-off-by: Pete Zaitcev <zaitcev@yahoo.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
 drivers/block/ub.c |   53 +++++++++++++++++++++++++++--------------------------
 1 file changed, 27 insertions(+), 26 deletions(-)