From: Luiz Fernando Capitulino <lcapitulino@prefeitura.sp.gov.br>

sound/oss/opl3sa2.c:163: warning: `opl3sa2_lock' defined but not used

From: Andi Kleen <ak@suse.de>

ptrace/access_process_vm was passing current to get_user_pages as task, but
it should have been clearly the child task instead.

This fixes the fault accounting in ptrace and the vsyscall debugging on
x86-64 (it needs the correct task_struct to map the vsyscall pages)

From: Luiz Fernando Capitulino <lcapitulino@prefeitura.sp.gov.br>

sound/oss/cmpci.c: In function `cm_release_mixdev':
sound/oss/cmpci.c:1465: warning: unused variable `s'

From: Rusty Russell <rusty@rustcorp.com.au>

From: Srivatsa Vaddagiri <vatsa@in.ibm.com>

Hit a couple of (cpu hotplug) races in slab allocator during my tests.
Mostly it was because of continuous loading/unloading fs/minix/minix.ko
while simultaneously doing offline/online of CPUs.  As part of its init and
exit routines, minix.ko create/destroys caches, which lead to several
oopses.

1. kmem_cache_create
	In brief, kmem_cache_create does:
		a) calls enable_cpucache to create per-cpu cache for all
		   online CPUs. 
		b) adds the cache to the global list of caches

	These two are not done atomically and thats what causes problems.

	For ex: lets say that at the time of step a) CPU1 is not online.
	Hence no per-cpu cache is created for CPU1 (cachep->array[1] is NULL). 
	However CPU1 is not completely dead in the sense that CPU_DEAD
	processing for it is not yet over.  By the time CPU_DEAD processing 
	starts for CPU1, step b) is complete. So cpuup_callback finds this
	cache and tries freeing it's per-cpu cache associated with CPU1.
	In the process it dereferences a NULL pointer and dies.

2. kmem_cache_destroy
	In brief, kmem_cache_destroy does:
		a) deletes the cache from the global list of caches
		b) Drain per-cpu cache (drain_cpu_caches), which
		   basically uses smp_call_function to run do_drain
		   on all online CPUs.

	One possible race is let's say that CPU1 is coming up.
	By the time CPU_UP_PREPARE is processed for CPU1, step a) is
	complete. Hence cpuup_callback does not allocate any per-cpu cache
	for the cache that is being destroyed.

	However by the time step b) is run, CPU1 is completely online
	(taking interrupts). It receives the IPI and tries draining
	it per-cpu cache (which is NULL) and dies there.

I think we need to serialize kmem_cache_create/destroy against CPU hotplug
to prevent these problems.  Patch below does that by taking CPU Hotplug sem
(which is OK since kmem_cache_create/destroy are not very frequently
used?).

From: Joe Korty <joe.korty@ccur.com>

The following fixes a problem where a SCHED_FIFO task would on occasion be
moved to the end of its runqueue when returned to from a preemption.  Cause
was due to some SCHED_OTHER code in schedule() which was being run for tasks
of every policy.

From: NeilBrown <neilb@cse.unsw.edu.au>

This helps raid5 work on at least 1 very large array..

Thanks to Evan Felix <evan.felix@pnl.gov>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

From: Colin Leroy <colin@colino.net>

rmmod'ing pmac_zilog currently oopses because uart_unregister_driver(),
which nullifies drv->tty_driver, is called before uart_remove_one_port(),
which uses said drv->tty_driver.

The comment at top of uart_unregister_driver() specifically says we have
to have removed all our ports via uart_remove_one_port() before.

From: Frank A. Uepping

   This fixes capiminor_alloc() to assign the lowest free minor for a
   new capi_tty. Thanks to Frank A. Uepping and Tim Woods.

The syscall return path on ppc64 checks if the error is between
-LAST_ERRNO and 0, if it is, does the usual inversion along with
setting a CR bit indicating to glibc that an error occured.

However, we had an interesting bug where we used a 32 bits logica
(unsigned) comparison, thus possibly doing false positives for
valid 64 bits unsigned values whose low 32 bits happen to be in
the error range.

Fix that.

Just as there is documentation for BINFMT_MISC and Java bytecodes
support, I thought it could be interesting to add documentation on how
to add BINFMT_MISC support for directly running .NET ".exe" binaries
using the Mono CLR.

This patch fixes more cases of possible preempt issue when testing
MSR for FP or VEC bits and then doing giveup_fpu or giveup_altivec
that I missed in my previous round of fixes (bk get helps before
grepping ;)

I also change the single step and program check exceptions to not
re-enable interrupts right away on C code entry, it was useless and
would cause interesting issues with preempt & xmon

A few asm/types.h test a config variable without including
<linux/config.h> first, which can e.g. cause different sector_t
definitions. HFS fell victim to that and broke on ppc with CONFIG_LBD
enabled. I scanned all asm/types.h and added <linux/config.h> as
necessary.

 - make sure cd->buffer is always inside a page - previously if an
   entry fit perfectly in the remainder of a page, cd->buffer would
   end up pointing past the end of that page.

 - make sure num_entry_words is always correct, even on the error
   path.

This increases the DART table to use the full size.  We allocate a full
16MB page anyway, so there's no difference in memory consumption. 

Thanks to Ben for spotting this, it was left over from debugging...

This fixes a bug in the iommu allocator that causes it to behave
strangely when a fair size of the table is allocated. 

Thanks to Andrew Gallatin for finding this.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

This patch from Alan Stern <stern@rowland.harvard.edu> fixes a bug in
the current USB code that causes khubd to hang when a device is removed
from the system, thereby preventing any future USB device changes (like
adding or removing other devices) from happening.

Both Andrew and I can easily duplicate this bug against the current -bk
tree. 

It's not a perfect fix, but it works for now, and I will spend the next
week working on restructuring the code so this is handled properly.

Version 0.16 of pcwd.c - Changes that were made are:
* Changed the driver so that it uses an internal timer to do
  the actual watchdog pinging. This way the watchdog's emulated
  'heartbeat' is usuable as a module parameter. The watchdog's
  heartbeat can now vary from 2 till 7200 seconds

Tested on pcwd card with temperature option

Version 0.15 of pcwd.c - Changes that were made are:
* Rewrote code for exchanging commands with the ISA-PC Watchdog card
* Restructured + rewrote the init and exit code
* Added option_switches info
* Use the option_switches info to find out what the cards heartbeat is
* Added notifier support

Tested on pcwd card with temperature option

It has been dead since kernel 2.5.18.

TiVo IDE support was never merged only this option was (in 2.4.0-test2), sigh.

filldir and getdents should check return values of put_user etc. The
generic code has been fixed but the ppc64 compat versions have not.

This replaces six duplicated implementations of various quality of
sys32_mount with a shiny new compat_sys_mount().

It's been tested on parisc64 and sparc64 and fixes a bug exposed by the
latest revision of Debian's initscripts.  Thanks to Arnd Bergmann and
Dave Miller for their suggestions, fixes and testing.  Please apply.

From: Bjorn Helgaas <bjorn.helgaas@hp.com>

Remove include of <asm/setup.h> from cmdlinepart.c.  This is not be needed
for i386 (it builds fine with this patch), and ia64 doesn't supply a
setup.h.

asm/setup.h contains a hodge-podge of stuff with no real
consistency between architectures.  It appears to be
included mainly by arch-specific drivers:
	acsi (Atari disks)
	amiflop (Amiga floppy)
	z2ram (ZorroII ram disk)
	amiserial (Amiga serial)
	...
and under arch-specific #ifdefs:
	fbcon (under __mc68000__ or CONFIG_APUS)
	fonts (ditto)
	logo (CONFIG_M68K)
	...

From: Bjorn Helgaas <bjorn.helgaas@hp.com>

The problem is that we don't clear out the efi_time_t buffer before asking
EFI to fill it in.  EFI doesn't always write the entire buffer (in
particular, the alarm time only supports one second resolution, so the
nanosecond field is often untouched).

The effect is that 'cat /proc/driver/efirtc' shows garbage in the
nanoseconds part of the alarm time, and sometimes artifacts like bogus
alarm date and junk after the actual end of the text.

From: James Morris <jmorris@redhat.com>

This patch fixes a bug where the return value for a permission call is not 
checked.

The bug was introduced when I added some code in the following changeset:

<http://linux.bkbits.net:8080/linux-2.5/diffs/security/selinux/hooks.c@1.19?nav=index.html|src/|src/security|src/security/selinux|hist/security/selinux/hooks.c>

Code was added after this line:

	err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, NULL, &ad);

without adding an explicit check of 'err', which was previously returned
from the function rather than being checked.  i.e. it would drop through
to:

	out:	
 		return err;

 	}

With the new code added, err can (and typically would) be overwritten with 
a successful value, causing the permission check to not deny permission if 
needed.  The intended denial would have been logged.

The patch below fixes this problem.

From: john stultz <johnstul@us.ibm.com>

This patch ensures that cpu_khz is adjusted on cpufreq notifications even
when the tsc timesource is not in use.  It fixes the mostly cosmetic issue
when using the ACPI PM timesource of /proc/cpuinfo not being properly
updated when cpu frequency was lowered.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

System call speedup part 2.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

The purpose of this is to speed up system calls on s390.  I managed to
squeeze about 65 cycles from each system call.  This improved e.g.  getpid()
from 232 to 157 cycles.  As a nice side-effect it simplified the uaccess
functions considerably.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

s390 tape driver changes:
 - Prevent offline while device is in use.
 - Do not use bus_id string in debug feature messages.
 - Check for IS_ERR(irb) error conditions in interrupt handler.
 - Fix removing tape discipline modules.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

s390 network driver changes:
 - ctc/lcs/qeth: prevent a ccw-device to be grouped multiple times.
 - icuv: clear correct field in iucv_register_program if no userid is specified.
 - lcs: fix online/offline cycle again.
 - lcs: fix ungrouping of lcs group device. The channels of the lcs card
   should be offline afterwards.
 - lcs: don't do netif_stop_queue if no tx buffer is available, just
   return -EBUSY and drop the packets.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

z/VM monitor stream changes:
 - Correct sysctl vs. module ref-counting.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

dasd device driver changes:
 - After a state change interrupt restart all running i/o on queue
   and reset device timer.
 - Improve some debug messages.
 - Lower timeout of reserve/release/steal_lock to 2 seconds.
 - Fix BIODASDPSRD ioctl.
 - Replace ro_flag, use_diag_flag and disconnect_error_flag words by bits.
 - Use BLKPG_DEL_PARTITION ioctl instead of a call to delete_partition because
   delete_partition is not an exported function. Since dasd_destroy_partitions
   can't do blkdev_get because dasd_open would fail, keep the block device
   open as long as partitions exist. This in turn requires a different
   approach to the open vs. offline race.