From: john stultz <johnstul@us.ibm.com>

I've found a race in the mtrr ipi_handler() and set_mtrr() functions.

Basically the server, set_mtrr() does the following:

  1.1 initialize a flag
  1.2 send ipi
  1.3 waits for all cpus to check in
  1.4 toggle flag
  1.5 do stuff
  1.6 wait for all cpus to check out
  1.7 toggle flag again
  1.8 return

While the clients, running ipi_handler() do the following:

  2.1 check in
  2.2 wait for flag
  2.3 do stuff
  2.4 check out
  2.5 wait for flag
  2.6 return

The problem is the flag is on the servers stack! So if 1.7 and 1.8
executes before 2.5 happens, the client's pointer to the flag becomes
invalid (likely overwritten) which causes the client to never see the
flag change, hanging the box.

The patch fixes that by adding a final synchronisation step in which the
controlling CPU waits for all the IPI'ed CPUs to complete.

From: Martin Pool <mbp@samba.org>

ia64_mv_irq_desc returns a 'struct irq_desc', which had a forward declaration
but did not actually exist.  We're currently using a silly anonymous struct
typedefed to irq_desc_t.

Now add the structure name as well.

Teach journal_get_write_access() and journal_get_undo_access() to handle
aborted trasaction handles.

From: george anzinger <george@mvista.com>

a) Fixes bug 858 (http://bugme.osdl.org/show_bug.cgi?id=858)

   The problem was caused by round off error in calculating the correct
   jiffies value in micro seconds to do the round up to jiffies.  The fix
   is to do the round up AFTER conversion to jiffies, rather than before.
   This only affected the timeval to jiffies calculation.

b) Changed the scale values to get the highest possible precision short
   of going to full 64-bit math.  This is particularly useful in the
   scaling of the seconds part of time.  The code now computes a trial
   value at compile time and adjusts the scaling if the result is less than
   32 bits.

c) Adds comments to time.h to remove (I hope) ALL the confusion that
   this file use to generate.

From: Peter Chubb <peterc@gelato.unsw.edu.au>

Currently, do_setitimer() is used in several files, but doesn't appear
in any header.  Thus its declaration is repeated in some files, and
its use causes a warning in others (because there is no declaration
present).

This patch:
     -- adds a couple of declarations to linux/times.h
     -- removes the (now duplicate) declarations from other files.

From: Ville Herva <vherva@niksula.hut.fi>

NMI watchdog is nowadays supported on x86-64, too. The nmi-watchdog.txt
document doesn't mention this. Here is a patch to add a few words on that.

From: jbarnes@sgi.com (Jesse Barnes)

Currently, free_all_bootmem_core() assumes that the bdata for a given
node will begin where the node's memory map begins.  This isn't
necessarily true on machines that use a virtual memory map (e.g. ia64
discontig machines), so we fix page to point to the first actual page of
RAM on the node, which _does_ contain the bdata struct.

From: jbarnes@sgi.com (Jesse Barnes)

hwgfs needs lookup_create(), and intermezzo already has copied it.

Document it, export it to modules and fix intermezzo.

From: Andi Kleen <ak@muc.de>

In some cases panic can be called with interrupts off.  Don't trigger the
NMI watchdog in this case when a panic= parameter is specified.

From: Matt Mackall <mpm@selenic.com>

This only checks in the non-__ versions, as those are occassionally
called inside things like kmap_atomic pairs which take a spinlock in
with highmem. It's all conditional on CONFIG_DEBUG_SPINLOCK_SLEEP
(which isn't quite the right name) so there's no overhead for normal
builds.

cdrom_decode_status() can call cdrom_end_request() twice.  The second call
oopses because the first call destroyed the request.

Fix it to only call cdrom_end_request() once.

Jens has acked this change.

move_one_page() is awkward.  It grabs an atomic_kmap of the source pte
(because it needs to know if there's really a page there) and then it needs
to allocate a pte for the dest.  But it cannot allocate the dest pte while
holding the src's atomic kmap.

So it performs this little dance peeking at pagetables to predict if
alloc_one_pte_map() might need to perform a pte page allocation.

When I wrote this code I made it conditional on CONFIG_HIGHPTE.  But that was
bogus: even in the !CONFIG_HIGHPTE case, get_one_pte_map_nested() will run
atomic_kmap() against the pte page, which disables preemption.

Net effect: with CONFIG_HIGHMEM && !CONFIG_HIGHPTE we can end up performing a
GFP_KERNEL pte page allocation while preemption is disabled.  It triggers a
might_sleep() warning and indeed is buggy.

So the patch removes the conditionality: even in the !CONFIG_HIGHPTE case we
still do the pagetable peek and drop the kmap if necessary.

(Arguably, we shouldn't be performing the atomic_kmap() at all if
!CONFIG_HIGHPTE: all it does is a pointless preemption disable).

(Arguably, kmap_atomic() should not be disabling preemption if the target
page is not highmem.  But we're doing it anyway at present for consistency
(ie: debug coverage) and because the filemap.c pagecache copying functions
rely on kmap_atomic() disabling do_no_page() for all pages: see
do_no_page()'s use of in_atomic()).

The new emergency remount path forgot to take lock_kernel(), which is
required for ->remount_fs().

From: Oleg Drokin <green@namesys.com>

This patch (originally by Chris Mason) fixes link/unlink races in reiserfs.

From: Oleg Drokin <green@namesys.com>

This patch fixes various bad stuff that happens when you write to full or
almost full reiserfs filesystem.

From: Oleg Drokin <green@namesys.com>

This small patch fixes a savelinks problem on bigendian platforms, where
savelinks were not working at all because of incorrect cpu->disk endianness
conversion.

Savelinks are used on reiserfs to remember "truncate" and "unlink" events
so that if crash happens in the middle of truncate/unlink, we do not endup
with lost or half truncated files.

From: Joe Thornber <thornber@sistina.com>

Some architectures define an extern function called resume(), which
clashes with a static function in dm-ioctl-v4.c.  Rename static one to
do_resume().

From: Joe Thornber <thornber@sistina.com>

Use sector_div() rather than defining own version.  [Christophe Saout]

From: Joe Thornber <thornber@sistina.com>

Missing #include

From: Joe Thornber <thornber@sistina.com>

Update the ioctl32 handlers for the 64-bit architectures to recognize
the new Device-Mapper version 4 ioctls. The version 1 ioctls are still
there.  If/When the version 1 ioctls are removed, these same files
will need to be updated again.

I have been unable to test this patch yet, since I have not had any
luck getting 2.6.0-test2 to compile on my ppc64 box (not a dm-related
problem).  But the patch is pretty trivial, so I'm pretty confident it
will work. If anyone else can test this (on mips64, sparc64, parisc,
or x86-64), let me know if you have any problems.  [Kevin Corry]

From: Joe Thornber <thornber@sistina.com>

The 2.4 version of Device-Mapper scans for device-numbers in decimal
instead of hex (in dm_get_device()). Update 2.6 so both versions use
the same behavior.  [Kevin Corry]

From: Joe Thornber <thornber@sistina.com>

Remove includes of <linux/blk.h>. This header is deprecated in 2.6.
[Kevin Corry]

From: Joe Thornber <thornber@sistina.com>

MODULE_PARM is deprecated in 2.6. Use the new module_param() macro.
[Kevin Corry]

Work around gcc-2.9x token-pasting bug by adding a space in front of the
comma.

 * the usual pile of tv card database updates.
 * various signed/unsigned fixups (fix gcc 3.3 warnings)
   and releated cleanups (use ARRAY_SIZE macro, ...).
 * moved some code which can be shared with the new,
   upcoming cx2388x driver to a separate module.
 * split the irq handler into smaller functions.
 * some new features (field rate capture support for example).
 * simplified i2c code a bit by removing redundant
   bookkeeping of attached i2c clients.
 * merged i2c changes back into my tree, there are some no-op
   changes due to this.
 * various other bugfixes.
 * fix build failure with CONFIG_FW_LOADER enabled

This patch drops procfs code from videodev.c and adds sysfs support
instead.  It adds a new class where all v4l devices are listed.  It
also provides some new helper functions for v4l drivers.

Original patch from Erik Andersen <andersen@codepoet.org>:
- fix CONFIG_IDEDISK_STROKE by adding proper detection of HPA feature set
  and removing IDE_STROKE_LIMIT
- remove irrelevant idedisk_supports_host_protected_area()
- make the HPA detection actually display useful information

I've reworked it a bit:
- detect HPA before calculating drive's geometry
- move HPA detection outside init_idedisk_capacity()
  to idedisk_check_hpa_lba28() and idedisk_check_hpa_lba48()
- use sectors_to_MB()
- respect 80-column limit

- no need to zero drive->capacity48 and drive->select.b.lba
- don't call idedisk_read_native_max_address_ext() twice
  if drive uses LBA-48 and CONFIG_IDEDISK_STROKE is defined
- remove uneccessary setup of drive->capacity48/cyl/select.b.lba
  if drive uses LBA-48, maximum virtual LBA address needs to be set
  and CONFIG_IDEDISK_STROKE is defined
- set drive->cyl only once if drive uses LBA-48
- don't call idedisk_read_native_max_address() if drive uses LBA-48
  and don't call it twice if CONFIG_IDEDISK_STROKE is defined
- don't check for Host Protected Area if drive uses CHS addressing
  (such combination is not supported by a driver)
- remove duplicated code (at the end of the function) that is never executed

From Andries.Brouwer@cwi.nl:

- store capacities in sector_t
- add generic sectors_to_MB() helper to ide-disk.c
- fix drive->bios_cyls calculation (limiting it to 65535) for disks

From Andries.Brouwer@cwi.nl:

- these functions should return 0 not 1 on error

From Benjamin Herrenschmidt <benh@kernel.crashing.org>.

- avoid device list corruption and scheduling at interrupt time
  (more work needed on proper locking)
- make sure "hold" flag and ide_dma_queued_* ops are properly
  transferred from old to new interface

From Andrey Borzenkov <arvidjaar@mail.ru>:

Apparently drive->driver is never NULL now but defaults to the default driver.

fixes kobject_register() oops

Now that we properly track queue references, that showed a bug in
scsi_ioctl.c, where it was dropping queues that it had never properly
gotten in the first place.

To be able to properly be able to keep references to block queues,
we make blk_init_queue() return the queue that it initialized, and
let it be independently allocated and then cleaned up on the last
reference.

I have grepped high and low, and there really shouldn't be any broken
uses of blk_init_queue() in the kernel drivers left.  The added bonus
being blk_init_queue() error checking is explicit now, most of the
drivers were broken in this regard (even IDE/SCSI).

No drivers have embedded request queue structures. Drivers that don't
use blk_init_queue() but blk_queue_make_request(), should allocate the
queue with blk_alloc_queue(gfp_mask). I've converted all of them to do
that, too. They can call blk_cleanup_queue() now too, using the define
blk_put_queue() is probably cleaner though.

into home.osdl.org:/home/torvalds/v2.5/linux

This patch fixes the BIO_RW_AHEAD being tested at the wrong end
in the bio layer.

The problem with PF_READAHEAD is that if someone does a non-GFP_ATOMIC memory
allocation we can enter page reclaim and then call writepage, while
PF_READAHEAD is set.  The block layer then drops writes or the wrong reads on
the floor.  It can cause data loss.

A fix is complex (well, intrusive).  Given that the readahead code is now
skipping the entire readahead attempt if the queue is congested, the setting
of PF_READAHEAD probably is not doing anything useful anyway, so simply
remove it.

There seemed to be increase in Athlon users reporting MCEs in 2.6 that
they never saw in 2.4 and I didn't buy the "2.6 pushes hardware harder"
for a second given folks are running 2.4+preempt+O(1) etc patchkits
without problems.

So I did a mini-audit of the mcheck code.

How embarressing. Another fix that went into 2.4 that never made
it forward. Once I'm done with various Red Hat administrivia
I'll see if I can devote some time to going through the changesets
mailing list. I wonder just how many other really stupid bugs
like this got fixed and not brought forward.

into kernel.bkbits.net:/home/davem/net-2.5