* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6:
  JFS: pageno needs to be long

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [PKT_SCHED] netem: Orphan SKB when adding to queue.
  [NET]: kernel-doc fix for sock.h
  [NET]: Reduce sizeof(struct flowi) by 20 bytes.
  [IPv6] fib: initialize tb6_lock in common place to give lockdep a key
  [ATM] nicstar: Fix a bogus casting warning
  [ATM] firestream: handle thrown error
  [ATM]: No need to return void
  [ATM]: handle sysfs errors
  [DCCP] ipv6: Fix opt_skb leak.
  [DCCP]: Fix Oops in DCCPv6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/sparc-2.6:
  [SPARC64]: 8-byte align return value from compat_alloc_user_space()

* master.kernel.org:/pub/scm/linux/kernel/git/lethal/sh-2.6:
  sh: Convert INTC2 to IRQ table registration.
  sh: Updates for irq-flow-type naming changes.
  sh: Add some missing board headers.
  sh: Fix exception_handling_table alignment.
  sh: Cleanup board header directories.
  sh: Remove board-specific ide.h headers.
  sh: Proper show_stack/show_trace() implementation.

Otherwise we get a ton of unaligned exceptions, for cases such
as compat_sys_msgrcv() which go:

	p = compat_alloc_user_space(second + sizeof(struct msgbuf));

and here 'second' can for example be an arbitrary odd value.

Based upon a bug report from Jurij Smakov.
Signed-off-by: David S. Miller <davem@davemloft.net>

The networking emulator can queue SKBs for a very long
time, so if you're using netem on the sender side for
large bandwidth/delay product testing, the SKB socket
send queue sizes become artificially larger.

Correct this by calling skb_orphan() in netem_enqueue().
Signed-off-by: David S. Miller <davem@davemloft.net>

Fix kernel-doc warning in include/net/sock.h:
Warning(/var/linsrc/linux-2619-rc1-pv//include/net/sock.h:894): No description found for parameter 'rcu'
Signed-off-by: Randy Dunlap <rdunlap@xenotime.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

As suggested by David, just kill off some unused fields in dnports to
reduce sizef(struct flowi). If they come back, they should be moved to
nl_u.dn_u in order not to enlarge again struct flowi

[ Modified to really delete this stuff instead of using #if 0. -DaveM ]
Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>

Not enough to make Nicstar 64bit friendly but got squashed in passing so might
as well be applied
Signed-off-by: Alan Cox <alan@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

gcc emits the following warning:

drivers/atm/firestream.c: In function ‘fs_open’:
drivers/atm/firestream.c:870: warning: ‘tmc0’ may be used uninitialized in this function

This indicates a real bug.  We should check make_rate() return value for
potential errors.
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

The module_exit function has return-type void and pci_unregister_driver()
returns void anyway.
Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Based upon a patch from Jesper Juhl.  Try to match the
TCP IPv6 code this was copied from as much as possible,
so that it's easy to see where to add the ipv6 pktoptions
support code.
Signed-off-by: David S. Miller <davem@davemloft.net>

I think I got the cause for the Oops observed in
http://www.mail-archive.com/dccp@vger.kernel.org/msg00578.html

The problem is always with applications listening on PF_INET6 sockets. Apart
from the mentioned oops, I observed another one one, triggered at irregular
intervals via timer interrupt:

    run_timer_softirq -> dccp_keepalive_timer
                      -> inet_csk_reqsk_queue_prune
                      -> reqsk_free
                      -> dccp_v6_reqsk_destructor

The latter function is the problem and is also the last function to be called
in said kernel panic.

In any case, there is a real problem with allocating the right request_sock
which is what this patch tackles.

It fixes the following problem:
 - application listens on PF_INET6
 - DCCPv4 packet comes in, is handed over to dccp_v4_do_rcv, from there
   to dccp_v4_conn_request

Now: socket is PF_INET6, packet is IPv4. The following code then furnishes the
connection with IPv6 - request_sock operations:

   req = reqsk_alloc(sk->sk_prot->rsk_prot);

The first problem is that all further incoming packets will get a Reset since
the connection can not be looked up.

The second problem is worse:
 --> reqsk_alloc is called instead of inet6_reqsk_alloc
 --> consequently inet6_rsk_offset is never set (dangling pointer)
 --> the request_sock_ops are nevertheless still dccp6_request_ops
 --> destructor is called via reqsk_free
 --> dccp_v6_reqsk_destructor tries to free random memory location (inet6_rsk_offset not set)
 --> panic

I have tested this for a while, DCCP sockets are now handled correctly in all
three scenarios (v4/v6 only/v4-mapped).

Commiter note: I've added the dccp_request_sock_ops forward declaration to keep
               the tree building and to reduce the size of the patch for 2.6.19,
               later I'll move the functions to the top of the affected source
               code to match what we have in the TCP counterpart, where this
               problem hasn't existed in the first place, dumb me not to have
               done the same thing on DCCP land 8)
Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: Arnaldo Carvalho de Melo <acme@mandriva.com>

* 'for-linus' of git://one.firstfloor.org/home/andi/git/linux-2.6:
  [PATCH] x86-64: increase PHB1 split transaction timeout
  [PATCH] x86-64: Fix C3 timer test

This patch increases the timeout for PCI split transactions on PHB1 on
the first Calgary to work around an issue with the aic94xx
adapter. Fixes kernel.org bugzilla #7180
(http://bugzilla.kernel.org/show_bug.cgi?id=7180)

Based on excellent debugging and a patch by Darrick J. Wong
<djwong@us.ibm.com>
Signed-off-by: Muli Ben-Yehuda <muli@il.ibm.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Andi Kleen <ak@suse.de>
Acked-by: Darrick J. Wong <djwong@us.ibm.com>

There was a typo in the C3 latency test to decide of the TSC
should be used or not. It used the C2 latency threshold, not the
C3 one. Fix that.

This should fix the time on various dual core laptops.
Signed-off-by: Andi Kleen <ak@suse.de>

The current implementation uses a sequence of a cacheflush and a copy.
This is racy in case of a multithreaded debuggee and renders GDB
virtually unusable.

Aside this fixes a performance hog rendering access to /proc/cmdline very
slow and resulting in a enough cache stalls for the 34K AP/SP programming
model to make the bare metal code on the non-Linux VPE miss RT deadlines.

The main part of this patch was originally written by Ralf Baechle;
Atushi Nemoto did the the debugging.
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Noticed by Samium Gromoff but his patch got stale in flight ...
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  [PATCH] libata-sff: Allow for wacky systems
  [PATCH] ahci: readability tweak
  [PATCH] libata: typo fix
  [PATCH] ATA must depend on BLOCK
  [PATCH] libata: use correct map_db values for ICH8

* 'upstream-linus' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6: (22 commits)
  [PATCH] ibmveth: Fix index increment calculation
  [PATCH] Fix timer race
  [PATCH] Remove useless comment from sb1250
  [PATCH] ucc_geth: changes to ucc_geth driver as a result of qe_lib changes and bugfixes
  [PATCH] sky2: 88E803X transmit lockup
  [PATCH] e1000: Reset all functions after a PCI error
  [PATCH] WAN/pc300: handle, propagate minor errors
  [PATCH] Update smc91x driver with ARM Versatile board info
  [PATCH] wireless: WE-20 compatibility for ESSID and NICKN ioctls
  [PATCH] zd1211rw: fix build-break caused by association race fix
  [PATCH] sotftmac: fix a slab corruption in WEP restricted key association
  [PATCH] airo: check if need to freeze
  [PATCH] wireless: More WE-21 potential overflows...
  [PATCH] zd1201: Possible NULL dereference
  [PATCH] orinoco: fix WE-21 buffer overflow
  [PATCH] airo.c: check returned values
  [PATCH] bcm43xx-softmac: Fix system hang for x86-64 with >1GB RAM
  [PATCH] bcm43xx-softmac: check returned value from pci_enable_device
  [PATCH] softmac: Fix WX and association related races
  [PATCH] bcm43xx: fix race condition in periodic work handler
  ...

* master.kernel.org:/pub/scm/linux/kernel/git/davej/agpgart:
  [AGPGART] uninorth: Add module param 'aperture' for aperture size

* 'for-linus' of git://one.firstfloor.org/home/andi/git/linux-2.6:
  [PATCH] x86-64: Revert timer routing behaviour back to 2.6.16 state
  [PATCH] x86-64: Overlapping program headers in physical addr space fix
  [PATCH] x86-64: Put more than one cpu in TARGET_CPUS
  [PATCH] x86: Revert new unwind kernel stack termination
  [PATCH] x86-64: Use irq_domain in ioapic_retrigger_irq
  [PATCH] i386: Disable nmi watchdog on all ThinkPads
  [PATCH] x86-64: Revert interrupt backlink changes
  [PATCH] x86-64: Fix ENOSYS in system call tracing
  [PATCH] i386: Fix fake return address
  [PATCH] x86-64: x86_64 add NX mask for PTE entry
  [PATCH] x86-64: Speed up dwarf2 unwinder
  [PATCH] x86: Use -maccumulate-outgoing-args
  [PATCH] x86-64: fix page align in e820 allocator
  [PATCH] x86-64: Fix for arch/x86_64/pci/Makefile CFLAGS
  [PATCH] i386: fix .cfi_signal_frame copy-n-paste error
  [PATCH] x86-64: typo in __assign_irq_vector when updating pos for vector and offset
  [PATCH] x86-64: x86_64 hot-add memory srat.c fix
  [PATCH] i386: Update defconfig
  [PATCH] x86-64: Update defconfig

If someone has renamed a directory on the server, triggering the d_move
code in d_materialise_unique(), then we need to invalidate the cached
directory information in the source parent directory.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Maneesh Soni <maneesh@in.ibm.com>
Cc: Dipankar Sarma <dipankar@in.ibm.com>
Cc: Neil Brown <neilb@cse.unsw.edu.au>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

If the caller tries to instantiate a directory using an inode that already
has a dentry alias, then we attempt to rename the existing dentry instead
of instantiating a new one.  Fail with an ELOOP error if the rename would
affect one of our parent directories.

This behaviour is needed in order to avoid issues such as

  http://bugzilla.kernel.org/show_bug.cgi?id=7178Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: Maneesh Soni <maneesh@in.ibm.com>
Cc: Dipankar Sarma <dipankar@in.ibm.com>
Cc: Neil Brown <neilb@cse.unsw.edu.au>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

CCISS was producing warnings about shifts being greater than the size of
the type and pointers being of incompatible type.  Turns out this is
because it's calling do_div on a 32-bit quantity.  Upon further
investigation, the sector_t total_size is being assigned to an int, and
then we're calling do_div on that int.  Obviously, sector_div is called for
here, and I took the chance to refactor the code a little.
Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Acked-by: Mike Miller <mike.miller@hp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Just like everyone else.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Markus Lidel <Markus.Lidel@shadowconnect.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Mistyped an ifdef CONFIG_CPUSETS - fixed.

I doubt that anyone ever noticed.  The impact of this typo was
that if someone:
 1) was using MPOL_BIND to force off node allocations
 2) while using cpusets to constrain memory placement
 3) when that cpuset was migrating that jobs memory
 4) while the tasks in that job were actively forking
then there was a rare chance that future allocations using
that MPOL_BIND policy would be node local, not off node.
Signed-off-by: Paul Jackson <pj@sgi.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The zonelist may contain zones of nodes that have not been bootstrapped and
we will oops if we try to allocate from those zones.  So check if the node
information for the slab and the node have been setup before attempting an
allocation.  If it has not been setup then skip that zone.

Usually we will not encounter this situation since the slab bootstrap code
avoids falling back before we have setup the respective nodes but we seem
to have a special needs for pppc.
Signed-off-by: Christoph Lameter <clameter@sgi.com>
Acked-by: Andy Whitcroft <apw@shadowen.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Mike Kravetz <kravetz@us.ibm.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Mel Gorman <mel@csn.ul.ie>
Acked-by: Will Schmidt <will_schmidt@vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Reintroduce NODES_SPAN_OTHER_NODES for powerpc

Revert "[PATCH] Remove SPAN_OTHER_NODES config definition"
    This reverts commit f62859bb.
Revert "[PATCH] mm: remove arch independent NODES_SPAN_OTHER_NODES"
    This reverts commit a94b3ab7.

Also update the comments to indicate that this is still required
and where its used.
Signed-off-by: Andy Whitcroft <apw@shadowen.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Mike Kravetz <kravetz@us.ibm.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Acked-by: Mel Gorman <mel@csn.ul.ie>
Acked-by: Will Schmidt <will_schmidt@vnet.ibm.com>
Cc: Christoph Lameter <clameter@sgi.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The recent commit 751ae21c introduced a bug
in the producer/consumer index calculation in the ibmveth driver -
incautious use of the post-increment ++ operator resulted in an increment
being immediately reverted.  This patch corrects the logic.

Without this patch, the driver oopses almost immediately after activation
on at least some machines.
Signed-off-by: David Gibson <dwg@au1.ibm.com>
Acked-by: Santiago Leon <santil@us.ibm.com>
Cc: Jeff Garzik <jeff@garzik.org>
Cc: Martin Schwidefsky <schwidefsky@de.ibm.com>
Cc: Andy Whitcroft <apw@shadowen.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

We seem to have lost the declaration of pci_get_device_reverse(), if we ever
had one.

Add a CONFIG_PCI=0 stub too.
Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Greg KH <greg@kroah.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

I have an acpi_pm that goes backwards, but it's not intel.  I tested the
verified read and my acpi_pm started to function properly.  So I added it
to the greylist.  I'm assuming that's the right spot.

I also added an unlikely() to the while, cause it seems appropriate.
Signed-off-by: Daniel Walker <dwalker@mvista.com>
Acked-by: John Stultz <johnstul@us.ibm.com>
Acked-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

And a couple of bug fixes found by sparse.
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Includes a couple of bugfixes found by sparse.
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

..  so that you can use bitmaps with 32bit userspace on a 64 bit kernel.
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Two less-used md personalities have bugs in the calculation of ->degraded (the
extent to which the array is degraded).
Signed-off-by: Neil Brown <neilb@suse.de>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The change from __setup() to module_param_named() requires users to prefix
the option with "generic.".

This patch re-adds the __setup() additionally to the module_param_named().

Usually it would make sense getting rid of such an obsolete __setup() at
some time, but considering that drivers/ide/ is slowly approaching a RIP
status it's already implicitely scheduled for removal.

This patch fixes kernel Bugzilla #7353.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Commits 881a8c12 and
efe1ec27 corrects pci device matching in
only one way; it no longer oopses/crashes, despite hotplug is not solved
in these changes.

Whenever pci_find_device -> pci_get_device change is performed, also
pci_dev_get and pci_dev_put should be in most cases called to properly
handle hotplug.  This patch does exactly this thing -- increase refcount
to let kernel know, that we are using this piece of HW just now.

It affects moxa and rio char drivers.

Cc: <R.E.Wolff@BitWizard.nl>
Acked-by: Amit Gud <gud@eth.net>
Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
Acked-by: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>