* 'hotfixes' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6:
  NFS: Fix dentry revalidation for NFSv4 referrals and mountpoint crossings
  NFS: Fix the fsid revalidation in nfs_update_inode()
  SUNRPC: Fix a nfs4 over rdma transport oops
  NFS: Fix an f_mode/f_flags confusion in fs/nfs/write.c

As long as the directory contents haven't changed, we should just let the
path walk proceed to cross the mountpoint. Apart from being an optimisation
in the case of 'nohide' mountpoint traversals, it also fixes an issue with
referrals: referral inodes don't have valid filehandles, so calling
nfs_revalidate_inode() on them is a bug.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

When we detect that we've crossed a mountpoint on the remote server, we
must take care not to use that inode to revalidate the fsid on our
current superblock. To do so, we label the inode as a remote mountpoint,
and check for that in nfs_update_inode().
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Prevent an RPC oops when freeing a dynamically allocated RDMA
buffer, used in certain special-case large metadata operations.
Signed-off-by: Tom Talpey <tmt@netapp.com>
Signed-off-by: James Lentini <jlentini@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

O_SYNC is stored in filp->f_flags.
Thanks to Al Viro for pointing out the bug.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

The card state mutex was only initialized when a device was connected,
but used during unload unconditionally, leading to an Oops if a driver
was loaded and unloaded again without ever connecting a device.

Fix this by initializing the mutex as soon as the structure is allocated.
Also add a missing mutex unlock revealed in the same execution path.

This fixes a possible Oops in 2.6.25-rc that was introduced by commit
e468c048 ("Gigaset: permit module
unload").

Thanks to Roland Kletzing for reporting this problem.
Signed-off-by: Tilman Schmidt <tilman@imap.cc>
Tested-by: Roland Kletzing <devzero@web.de>
Cc: Hansjoerg Lipp <hjlipp@web.de>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mingo/linux-2.6-sched-devel

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mingo/linux-2.6-sched-devel:
  sched: don't allow rt_runtime_us to be zero for groups having rt tasks
  sched: rt-group: fixup schedulability constraints calculation
  sched: fix the wrong time slice value for SCHED_FIFO tasks
  sched: export task_nice
  sched: balance RT task resched only on runqueue
  sched: retain vruntime

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-x86:
  x86-boot: don't request VBE2 information
  x86: re-add reboot fixups
  x86: fix typo in step.c
  x86: fix merge mistake in i387.c
  x86: clear DF before calling signal handler

randconfig testing found a bootup lockup in drivers/char/esp.c because
of a spinlock that wasn't correctly initialized.

I'm not sure why it became more prominent in 2.6.25-rc4, the bug seems
rather old and i've been doing allyesconfig bootups for ages with
CONFIG_ESP enabled.

This fixes this bootup lockup:

 PM: Adding info for No Bus:ttyP63
 ttyP32 at 0x0240 (irq = 0) is an ESP primary port
 BUG: spinlock lockup on CPU#0, swapper/1, f56dd004
 Pid: 1, comm: swapper Not tainted 2.6.25-rc4-sched-devel.git-x86-latest.git #402 [<c03ac6f4>] _raw_spin_lock+0x134/0x140
  [<c08649be>] _spin_lock_irqsave+0x5e/0x80
  [<c0b9fbfe>] ? espserial_init+0x2be/0x6e0
  [<c0b9fbfe>] espserial_init+0x2be/0x6e0
  [<c0b877a3>] kernel_init+0x83/0x260
  [<c0b9f940>] ? espserial_init+0x0/0x6e0
  [<c010416a>] ? restore_nocheck_notrace+0x0/0xe
  [<c0b87720>] ? kernel_init+0x0/0x260
  [<c0b87720>] ? kernel_init+0x0/0x260
  [<c0104507>] kernel_thread_helper+0x7/0x10
  =======================

kzalloc() is not the way to initialize spinlocks anymore.
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This patch checks if we can set the rt_runtime_us to 0. If there is a
realtime task in the group, we don't want to set the rt_runtime_us as 0
or bad things will happen. (that task wont get any CPU time despite
being TASK_RUNNNG)
Signed-off-by: Dhaval Giani <dhaval@linux.vnet.ibm.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

it was only possible to configure the rt-group scheduling parameters
beyond the default value in a very small range.

that's because div64_64() has a different calling convention than
do_div() :/

fix a few untidies while we are here; sysctl_sched_rt_period may overflow
due to that multiplication, so cast to u64 first. Also that RUNTIME_INF
juggling makes little sense although its an effective NOP.
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

Function sys_sched_rr_get_interval returns wrong time slice value for
SCHED_FIFO tasks. The time slice for SCHED_FIFO tasks should be 0.
Signed-off-by: Miao Xie <miaox@cn.fujitsu.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

The API is trivial, and so is the implementation.
Signed-off-by: Pavel Roskin <proski@gnu.org>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

Sripathi Kodi reported a crash in the -rt kernel:

  https://bugzilla.redhat.com/show_bug.cgi?id=435674

this is due to a place that can reschedule a task without holding
the tasks runqueue lock.  This was caused by the RT balancing code
that pulls RT tasks to the current run queue and will reschedule the
current task.

There's a slight chance that the pulling of the RT tasks will release
the current runqueue's lock and retake it (in the double_lock_balance).
During this time that the runqueue is released, the current task can
migrate to another runqueue.

In the prio_changed_rt code, after the pull, if the current task is of
lesser priority than one of the RT tasks pulled, resched_task is called
on the current task. If the current task had migrated in that small
window, resched_task will be called without holding the runqueue lock
for the runqueue that the task is on.

This race condition also exists in the mainline kernel and this patch
adds a check to make sure the task hasn't migrated before calling
resched_task.
Signed-off-by: Steven Rostedt <srostedt@redhat.com>
Tested-by: Sripathi Kodi <sripathik@in.ibm.com>
Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

Kei Tokunaga reported an interactivity problem when moving tasks
between control groups.

Tasks would retain their old vruntime when moved between groups, this
can cause funny lags. Re-set the vruntime on group move to fit within
the new tree.
Reported-by: Kei Tokunaga <tokunaga.keiich@jp.fujitsu.com>
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

The new x86 setup code (4fd06960) broke booting on an old P3/500MHz
with an onboard Voodoo3 of mine. After debugging it, it turned out
to be caused by the fact that the vesa probing now asks for VBE2 data.

Disassembing the video BIOS shows that it overflows the vesa_general_info
structure when VBE2 data is requested because the source addresses for the
information strings which get strcpy'ed to the buffer lie outside the 32K
BIOS code (and hence contain long sequences of 0xff's).

E.G.:

get_vbe_controller_info:
00002A9C  60                pushaw
00002A9D  1E                push ds
00002A9E  0E                push cs
00002A9F  1F                pop ds
00002AA0  2BC9              sub cx,cx
00002AA2  6626813D56424532  cmp dword [es:di],0x32454256 ; "VBE2"
00002AAA  7501              jnz .1
00002AAC  41                inc cx
.1:
00002AAD  51                push cx
00002AAE  B91400            mov cx,0x14
00002AB1  BED47F            mov si, controller_header
00002AB4  57                push di
00002AB5  F3A4              rep movsb ; copy vbe1.2 header

00002AB7  B9EC00            mov cx,0xec
00002ABA  2AC0              sub al,al
00002ABC  F3AA              rep stosb ; zero pad remainder

00002ABE  5F                pop di
00002ABF  E8EB0D            call word get_memory
00002AC2  C1E002            shl ax,0x2
00002AC5  26894512          mov [es:di+0x12],ax ; total memory
00002AC9  26C745040003      mov word [es:di+0x4],0x300 ; VBE version
00002ACF  268C4D08          mov [es:di+0x8],cs
00002AD3  268C4D10          mov [es:di+0x10],cs
00002AD7  59                pop cx
00002AD8  E361              jcxz .done ; VBE2 requested?
00002ADA  8D9D0001          lea bx,[di+0x100]
00002ADE  53                push bx
00002ADF  87DF              xchg bx,di ; di now points to 2nd half
00002AE1  26C747140001      mov word [es:bx+0x14],0x100 ; sw rev

00002AE7  26897F06          mov [es:bx+0x6],di		; oem string
00002AEB  268C4708          mov [es:bx+0x8],es
00002AEF  BE5280            mov si,0x8052 ; oem string
00002AF2  E87A1B            call word strcpy

00002AF5  26897F0E          mov [es:bx+0xe],di ; video mode list
00002AF9  268C4710          mov [es:bx+0x10],es
00002AFD  B91E00            mov cx,0x1e
00002B00  BEE87F            mov si,vidmodes
00002B03  F3A5              rep movsw

00002B05  26897F16          mov [es:bx+0x16],di ; oem vendor
00002B09  268C4718          mov [es:bx+0x18],es
00002B0D  BE2480            mov si,0x8024 ; oem vendor
00002B10  E85C1B            call word strcpy

00002B13  26897F1A          mov [es:bx+0x1a],di ; oem product
00002B17  268C471C          mov [es:bx+0x1c],es
00002B1B  BE3880            mov si,0x8038 ; oem product
00002B1E  E84E1B            call word strcpy

00002B21  26897F1E          mov [es:bx+0x1e],di ; oem product rev
00002B25  268C4720          mov [es:bx+0x20],es
00002B29  BE4580            mov si,0x8045 ; oem product rev
00002B2C  E8401B            call word strcpy

00002B2F  58                pop ax
00002B30  B90001            mov cx,0x100
00002B33  2BCF              sub cx,di
00002B35  03C8              add cx,ax
00002B37  2AC0              sub al,al
00002B39  F3AA              rep stosb ; zero pad
.done:
00002B3B  1F                pop ds
00002B3C  61                popaw
00002B3D  B84F00            mov ax,0x4f
00002B40  C3                ret

(The full BIOS can be found at http://peter.korsgaard.com/vgabios.bin
if interested).

The old setup code didn't ask for VBE2 info, and the new code doesn't
actually do anything with the extra information, so the fix is to simply
not request it. Other BIOS'es might have the same problem.
Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

Jan Beulich noticed that the reboot fixups went missing during
reboot.c unification.

(commit 4d022e35)

Geode and a few other rare boards with special reboot quirks are
affected.
Reported-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

TIF_DEBUGCTLMSR has no meaning in the actual MSR...
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

convert_fxsr_to_user() in 2.6.24's i387_32.c did this, and
convert_to_fxsr() also does the inverse, so I assume it's an oversight
that it is no longer being done.

[ mingo@elte.hu:

  we encode it this way because there's no space for the 'FPU Last
  Instruction Opcode' (->fop) field in the legacy user_i387_ia32_struct
  that PTRACE_GETFPREGS/PTRACE_SETFPREGS uses.

  it's probably pure legacy - i'd be surprised if any user-space relied on
  the FPU Last Opcode in any way. But indeed we used to do it previously
  so the most conservative thing is to preserve that piece of information.
]
Signed-off-by: Jan Beulich <jbeulich@novell.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>

The Linux kernel currently does not clear the direction flag before
calling a signal handler, whereas the x86/x86-64 ABI requires that.

Linux had this behavior/bug forever, but this becomes a real problem
with gcc version 4.3, which assumes that the direction flag is
correctly cleared at the entry of a function.

This patches changes the setup_frame() functions to clear the
direction before entering the signal handler.
Signed-off-by: Aurelien Jarno <aurelien@aurel32.net>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Acked-by: H. Peter Anvin <hpa@zytor.com>

* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6.25:
  sh: Fix up the sh64 build.
  sh: Fix up SH7710 VoIP-GW build.
  sh: Flag PMB support as EXPERIMENTAL.
  sh: Update r7780mp defconfig.
  fb: hitfb: Balance probe/remove section annotations.
  sh: hp6xx: Fix up hp6xx_apm build failure.
  fb: pvr2fb: Fix up remaining section mismatch.
  sh: Fix up section mismatches.
  sh: hp6xx: Correct APM output.
  sh: update se7780 defconfig
  sh: replace remaining __FUNCTION__ occurrences
  sh: export copy-page() to modules
  sh_ksyms_32.c update for gcc 4.3
  sh/mm/pg-sh7705.c must #include <linux/fs.h>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/blackfin-2.6:
  [Blackfin] arch: current_l1_stack_save is a pointer, so use NULL rather than 0
  [Blackfin] arch: fix atomic and32/xor32 comments and ENDPROC markings
  [Blackfin] arch: fix bug - allow SDH driver to be used as module
  [Blackfin] arch: to kill syscalls missing warning by adding new timerfd syscalls

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  [IA64] kprobes arch consolidation build fix
  [IA64] update efi region debugging to use MB, GB and TB as well as KB
  [IA64] use dev_printk in video quirk
  [IA64] remove remaining __FUNCTION__ occurrences
  [IA64] remove unnecessary nfs includes from sys_ia32.c
  [IA64] remove CONFIG_SMP ifdef in ia64_send_ipi()
  [IA64] arch_ptrace() cleanup
  [IA64] remove duplicate code from arch_ptrace()
  [IA64] convert sys_ptrace to arch_ptrace
  [IA64] remove find_thread_for_addr()
  [IA64] do not sync RBS when changing PT_AR_BSP or PT_CFM
  [IA64] access user RBS directly

ia64 named their handler kprobes_fault_handler while all other
arches used kprobe_fault_handler.  Change the function definition
and header declaration.
Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

When EFI_DEBUG is defined to a non-zero value in arch/ia64/kernel/efi.c,
the efi memory regions are displayed. This patch enhances the
display code in a few ways:

1. Use TB, GB and MB as well as KB as units.
   Although this introduces rounding errors (KB doesn't as
   size is always a multiple of 4Kb), it does make
   things a lot more readable.

   Also as the range is also shown, it is possible to note the exact size
   if it is important. In my experience, the size field is mostly useful
   for getting a general idea of the size of a region.

   On the rx2620 that I use, there actually is an 8TB region (though not
   backed by physical memory, and 8TB really is a lot more readable than
   8589934592KB.

2. pad the size field with leading spaces to further improve readability

   ...
   ... (   8MB)
   ... ( 928MB)
   ... (   3MB)
   ...

   vs

   ...
   ... (8MB)
   ... (928MB)
   ... (3MB)
   ...

3. Pad the attr field out to 64bits using leading zeros,
   to further improve readability.

   ...
   mem05: type= 2, attr=0x0000000000000008, range=[0x0000000004000000-0x000000000481f000) (   8MB)
   mem06: type= 7, attr=0x0000000000000008, range=[0x000000000481f000-0x000000003e876000) ( 928MB)
   mem07: type= 5, attr=0x8000000000000008, range=[0x000000003e876000-0x000000003eb8e000) (   3MB)
   mem08: type= 4, attr=0x0000000000000008, range=[0x000000003eb8e000-0x000000003ee7a000) (   2MB)
   ...

   ...
   mem05: type= 2, attr=0x8, range=[0x0000000004000000-0x000000000481f000) (   8MB)
   mem06: type= 7, attr=0x8, range=[0x000000000481f000-0x000000003e876000) ( 928MB)
   mem07: type= 5, attr=0x8000000000000008, range=[0x000000003e876000-0x000000003eb8e000) (   3MB)
   mem08: type= 4, attr=0x8, range=[0x000000003eb8e000-0x000000003ee7a000) (   2MB)
   ...

4. Use %d instead of %u for the index field, as i is a signed int.

N.B: This code is not compiled unless EFI_DEBUG is non 0.
Signed-off-by: Simon Horman <horms@verge.net.au>
Signed-off-by: Tony Luck <tony.luck@intel.com>

Convert quirk printks to dev_printk().
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

__FUNCTION__ is gcc-specific, use __func__

Long lines have been kept where they exist, some small spacing changes
have been done.
Signed-off-by: Harvey Harrison <harvey.harrison@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Tony Luck <tony.luck@intel.com>

Compilation of 2.6.25-rc2-mm1 on ia64 generates many warnings.

IA64 support 2 ELF format (IA64 binary and IA32 binary),
thus if 2 elf related header included, cause many warning or error.

about 2 week ago, J. Bruce Fields proposed this problem fixed patch.
(http://marc.info/?l=linux-ia64&m=120329313305695&w=2)
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Tony Luck <tony.luck@intel.com>

When !CONFIG_SMP, cpu_physical_id() is ia64_get_lid(), which is
functionally identical to

    (ia64_getreg(_IA64_REG_CR_LID) >> 16) & 0xffff

so there's no need for two versions of this code.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  [CRYPTO] xcbc: Fix crash with IPsec
  [CRYPTO] xts: Use proper alignment
  [CRYPTO] digest: Include internal.h for prototypes
  [CRYPTO] authenc: Add missing Kconfig dependency on BLKCIPHER
  [CRYPTO] skcipher: Move chainiv/seqiv into crypto_blkcipher module

* 'for-linus' of git://oss.sgi.com:8090/xfs/xfs-2.6:
  [XFS] fix inode leak in xfs_iget_core()
  [XFS] 977545 977545 977545 977545 977545 977545 xfsaild causing too many

Commit ed7b1889 removed page.h from
include/asm-generic/Kbuild so that it shouldn't get exported.

However, it was redundantly listed in asm-mn10300/Kbuild and
asm-x86/Kbuild too. Remove those as well, so it really stops being
exported on those architectures. Also remove the redundant listing of
ptrace.h and termios.h from mn10300.
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

When using aes-xcbc-mac for authentication in IPsec, 
the kernel crashes. It seems this algorithm doesn't 
account for the space IPsec may make in scatterlist for authtag.
Thus when crypto_xcbc_digest_update2() gets called,
nbytes may be less than sg[i].length. 
Since nbytes is an unsigned number, it wraps
at the end of the loop allowing us to go back 
into loop and causing crash in memcpy.

I used update function in digest.c to model this fix.
Please let me know if it looks ok.
Signed-off-by: Joy Latten <latten@austin.ibm.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

The XTS blockmode uses a copy of the IV which is saved on the stack
and may or may not be properly aligned. If it is not, it will break
hardware cipher like the geode or padlock.
This patch encrypts the IV in place so we don't have to worry about
alignment.
Signed-off-by: Sebastian Siewior <sebastian@breakpoint.cc>
Tested-by: Stefan Hellermann <stefan@the2masters.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Signed-off-by: Paul Mundt <lethal@linux-sh.org>

The only board-specific bits that existed here were for setting up the
IRQs, which are now handled by the SH7710 CPU support code instead. As
there's nothing else to do for setup, kill off the board support code
and have the defconfig use the generic machvec instead.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

There's still work that needs to be done here, and this should not be
enabled by default on existing boards.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

This disables the PMB/32BIT=y by default in r7780mp, as turning this on
presently results in build errors (for an admittedly experimental
feature).
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

If the radix_tree_preload() fails, we need to destroy the inode we just
read in before trying again. This could leak xfs_vnode structures when
there is memory pressure. Noticed by Christoph Hellwig.

SGI-PV: 977823
SGI-Modid: xfs-linux-melb:xfs-kern:30606a
Signed-off-by: David Chinner <dgc@sgi.com>
Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>
Signed-off-by: Christoph Hellwig <hch@infradead.org>

wakeups

Idle state is not being detected properly by the xfsaild push code. The
current idle state is detected by an empty list which may never happen
with mostly idle filesystem or one using lazy superblock counters. A
single dirty item in the list that exists beyond the push target can
result repeated looping attempting to push up to the target because it
fails to check if the push target has been acheived or not.

Fix by considering a dirty list with everything past the target as an idle
state and set the timeout appropriately.

SGI-PV: 977545
SGI-Modid: xfs-linux-melb:xfs-kern:30532a
Signed-off-by: David Chinner <dgc@sgi.com>
Signed-off-by: Christoph Hellwig <hch@infradead.org>
Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>