into ppc970.osdl.org:/home/torvalds/v2.6/linux

Patch from Pierre Ossman

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Fix a pretty bad bug that caused sometimes signals on x86-64
to be restarted like system calls. This corrupted the RIP and
in general caused undesirable effects.

The problem happens because orig_rax is unsigned on x86-64,
but it originally was signed when the signal code was written.
And the if (orig_rax >= 0) ended up always true.
And gcc didn't warn about this, because the warning is only in 
-Wextra. 

In 2.4 we still had a cast for it, but somehow it got dropped
in 2.5.

Credit goes to John Slice for tracking it down and Erich Boleyn
for the original fix. All blame to me. I fixed it at another
place too.
Signed-off-by: Andi Kleen <ak@suse.de>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This should go in before 2.6.10. It fixes a forgotten case to provide
police backward compatibility statistics for old iproute2 versions
running on a new kernel with actions enabled. Should make distributions
happy with older iproute2 versions and all-included kernel configs
since they probably favour actions over plain policer.

Testing results:
  iproute2-2.4.7 on 2.6.10-rc3-bk8:
  cls-police: police creation succeeded
  cls-police: Sending 10 ICMP echo requests
  cls-police: police dumping succeeded with output:
  filter protocol ip pref 10 u32 
  filter protocol ip pref 10 u32 fh 800: ht divisor 1 
  filter protocol ip pref 10 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 10:12 
  police 3 action drop rate 2Kbit burst 10Kb mtu 2Kb 
    match 00010000/00ff0000 at 8
   Sent 420 bytes 10 pkts (dropped 0, overlimits 0)  <-- This would have been missing
  cls-police: police deletion succeeded

 iproute2-2.6.9 on 2.6.10-rc3-bk8:
 ...
  filter protocol ip pref 10 u32 
  filter protocol ip pref 10 u32 fh 800: ht divisor 1 
  filter protocol ip pref 10 u32 fh 800::800 order 2048 key ht 800 bkt 0 flowid 10:12  (rule hit 10 success 10)
    match 00010000/00ff0000 at 8 (success 10 ) 
   police 0x4 rate 2000bit burst 10Kb mtu 2Kb action drop 
  ref 1 bind 1
   Sent 420 bytes 10 pkts (dropped 0, overlimits 0) 
 ...

 (Same results for fw classifier)
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>

tcindex's destroy uses its own delete functions to destroy its
configuration. The delete function (correctly) takes the qdisc_tree_lock
to prevent list walkings from happening while removing from the list.
The qdisc_tree_lock is already held if we're comming via the destroy
path and thus a double locking takes place.
Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

This fixes a memory leak where the percpu internal structure is not freed. 
Repeated add/remove device illustrates the leak nicely.
Signed-off-by: Philip R. Auld <pauld@egenera.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

cdrom_read_toc (ide-cd.c) always reads the TOC using MSF format.  If the
last session of the disk starts beyond block 1152000 (LBA) there's an
overflow in the MSF format and kernel complains:

Unable to identify CD-ROM format.

I reported this bug a while ago (see bug #1930 on bugzilla) and Andy
Polyakov tracked it down.

Read the multi-session TOC in LBA format in order to avoid an overflow
in MSF format when the last session starts beyond block 1152000 (LBA).
Signed-off-by: Luca Tettamanti <kronos@kronoz.cjb.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

There is a race condition int pty.c when pty_close wakes up waiter on its
pair device before set TTY_OTHER_CLOSED flag.

It is possible on SMP or preempt kernel, waiter wakes up too early that it
will not get TTY_OTHER_CLOSED flag then fall into sleep again - missed wakeup.

hjl reports that this bug will hang some expect scripts on SMP machines.
Signed-off-by: Zou Nan hai <Nanhai.zou@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Patch from Nicolas Pitre

... also remove an unused variable warning.

Signed-off-by: Nicolas Pitre
Signed-off-by: Russell King

Addresses bug #3863, from <daveh@dmh2000.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The aty128fb driver in 2.6.10-rc3 tries to release an unrequested range
during driver unload.  This results in the following printout on my Apple
G4 Cube:

Trying to free nonexistent resource <00802400-008024ff>

The remedy is simple - do not release the unrequested range.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Some users have reported problems with the I2O subsystem, which was
caused by the timeout to fetch the LCT.

- increases the timeout for I2O LCT_GET.  On some systems the time to get
  a reply from the I2O controller is longer then the timeout to wait.
Signed-off-by: Markus Lidel <Markus.Lidel@shadowconnect.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This is the third of 3 patches from David Woodhouse which fix various
problems with signal handling on ppc64.

At present, if a signal is being delivered, and the process has specified
delivery of that signal on an alternate stack but the alternate stack that
has been specified is invalid (i.e.  the kernel gets a fault writing to the
alternate stack), then we (correctly) give the process a SIGSEGV but we put
the wrong signal mask in the saved state on the stack - i.e.  we put the
mask that would have been established for the original signal handler
there.

This patch fixes it by making setup_rt_frame, handle_rt_signal32 and
handle_signal32 return a status code to indicate whether they successfully
established a stack frame.  If they fail, the caller doesn't block the
signals specified for the signal handler.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This is the second of 3 patches from David Woodhouse which fix various
problems with signal handling on ppc64.

The problem that this patch fixes is that a process being single-stepped
will execute one instruction too many in certain cases: when a signal is
delivered, when a signal handler returns, and when a system call
instruction is single-stepped.  This patch fixes it by checking if the
process is being single-stepped in the syscall exit path and on signal
delivery, and stopping it if so.  To avoid slowing down the syscall exit
path in the normal case, we use a bit in the thread_info flags, which can
be tested along with the other bits we already test in the syscall exit
path.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This is the first of 3 patches from David Woodhouse which fix various
problems with signal handling on ppc64.  (This is David's patch plus a
couple of comment fixes from me.)

Without this patch, a signal handler that is called as a result of delivery
of a signal while a process is waiting in sigsuspend() will have wrong
values given to it for the second and third arguments.  The reason is that
we were returning to userspace via the syscall return path, which doesn't
bother to restore r4 and r5.  This patch arranges for the return to
userspace to be done via ret_from_except in this case, which restores all
registers.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Gerald Schaefer <geraldsc@de.ibm.com>

 - Remove ESPIPE logic, use nonseekable_open() instead.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Gerald Schaefer <geraldsc@de.ibm.com>

 - Use nonseekable_open() to disable seeking and pread()/pwrite().
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Olaf Hering <olh@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Klaus Dittrich observed this bug and posted a test case for it.

This patch fixes both that failure mode and some others possible.  What
Klaus saw was a false negative (i.e.  ECHILD when there was a child)
when the group leader was a zombie but delayed because other children
live; in the test program this happens in a race between the two threads
dying on a signal.

The change to the TASK_TRACED case avoids a potential false positive
(blocking, or WNOHANG returning 0, when there are really no children
left), in the race condition where my_ptrace_child returns zero.
Signed-off-by: Roland McGrath <roland@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Don't try autosuspend if we think the hardware won't resume correctly
from the OHCI suspend state.  This makes the RWC bit serve double duty,
but that appears to work OK, and the only penalty is increased power
consumption (from OHCI clocks) on boards/chips that don't work right.

For example, the amd756 erratum 4 workaround needs this logic; and at
least one ServerWorks box issues spurious resume IRQs (~3x/second!)
in the suspend state.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch fixes a bug in the usbfs code.  The driver is too zealous about
checking for disconnected devices before doing things.  In particular, it
is necessary to reap all outstanding asynchronous URBs and unbind from
interfaces when the device file is closed, even if the device is no longer
connected.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Patch from Richard Purdie

The base PCMCIA code for PXA2xx doesn't work over a suspend/resume 
cycle as the MECR register isn't preserved. This patch restores 
the register.

Signed-off-by: Richard Purdie
Signed-off-by: Russell King

Patch from Catalin Marinas

The CType field in the cache type CP15 register does not always
specify whether the cache is VIVT or VIPT. The dump_cpu_info()
function should use the cache_is_(vivt|vipt) macros instead.

Signed-off-by: Catalin Marinas
Signed-off-by: Russell King

Patch from Catalin Marinas

The CPU Id register changed with the ARM1176 processor and the
ARMv6 architecture description field can be either 7 or 0xF.
This patch also detects the first byte of the part number since
0xF in the description field will also be used for future ARM
architectures.

Signed-off-by: Catalin Marinas
Signed-off-by: Russell King

Patch from Deepak Saxena

Add support for Intel's new IXP46x CPU family.

Signed-off-by: Deepak Saxena
Signed-off-by: Russell King

Patch from Catalin Marinas

CONFIG_FPE_NWFPE was enabled and CONFIG_FPE_FASTFPE disabled in the
(integrator|versatile)_defconfig files because the latter is only
available as a separate patch.

Signed-off-by: Catalin Marinas
Signed-off-by: Russell King

Patch from Dave Jiang

Update all IOP def configs to utilize the MTD physmap driver instead of IOP specific MTD maps driver.

Signed-off-by: Dave Jiang
Signed-off-by: Russell King

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Here is trivial patch to enable the early console setup for UP as well.
Tested on zx1.
Signed-off-by: David Mosberger-Tang <davidm@hpl.hp.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

into intel.com:/data/home/aegl/BK/linux-ia64-release-2.6.10

Signed-off-by: Matthew Wilcox <matthew@wil.cx>
Signed-off-by: Tony Luck <tony.luck@intel.com>

into bkbits.net:/repos/c/cifs/linux-2.5cifs

Error mapping workaround for NT4 bug of reporting oldstyle DOS error for ERR invalid level (shows up on attempts to do SetPathInfo to NT4).
Call posix_lock_wait to avoid fs/locks.c panic per Trond's suggestion

Signed-off-by: Steve French (sfrench@us.ibm.com)

Patch from Dave Jiang

remove iop331-mm.c in arch/arm/mach-iop3xx

Signed-off-by: Dave Jiang
Signed-off-by: Russell King

Patch from Catalin Marinas

The Versatile/AB platform is defined as a MACH (not ARCH) in the
arch/arm/tools/mach-types file.

Signed-off-by: Catalin Marinas
Signed-off-by: Russell King