From: "J. Bruce Fields" <bfields@fieldses.org>

Unregister svcauth_gss caches on exit from gss module; fixes an oops on
rmmod.

From: Benjamin Herrenschmidt <benh@kernel.crashing.org>

From: David Woodhouse <dwmw2@infradead.org>

Without this the task struct gets unaligned when using SLAB_DEBUG, causing
random problems with FP and Altivec.

From: Ralf Baechle <ralf@linux-mips.org>

MIPS now also uses the generic ioctl compat code.

From: Ralf Baechle <ralf@linux-mips.org>

MIPS never uses a.out

From: Ralf Baechle <ralf@linux-mips.org>

- Add HPC3 PS/2 driver bits for SGI IP22 aka Indy
- Add Mace PS/2 driver bits for SGI IP32 aka O2
- Add R4030 PS/2 driver bits for Jazz family
- Don't register I/O ports where we're using the I/O port memory window
   to access the i8042 registers

From: Ralf Baechle <ralf@linux-mips.org>

Add Pete to CREDITS for all the time he's invested into supporting the AMD
Alchemy of SOCs and eval boards.

From: Ralf Baechle <ralf@linux-mips.org>

All MIPS systems use the same PCI code now.

Fix the incorrect comment which caused the fb_ioctl confusion.

From: Matt Mackall <mpm@selenic.com>

Delete obsolete comment and kill test of obsolete define.

From: Matt Domsch <Matt_Domsch@dell.com>

The patch below from Michael E.  Brown properly sets the owner field of a
sysfs attribute.  Without this patch, it is possible to crash the kernel with
a simultaneous insmod/rmmod while reading files exported by the module.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

Add support for z990 crypto instructions to in-kernel crypto api.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

zfcp host adapter changes:
 - Fix error recovery stall in case of unavailable nameserver.
 - Reset host_scribble field to NULL in scsi_cmd.
 - Remove request debug code.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

dasd device driver changes:
 - Initialize open_count with -1 to account for blkdev_open in
   dasd_scan_partitions.
 - Introduce USE_ERP request flag to selectivly switch off error
   recovery for reserve, release & unconditional reserve ioctls.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

Network driver changes:
 - qeth: Fix reference counting in regard to sysfs backing store patches.
 - qeth: Prefix kernel thread names with qeth_.
 - qeth: Remove inbound and outbound tasklets. Handle buffers directly
         in the interrupts handlers.
 - iucv: Add missing kfree in iucv_register_program.
 - iucv: Add missing return in netiucv_transmit_skb.
 - iucv: Check for NULL pointer in conn_action_txdone.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

3270 device driver changes:
 - Add NULL pointer checks.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

Common i/o layer changes:
 - Quiesce active subchannels for lpar reipl.
 - Delete timer after reception of interrupt for kill on timeout.
 - Cleanup some comments in qdio.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

s390 core changes:
 - Fix race in do_call_softirq in regard to kernel preemption.
 - Fix typo in compat mq system call wrappers.
 - Add s390 to Kconfig for AUDITSYSCALL.
 - Redefine TASK_SIZE to TASK31_SIZE for compilation of binfmt_elf32.
 - Use correct error value for sys32_ipc when called with an invalid number.
 - New default configuration.

From: Stephen Rothwell <sfr@canb.auug.org.au>

This patch fixes loading viocd as a module.  It would oops because I was
passing the address of a static buffer to dma_map_single and when loaded as
a module, this address is not valid for that purpose.

There are a couple of simple cleanups here as well.

It no longer has any callers.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Brad Spengler <spender@grsecurity.net> found an exploitable bug in the proc handler
of cpufreq, where a user-supplied unsigned int is cast to a signed int and then
passed on to copy_[to|from]_user() allowing arbitary amounts of memory to be written
(root only thankfully), or read (as any user).

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned
the name CAN-2004-0228 to this issue.

From Dominik.

One big limitation of the ACPI specification is that it's impossible to
detect the current P-State by reading from ACPI-defined registers. And the
CPU isn't always at P0 when the system boots. So, try to "guess" the current
P-State by analyzing cpu_khz.

From Dominik.

If used as a bootparam, this would've become powernow-k7.powernow_acpi_force which looks silly.

Spotted by Charles Coffing <ccoffing@novell.com>

This updates the lkkbd driver to it's current version.

It also incorporates two patches suggested on LKML (fixing
some leading whitespace and an unneccessary check).

This  updates the vsxxx driver to it's current version.

Even DEC tablet support (VSXXX-AB) is now tested - it works:)
You can even hotplug between mouse and digitizer...

This patch is needed due to other patches that were applied in parallel
with the inclusion of the iSeries virtual ethernet driver.

From: Pavel Roskin <proski@gnu.org>

The "ide-cs" module cannot be unloaded because it uses obsolete
MOD_INC_USE_COUNT and MOD_DEC_USE_COUNT macros.  In fact, they are not
needed in ide-cs.c in 2.6 kernels.  The generic PCMCIA code already
increases use count for every device served by the driver, so it's
impossible to unload the ide-cs driver while it's in use.

I was told that the removal of IDE interfaces may be unsafe in 2.6
kernels.  However, MOD_INC_USE_COUNT only prevents removal of the module,
not the interface.  It's also the first obstacle, albeit a trivial one,
for anybody debugging those problems (i.e. loading a modified module
requires "rmmod -f" or reboot to unload the old version).

From: Arthur Othieno <a.othieno@bluewin.ch>

From: Pavel Roskin <proski@gnu.org>

If I eject IDE CompactFlash card, I get a stack dump from
devfs_remove() because ide/host2/bus0/target0/lun0 doesn't exist.

After del_gendisk() is called from idedisk_cleanup() drive->devfs_name refers
to a non-existent directory and should be erased, so that ide_unregister()
doesn't try to remove that directory again.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

This cset adds minimal support for ARM Ltd's ARM926EJ-S "Versatile"
platform.

As Arjan points out, the patch does exactly the opposite
of what it was claimed to do.

Andrea: tssk tssk.

Cset exclude: akpm@osdl.org[torvalds]|ChangeSet|20040421144431|15930

From: Yury Umanets <torque@ukrpost.net>

I have found small inconsistency in loop_set_fd().  It checks if
->sendfile() is implemented for passed block device file.  But in fact,
loop back device driver never calls it.  It uses ->sendfile() from backing
store file.

From: William Lee Irwin III <wli@holomorphy.com>

i386 does hardware interpretation of pagetables, so pte_clear() can't be
used on present ptes, as it sets the upper half of the hugepte prior to
setting the lower half (which includes the valid bit).  i.e.  there is a
window where having a hugepage mapped at 56GB and doing pte_clear() in
unmap_hugepage_range() allows other threads of the process to see a
hugepage at 0 in place of the original hugepage at 56GB.

This patch corrects the situation by using ptep_get_and_clear(), which
clears the lower word of the pte prior to clearing the upper word.

There is another nasty where huge_page_release() needs to wait for TLB
flushes before returning the hugepages to the free pool, analogous to the
issue tlb_remove_page() and tlb_flush_mm() repair.

From: Andrea Arcangeli <andrea@suse.de>

Arrange for ioctl(FBIOPUTCMAP) to do copy_to_user() rather than memcpy.

From: Andrea Arcangeli <andrea@suse.de>

Correctly range-check an incoming-from-userspace argument.  Found by the
Stanford checker.