commit 5f17cfce5776c566d64430f543a289e5cfa4538b
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Sep 4 01:33:59 2008 -0700

    PCI: fix pbus_size_mem() resource alignment for CardBus controllers
    
    Commit 884525655d07fdee9245716b998ecdc45cdd8007 ("PCI: clean up resource
    alignment management") changed the resource handling to mark how a
    resource was aligned on a per-resource basis.
    
    Thus, instead of looking at the resource number to determine whether it
    was a bridge resource or a regular resource (they have different
    alignment rules), we should just ask the resource for its alignment
    directly.
    
    The reason this broke only cardbus resources was that for the other
    types of resources, the old way of deciding alignment actually still
    happened to work.  But CardBus bridge resources had been changed by
    commit 934b7024f0ed29003c95cef447d92737ab86dc4f ("Fix cardbus resource
    allocation") to look more like regular resources than PCI bridge
    resources from an alignment handling standpoint.
    
    Reported-and-tested-by: Andrew Morton <akpm@linux-foundation.org>
    Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
    Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit de014d617636d6a6bd5aef3b3d1f7f9a35669057
Author: Alok N Kataria <akataria@vmware.com>
Date:   Wed Sep 3 18:18:01 2008 -0700

    x86: Change warning message in TSC calibration.
    
    When calibration against PIT fails, the warning that we print is misleading.
    In a virtualized environment the VM may get descheduled while calibration
    or, the check in PIT calibration may fail due to other virtualization
    overheads.
    
    The warning message explicitly assumes that calibration failed due to SMI's
    which may not be the case. Change that to something proper.
    
    Signed-off-by: Alok N Kataria <akataria@vmware.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit ce36394269ccd9d1d286d6192ba09fa6894365e9
Author: Tejun Heo <tj@kernel.org>
Date:   Wed Sep 3 16:09:47 2008 +0200

    mmap: fix petty bug in anonymous shared mmap offset handling
    
    Anonymous mappings should ignore offset but shared anonymous mapping
    forgot to clear it and makes the following legit test program trigger
    SIGBUS.
    
     #include <sys/mman.h>
     #include <stdio.h>
     #include <errno.h>
    
     #define PAGE_SIZE	4096
    
     int main(void)
     {
    	 char *p;
    	 int i;
    
    	 p = mmap(NULL, 2 * PAGE_SIZE, PROT_READ|PROT_WRITE,
    		  MAP_SHARED|MAP_ANONYMOUS, -1, PAGE_SIZE);
    	 if (p == MAP_FAILED) {
    		 perror("mmap");
    		 return 1;
    	 }
    
    	 for (i = 0; i < 2; i++) {
    		 printf("page %d\n", i);
    		 p[i * 4096] = i;
    	 }
    	 return 0;
     }
    
    Fix it.
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Acked-by: Hugh Dickins <hugh@veritas.com>
    Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit d210baf53b699fc61aa891c177b71d7082d3b957
Merge: 3e25a2d... 8e531af...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Wed Sep 3 17:57:55 2008 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
      SELinux: memory leak in security_context_to_sid_core

commit 3e25a2d90e7e303168540c5ecb726297940cb172
Merge: 316343e... 7888bc2...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Wed Sep 3 17:36:37 2008 -0700

    Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc
    
    * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
      powerpc: Fix for getting CPU number in power_save_ppc32_restore()
      powerpc: Fix build error with 64K pages and !hugetlbfs
      powerpc: Work around gcc's -fno-omit-frame-pointer bug
      powerpc: Make sure _etext is after all kernel text
      powerpc: Only make kernel text pages of linear mapping executable
      powerpc: Fix uninitialised variable in VSX alignment code

commit 316343e2cfd9a4bb4c70d0e1991e7a74840fe29e
Merge: ec0c15a... fca1287...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Wed Sep 3 16:21:02 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      bnx2x: Accessing un-mapped page
      ath9k: Fix TX control flag use for no ACK and RTS/CTS
      ath9k: Fix TX status reporting
      iwlwifi: fix STATUS_EXIT_PENDING is not set on pci_remove
      iwlwifi: call apm stop on exit
      iwlwifi: fix Tx cmd memory allocation failure handling
      iwlwifi: fix rx_chain computation
      iwlwifi: fix station mimo power save values
      iwlwifi: remove false rxon if rx chain changes
      iwlwifi: fix hidden ssid discovery in passive channels
      iwlwifi: W/A for the TSF correction in IBSS
      netxen: Remove workaround for chipset quirk
      pcnet-cs, axnet_cs: add new IDs, remove dup ID with less info
      ixgbe: initialize interrupt throttle rate
      net/usb/pegasus: avoid hundreds of diagnostics
      tipc: Don't use structure names which easily globally conflict.

commit 8e531af90f3940615623dc0aa6c94866a6773601
Author: Eric Paris <eparis@redhat.com>
Date:   Wed Sep 3 11:49:47 2008 -0400

    SELinux: memory leak in security_context_to_sid_core
    
    Fix a bug and a philosophical decision about who handles errors.
    
    security_context_to_sid_core() was leaking a context in the common case.
    This was causing problems on fedora systems which recently have started
    making extensive use of this function.
    
    In discussion it was decided that if string_to_context_struct() had an
    error it was its own responsibility to clean up any mess it created
    along the way.
    
    Signed-off-by: Eric Paris <eparis@redhat.com>
    Acked-by:  Stephen Smalley <sds@tycho.nsa.gov>
    Signed-off-by: James Morris <jmorris@namei.org>

commit fca1287a3a9246d4facc27a0a455fada18fd1164
Merge: 437cf2f... 0b62afb...
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Sep 3 14:43:30 2008 -0700

    Merge branch 'davem-fixes' of master.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6

commit 437cf2f1c5f05e34510f43e129af29a716b04ce6
Author: Eilon Greenstein <eilong@broadcom.com>
Date:   Wed Sep 3 14:38:00 2008 -0700

    bnx2x: Accessing un-mapped page
    
    The allocated RX buffer size was 64 bytes bigger than the PCI mapped
    size with no good reason. If the packet was actually using the buffer up
    to its limit and if the last 64 bytes of the buffer crossed 4KB boundary
    then an unmapped PCI page was accessed. The fix is to use only one
    parameter for the buffer size - there is no need to differentiate
    between the buffer size and the PCI mapping size since the extra 64
    bytes can actually be used by the FW to align the Ethernet payload to
    64 bytes.
    
    Also updating the driver version and date
    
    Signed-off-by: Eilon Greenstein <eilong@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 56e9c0a6eb4918ae010aa4689e4481ab67986a0c
Merge: 6c00055... 9aab3e3...
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Sep 3 14:32:33 2008 -0700

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

commit 9aab3e3ee6f256a1eaabc275e0748132966f963d
Author: Jouni Malinen <jouni.malinen@atheros.com>
Date:   Mon Aug 11 14:01:51 2008 +0300

    ath9k: Fix TX control flag use for no ACK and RTS/CTS
    
    Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 43f30ae0a6308fd5b862ee7851feca1fc18c72d0
Author: Jouni Malinen <jouni.malinen@atheros.com>
Date:   Mon Aug 11 14:01:49 2008 +0300

    ath9k: Fix TX status reporting
    
    Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 0b124c31838bcf0459708aa91ce859582c7d3ca1
Author: Gregory Greenman <gregory.greenman@intel.com>
Date:   Wed Sep 3 11:18:50 2008 +0800

    iwlwifi: fix STATUS_EXIT_PENDING is not set on pci_remove
    
    This patch sets STATUS_EXIT_PENDING on pci_remove. Otherwise
    iwl4965_down may fail to uninitialize the driver.
    
    Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
    Signed-off-by: Mohamed Abbas <mohamed.abbas@intel.com>
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit d535311ecbba0d692b5f1278b8bcb2581c3482e0
Author: Gregory Greenman <gregory.greenman@intel.com>
Date:   Wed Sep 3 11:18:49 2008 +0800

    iwlwifi: call apm stop on exit
    
    This patch calls apm stop on exit and suspend. Without this patch
    hardware consumes power even after driver is removed or suspended.
    
    Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
    Signed-off-by: Mohamed Abbas <mohamed.abbas@intel.com>
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 73b7d742519ab4cc1b7a12c7af15187fc0ede8e7
Author: Tomas Winkler <tomas.winkler@intel.com>
Date:   Wed Sep 3 11:18:48 2008 +0800

    iwlwifi: fix Tx cmd memory allocation failure handling
    
    This patch "iwlwifi: do not use GFP_DMA in iwl_tx_queue_init" removes
    GFP_DMA from allocation tx command buffers. GFP_DMA allows allocation
    only for memory under 16M which causes allocation problems
    suspend/resume flows.
    
    Using kmalloc is temporal solution and some consistent/coherent
    allocation schema will be more correct. Since iwlwifi hardware
    supports 64bit address this solution should work on x86 (32 and
    64bit) for now.
    
    This patch fixes memory freeing problem in the previous patch.
    
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Ian Schram <ischram@telenet.be>
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 28a6b07a14bd5e63af2c0304306f35c5b963910b
Author: Tomas Winkler <tomas.winkler@intel.com>
Date:   Wed Sep 3 11:18:47 2008 +0800

    iwlwifi: fix rx_chain computation
    
    This patch fixes rx_chain computation. The code that adjusts number of
    rx chains to number supported by HW was missing. Miss configuration
    causes firmware error.  Note: iwlwifi supports HW with up to 3 RX
    chains (2x2, 2x3, 1x2, and 3x3 MIMO). This patch also simplifies the
    whole RX chain computation.
    
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Mohamed Abbas <mohamed.abbas@intel.com>
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 4834c73f055b92f719a23e29e275559fa8c29513
Author: Ron Rindjunsky <ron.rindjunsky@intel.com>
Date:   Wed Sep 3 11:18:46 2008 +0800

    iwlwifi: fix station mimo power save values
    
    This patch fixes the wrong use MIMO power save values. Our TX was
    configured with our MIMO power save values instead of peer's MIMO power
    save values, this may affect connectivity. The peer STA/AP may not sense
    our traffic at all as it doesn't have all RX chains opened.
    
    Signed-off-by: Ron Rindjunsky <ron.rindjunsky@intel.com>
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 545597036caefd4b438731abaca902efe004b1b4
Author: Mohamed Abbas <mohamed.abbas@intel.com>
Date:   Wed Sep 3 11:18:44 2008 +0800

    iwlwifi: remove false rxon if rx chain changes
    
    Rx chain might change during power save transitions but it doesn't
    require sending Full-ROXN command to the firmware. Full-RXON requires
    reconnection to an AP and thus affects user experience. The patch
    avoids the Full-RXON by removing the rx_chain modification check in
    iwl_full_rxon_required function.
    
    Signed-off-by: Mohamed Abbas <mohamed.abbas@intel.com
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 0ffe014a8c548f88694815ae7b25d6e86550917e
Author: Ron Rindjunsky <ron.rindjunsky@intel.com>
Date:   Wed Sep 3 11:18:43 2008 +0800

    iwlwifi: fix hidden ssid discovery in passive channels
    
    This enables sending of direct probes on passive channels, as long as
    traffic was detected on that channel. This enables connectivity to
    hidden/non broadcasting SSIDs APs on passive channels. Note 5000 HW
    declares all 5.2 spectrum as passive.
    
    Signed-off-by: Cahill Ben <ben.m.cahill@intel.com>
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Ron Rindjunsky <ron.rindjunsky@intel.com>
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit b94d8eea44df985ea22b1f51e402b4bbfdd6d793
Author: Assaf Krauss <assaf.krauss@intel.com>
Date:   Wed Sep 3 11:18:42 2008 +0800

    iwlwifi: W/A for the TSF correction in IBSS
    
    This patch is a W/A for the TSF sync issue in IBSS merging. HW is not
    capable to sync TSF (it's constantly little behind). This creates
    constant IBSS merging upon reception of each beacon, adding and removing
    station which in turn creates above 50% packet loss and thus dramatically
    degrade the throughput. The W/A simply stops the driver from declaring it
    has a reliable TSF value and thus eliminates IBSS merging.
    
    Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit ec0c15afb41fd9ad45b53468b60db50170e22346
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Wed Sep 3 07:30:13 2008 -0700

    Split up PIT part of TSC calibration from native_calibrate_tsc
    
    The TSC calibration function is still very complicated, but this makes
    it at least a little bit less so by moving the PIT part out into a
    helper function of its own.
    
    Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-of-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 0b62afb432d807482a6808508112d1baf29f3798
Author: Dhananjay Phadke <dhananjay@netxen.com>
Date:   Wed Aug 27 21:57:30 2008 -0700

    netxen: Remove workaround for chipset quirk
    
    Remove chipset-specific quirk workaround; the workaround caused
    unrecoverable DMA lockups when the driver was loaded following a
    PXE boot.
    
    Signed-off-by: Dhananjay Phadke <dhananjay@netxen.com>
    Signed-off-by: Michael Brown <mbrown@fensystems.co.uk>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 2dcc9ff7efc701f76883356bdbaf1134039e5fa5
Author: Komuro <komurojun-mbn@nifty.com>
Date:   Sat Aug 30 12:13:33 2008 +0900

    pcnet-cs, axnet_cs: add new IDs, remove dup ID with less info
    
    pcnet_cs:
        add new ID: "corega Ether PCC-TD".
        remove duplicate ID: "IC-CARD".
    
    axnet_cs:
        add new ID: "IO DATA ETXPCM".
    
    Signed-off-by: Komuro <komurojun-mbn@nifty.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 15e79f24b60c4b0bf8019423bda4e03a576b02f2
Author: Andy Gospodarek <andy@greyhouse.net>
Date:   Wed Aug 27 18:04:32 2008 -0700

    ixgbe: initialize interrupt throttle rate
    
    This commit dropped the setting of the default interrupt throttle rate.
    
    commit 021230d40ae0e6508d6c717b6e0d6d81cd77ac25
    Author: Ayyappan Veeraiyan <ayyappan.veeraiyan@intel.com>
    Date:   Mon Mar 3 15:03:45 2008 -0800
    
        ixgbe: Introduce MSI-X queue vector code
    
    The following patch adds it back.  Without this the default value of 0
    causes the performance of this card to be awful.  Restoring these to the
    default values yields much better performance.
    
    This regression has been around since 2.6.25.
    
    Signed-off-by: Andy Gospodarek <andy@greyhouse.net>
    Acked-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    CC: stable@kernel.org [2.6.25 and later]
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit e000ea13123a28108cff2d6b9856b414dfdcd1fa
Author: David Brownell <dbrownell@users.sourceforge.net>
Date:   Tue Sep 2 11:34:24 2008 -0700

    net/usb/pegasus: avoid hundreds of diagnostics
    
    Make the "pegasus" driver scream less loudly in the face of
    problems as it initializes, avoiding hundreds of messages:
    
     - ratelimit some key error messages
     - avoid some spurious diagnostics caused by strange codeflow
    
    And fix one instance of goofy indentation.
    
    Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 7888bc2b4778fda267a6e6422c4497dba865a47a
Author: Kumar Gala <galak@kernel.crashing.org>
Date:   Tue Aug 26 12:08:56 2008 +1000

    powerpc: Fix for getting CPU number in power_save_ppc32_restore()
    
    The calculation to get TI_CPU based off of SPRG3 was just plain wrong,
    meaning that we were getting garbage for the CPU number on 6xx/G3/G4
    based SMP boxes in this code.
    
    Just offset off the stack pointer (to get to thread_info) like all the
    other references to TI_CPU do.
    
    This was pointed out by Chen Gong <G.Chen@freescale.com>
    
    [paulus@samba.org - use rlwinm r12,r11,... instead of
     rlwinm r12,r1,...; tophys()]
    
    Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
    Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Paul Mackerras <paulus@samba.org>

commit 94ee815c05c9387931e549d83312d30009ed86e9
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date:   Wed Sep 3 13:12:05 2008 +1000

    powerpc: Fix build error with 64K pages and !hugetlbfs
    
    HAVE_ARCH_UNMAPPED_AREA and HAVE_ARCH_UNMAPPED_AREA_TOPDOWN must
    be defined whenever CONFIG_PPC_MM_SLICES is enabled, not just when
    CONFIG_HUGETLB_PAGE is.  They used to be always defined together but
    this is no longer the case since 3a8247cc2c856930f34eafce33f6a039227ee175
    ("powerpc: Only demote individual slices rather than whole process").
    
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Paul Mackerras <paulus@samba.org>

commit 7563dc64585324f443f5ac107eb6d89ee813a2d2
Author: Tony Breeds <tony@bakeyournoodle.com>
Date:   Tue Sep 2 16:50:38 2008 +1000

    powerpc: Work around gcc's -fno-omit-frame-pointer bug
    
    This bug is causing random crashes
    (http://bugzilla.kernel.org/show_bug.cgi?id=11414).
    
    -fno-omit-frame-pointer is only needed on powerpc when -pg is also
    supplied, and there is a gcc bug that causes incorrect code generation
    on 32-bit powerpc when -fno-omit-frame-pointer is used---it uses stack
    locations below the stack pointer, which is not allowed by the ABI
    because those locations can and sometimes do get corrupted by an
    interrupt.
    
    This ensures that CONFIG_FRAME_POINTER is only selected by ftrace.
    When CONFIG_FTRACE is enabled we also pass -mno-sched-epilog to work
    around the gcc codegen bug.
    
    Patch based on work by:
    	Andreas Schwab <schwab@suse.de>
    	Segher Boessenkool <segher@kernel.crashing.org>
    
    Signed-off-by: Tony Breeds <tony@bakeyournoodle.com>
    Signed-off-by: Paul Mackerras <paulus@samba.org>

commit 303996dace16894710a5291327eeb79afdb8ed12
Author: Stephen Rothwell <sfr@canb.auug.org.au>
Date:   Tue Sep 2 15:04:09 2008 +1000

    powerpc: Make sure _etext is after all kernel text
    
    This makes core_kernel_text() (and therefore kernel_text_address())
    return the correct result.  Currently all the __devinit routines (at
    least) will not be considered to be kernel text.
    
    This is just a quick fix for 2.6.27 - hopefully we will be able to fix
    this better in 2.6.28.
    
    Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
    Signed-off-by: Paul Mackerras <paulus@samba.org>

commit 9e88ba4e45ecad2425c4cc4e0861a26f4e36c6da
Author: Paul Mackerras <paulus@samba.org>
Date:   Sat Aug 30 11:26:27 2008 +1000

    powerpc: Only make kernel text pages of linear mapping executable
    
    Commit bc033b63bbfeb6c4b4eb0a1d083c650e4a0d2af8 ("powerpc/mm: Fix
    attribute confusion with htab_bolt_mapping()") moved the check for
    whether we should make pages of the linear mapping executable from
    htab_bolt_mapping into its callers, including htab_initialize.
    A side-effect of this is that the decision is now made once for
    each contiguous section in the LMB array rather than for each page
    individually.  This can often mean that the whole of the linear
    mapping ends up being executable.
    
    This reverts to the previous behaviour, where individual pages are
    checked for being part of the kernel text or not, by moving the check
    back down into htab_bolt_mapping.
    
    Acked-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Signed-off-by: Paul Mackerras <paulus@samba.org>

commit 78fbc824ed8225edd80cdc57771d5ca4f7aae95e
Author: Michael Neuling <mikey@neuling.org>
Date:   Thu Aug 28 14:57:39 2008 +1000

    powerpc: Fix uninitialised variable in VSX alignment code
    
    This fixes an uninitialised variable in the VSX alignment code.  It can
    cause warnings from GCC (noticed with gcc-4.1.1).  Gcc is actually
    correct in this instance, and this bug could cause the alignment
    interrupt handler to send a SIGSEGV to the process on a legitimate
    access.
    
    Signed-off-by: Michael Neuling <mikey@neuling.org>
    Signed-off-by: Paul Mackerras <paulus@samba.org>

commit 6c00055a819ce8a6e2c3af2f65d4ea1a8559c491
Author: David S. Miller <davem@davemloft.net>
Date:   Tue Sep 2 23:38:32 2008 -0700

    tipc: Don't use structure names which easily globally conflict.
    
    Andrew Morton reported a build failure on sparc32, because TIPC
    uses names like "struct node" and there is a like named data
    structure defined in linux/node.h
    
    This just regexp replaces "struct node*" to "struct tipc_node*"
    to avoid this and any future similar problems.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit d26acd92fa990764b72608a68224f46fac377032
Merge: fbb16e2... 37b08e3...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 2 21:02:14 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      ipsec: Fix deadlock in xfrm_state management.
      ipv: Re-enable IP when MTU > 68
      net/xfrm: Use an IS_ERR test rather than a NULL test
      ath9: Fix ath_rx_flush_tid() for IRQs disabled kernel warning message.
      ath9k: Incorrect key used when group and pairwise ciphers are different.
      rt2x00: Compiler warning unmasked by fix of BUILD_BUG_ON
      mac80211: Fix debugfs union misuse and pointer corruption
      wireless/libertas/if_cs.c: fix memory leaks
      orinoco: Multicast to the specified addresses
      iwlwifi: fix 64bit platform firmware loading
      iwlwifi: fix apm_stop (wrong bit polarity for FLAG_INIT_DONE)
      iwlwifi: workaround interrupt handling no some platforms
      iwlwifi: do not use GFP_DMA in iwl_tx_queue_init
      net/wireless/Kconfig: clarify the description for CONFIG_WIRELESS_EXT_SYSFS
      net: Unbreak userspace usage of linux/mroute.h
      pkt_sched: Fix locking of qdisc_root with qdisc_root_sleeping_lock()
      ipv6: When we droped a packet, we should return NET_RX_DROP instead of 0

commit fbb16e243887332dd5754e48ffe5b963378f3cd2
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Wed Sep 3 00:54:47 2008 +0200

    [x86] Fix TSC calibration issues
    
    Larry Finger reported at http://lkml.org/lkml/2008/9/1/90:
    An ancient laptop of mine started throwing errors from b43legacy when
    I started using 2.6.27 on it. This has been bisected to commit bfc0f59
    "x86: merge tsc calibration".
    
    The unification of the TSC code adopted mostly the 64bit code, which
    prefers PMTIMER/HPET over the PIT calibration.
    
    Larrys system has an AMD K6 CPU. Such systems are known to have
    PMTIMER incarnations which run at double speed. This results in a
    miscalibration of the TSC by factor 0.5. So the resulting calibrated
    CPU/TSC speed is half of the real CPU speed, which means that the TSC
    based delay loop will run half the time it should run. That might
    explain why the b43legacy driver went berserk.
    
    On the other hand we know about systems, where the PIT based
    calibration results in random crap due to heavy SMI/SMM
    disturbance. On those systems the PMTIMER/HPET based calibration logic
    with SMI detection shows better results.
    
    According to Alok also virtualized systems suffer from the PIT
    calibration method.
    
    The solution is to use a more wreckage aware aproach than the current
    either/or decision.
    
    1) reimplement the retry loop which was dropped from the 32bit code
    during the merge. It repeats the calibration and selects the lowest
    frequency value as this is probably the closest estimate to the real
    frequency
    
    2) Monitor the delta of the TSC values in the delay loop which waits
    for the PIT counter to reach zero. If the maximum value is
    significantly different from the minimum, then we have a pretty safe
    indicator that the loop was disturbed by an SMI.
    
    3) keep the pmtimer/hpet reference as a backup solution for systems
    where the SMI disturbance is a permanent point of failure for PIT
    based calibration
    
    4) do the loop iteration for both methods, record the lowest value and
    decide after all iterations finished.
    
    5) Set a clear preference to PIT based calibration when the result
    makes sense.
    
    The implementation does the reference calibration based on
    HPET/PMTIMER around the delay, which is necessary for the PIT anyway,
    but keeps separate TSC values to ensure the "independency" of the
    resulting calibration values.
    
    Tested on various 32bit/64bit machines including Geode 266Mhz, AMD K6
    (affected machine with a double speed pmtimer which I grabbed out of
    the dump), Pentium class machines and AMD/Intel 64 bit boxen.
    
    Bisected-by:  Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 37b08e34a98c664bea86e3fae718ac45a46b7276
Author: David S. Miller <davem@davemloft.net>
Date:   Tue Sep 2 20:14:15 2008 -0700

    ipsec: Fix deadlock in xfrm_state management.
    
    Ever since commit 4c563f7669c10a12354b72b518c2287ffc6ebfb3
    ("[XFRM]: Speed up xfrm_policy and xfrm_state walking") it is
    illegal to call __xfrm_state_destroy (and thus xfrm_state_put())
    with xfrm_state_lock held.  If we do, we'll deadlock since we
    have the lock already and __xfrm_state_destroy() tries to take
    it again.
    
    Fix this by pushing the xfrm_state_put() calls after the lock
    is dropped.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 8b76f46a2db29407fed66cf4aca19d61b3dcb3e1
Author: Andrew Morton <akpm@linux-foundation.org>
Date:   Tue Sep 2 14:36:14 2008 -0700

    drivers/char/random.c: fix a race which can lead to a bogus BUG()
    
    Fix a bug reported by and diagnosed by Aaron Straus.
    
    This is a regression intruduced into 2.6.26 by
    
        commit adc782dae6c4c0f6fb679a48a544cfbcd79ae3dc
        Author: Matt Mackall <mpm@selenic.com>
        Date:   Tue Apr 29 01:03:07 2008 -0700
    
            random: simplify and rename credit_entropy_store
    
    credit_entropy_bits() does:
    
    	spin_lock_irqsave(&r->lock, flags);
    	...
    	if (r->entropy_count > r->poolinfo->POOLBITS)
    		r->entropy_count = r->poolinfo->POOLBITS;
    
    so there is a time window in which this BUG_ON():
    
    static size_t account(struct entropy_store *r, size_t nbytes, int min,
    		      int reserved)
    {
    	unsigned long flags;
    
    	BUG_ON(r->entropy_count > r->poolinfo->POOLBITS);
    
    	/* Hold lock while accounting */
    	spin_lock_irqsave(&r->lock, flags);
    
    can trigger.
    
    We could fix this by moving the assertion inside the lock, but it seems
    safer and saner to revert to the old behaviour wherein
    entropy_store.entropy_count at no time exceeds
    entropy_store.poolinfo->POOLBITS.
    
    Reported-by: Aaron Straus <aaron@merfinllc.com>
    Cc: Matt Mackall <mpm@selenic.com>
    Cc: Theodore Ts'o <tytso@mit.edu>
    Cc: <stable@kernel.org>		[2.6.26.x]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 9d3593574702ae1899e23a1535da1ac71f928042
Author: John Kacur <jkacur@gmail.com>
Date:   Tue Sep 2 14:36:13 2008 -0700

    pm_qos_requirement might sleep
    
    Make PM_QOS and CPU_IDLE play nicer when run with the RT-Preempt kernel.
    
    The purpose of the patch is to remove the spin_lock around the read in the
    function pm_qos_requirement - since spinlocks can sleep in -rt and this
    function is called from idle.
    
    CPU_IDLE polls the target_value's of some of the pm_qos parameters from
    the idle loop causing sleeping locking warnings.  Changing the
    target_value to an atomic avoids this issue.
    
    Remove the spinlock in pm_qos_requirement by making target_value an atomic
    type.
    
    Signed-off-by: mark gross <mgross@linux.intel.com>
    Signed-off-by: John Kacur <jkacur@gmail.com>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 74c4633da7994eddcfcd2762a448c6889cc2b5bd
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Tue Sep 2 14:36:11 2008 -0700

    rtc-cmos: wake again from S5
    
    Update rtc-cmos shutdown handling to leave RTC alarms active, resolving
    http://bugzilla.kernel.org/show_bug.cgi?id=11411 on several boards.  There
    are still some systems where the ACPI event handling doesn't cooperate.
    (Possibly related to bugid 11312, reporting the spontaneous disabling of
    RTC events.)
    
    Bug 11411 reported that changes to work around some ACPI event issues
    broke wake-from-S5 handling, as used for DVR applications.  (They like to
    power off, then wake later to record programs.)
    
    [yakui.zhao@intel.com: add shutdown for PNP devices]
    [dbrownell@users.sourceforge.net: update comments]
    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Signed-off-by: Zhao Yakui <yakui.zhao@intel.com>
    Signed-off-by: Zhang Rui <rui.zhang@intel.com>
    Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
    Cc: Stefan Bauer <stefan.bauer@cs.tu-chemnitz.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 8b3a8944a9c0f2a3afc1678798b44f0442924a37
Author: Russ Anderson <rja@sgi.com>
Date:   Tue Sep 2 14:36:09 2008 -0700

    sysfs: document files in /sys/firmware/sgi_uv/
    
    Document files in /sys/firmware/sgi_uv/.
    
    Signed-off-by: Russ Anderson <rja@sgi.com>
    Cc: Jack Steiner <steiner@sgi.com>
    Cc: Ingo Molnar <mingo@elte.hu>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Acked-by: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit bb8fb4e6840ecebdc61f7ebd0653187e7128dde5
Author: Mike Christie <michaelc@cs.wisc.edu>
Date:   Tue Sep 2 14:36:07 2008 -0700

    ibft: fix target info parsing in ibft module
    
    I got this patch through Red Hat's bugzilla from the bug submitter and
    patch creator.  I have just fixed it up so it applies without fuzz to
    upstream kernels.
    
    Original patch and description from Shyam kumar Iyer:
    
    The issue [ibft module not displaying targets with short names] is because
    of an offset calculatation error in the iscsi_ibft.c code.  Due to this
    error directory structure for the target in /sys/firmware/ibft does not
    get created and so the initiator is unable to connect to the target.
    
    Note that this bug surfaced only with an name that had a short section at
    the end.  eg: "iqn.1984-05.com.dell:dell".  It did not surface when the
    iqn's had a longer section at the end.  eg:
    "iqn.2001-04.com.example:storage.disk2.sys1.xyz"
    
    So, the eot_offset was calculated such that an extra 48 bytes i.e.  the
    size of the ibft_header which has already been accounted was subtracted
    twice.
    
    This was not evident with longer iqn names because they would overshoot
    the total ibft length more than 48 bytes and thus would escape the bug.
    
    Signed-off-by: Shyam Kumar Iyer <shyam_iyer@dell.com>
    Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
    Cc: Konrad Rzeszutek <konrad@virtualiron.com>
    Cc: Peter Jones <pjones@redhat.com>
    Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
    Cc: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 73442daf2ea85e2a779396b76b1a39b10188ecb5
Author: Jan Altenberg <jan.altenberg@linutronix.de>
Date:   Tue Sep 2 14:36:05 2008 -0700

    rtc_time_to_tm: fix signed/unsigned arithmetic
    
    commit 945185a69daa457c4c5e46e47f4afad7dcea734f ("rtc: rtc_time_to_tm: use
    unsigned arithmetic") changed the some types in rtc_time_to_tm() to
    unsigned:
    
     void rtc_time_to_tm(unsigned long time, struct rtc_time *tm)
     {
    -       register int days, month, year;
    +       unsigned int days, month, year;
    
    This doesn't work for all cases, because days is checked for < 0 later
    on:
    
    if (days < 0) {
    	year -= 1;
    	days += 365 + LEAP_YEAR(year);
    }
    
    I think the correct fix would be to keep days signed and do an appropriate
    cast later on.
    
    Signed-off-by: Jan Altenberg <jan.altenberg@linutronix.de>
    Cc: Maciej W. Rozycki <macro@linux-mips.org>
    Cc: Alessandro Zummo <a.zummo@towertech.it>
    Cc: David Brownell <david-b@pacbell.net>
    Cc: Dmitri Vorobiev <dmitri.vorobiev@gmail.com>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit b4a49b12e879ce79f495cc318c4b33caec6922e8
Author: Krzysztof Helt <krzysztof.h1@wp.pl>
Date:   Tue Sep 2 14:36:04 2008 -0700

    tdfxfb: fix frame buffer name overrun
    
    If there are more then one graphics card handled by the tdfxfb driver the
    name of the frame buffer overruns reserved size.
    
    Signed-off-by: Krzysztof Helt <krzysztof.h1@wp.pl>
    Cc: Geert Uytterhoeven <geert@linux-m68k.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit bf6910c0afb1e416a99ad5b2296e088449fbe481
Author: Krzysztof Helt <krzysztof.h1@wp.pl>
Date:   Tue Sep 2 14:36:03 2008 -0700

    tdfxfb: fix SDRAM memory size detection
    
    Fix memory detection on Voodoo3 cards with SDRAM memory.
    
    Signed-off-by: Krzysztof Helt <krzysztof.h1@wp.pl>
    Cc: Geert Uytterhoeven <geert@linux-m68k.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit a8823aefd142d2a9c4b3661bf8712ccd2da1b220
Author: Matthew Garrett <mjg59@srcf.ucam.org>
Date:   Tue Sep 2 14:36:03 2008 -0700

    hp-wmi: add proper hotkey support
    
    It turns out that event 0x4 merely indcates that a hotkey has been
    pressed, not which one.  A further query is required in order to determine
    the actual keypress.  The following patch adds support for that along with
    the known keycodes.
    
    Signed-off-by: Matthew Garrett <mjg@redhat.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 3f6e2f137c5b83c3c2d48fae971e845c3450cc7c
Author: Matthew Garrett <mjg59@srcf.ucam.org>
Date:   Tue Sep 2 14:36:00 2008 -0700

    hp-wmi: update to match current rfkill semantics
    
    hp-wmi currently changes the RFKill state by altering the struct members
    rather than using the dedicated interface, meaning that update events
    won't be pushed to userspace.  This patch fixes that, along with fixing
    the declared type of the WWAN kill switch.  It also ensures that rfkill
    interfaces are only registered for hardware that exists.
    
    Signed-off-by: Matthew Garrett <mjg@redhat.com>
    Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
    Cc: Ivo van Doorn <ivdoorn@gmail.com>
    Cc: Dave Young <hidave.darkstar@gmail.com>
    Cc: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 61e55d0576d0e7eb4fecaeb25b3618e035de5be1
Author: Nadia Derbey <Nadia.Derbey@bull.net>
Date:   Tue Sep 2 14:35:59 2008 -0700

    ipc: document the new auto_msgmni proc file
    
    Update Documentation/filesystems/proc.txt: it describes the file
    auto_msgmni intoduced to enable/disable msgmni automatic recomputing upon
    memory add/remove (see thread http://lkml.org/lkml/2008/7/4/27).  Also
    added a description for msgmni (this filex is only listed in
    Documentation/sysctl/kernel.txt).
    
    Signed-off-by: Nadia Derbey <Nadia.Derbey@bull.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit b954185214c3b562c3fcc651e9ec69d421d76bfa
Author: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Date:   Tue Sep 2 14:35:58 2008 -0700

    mm: size of quicklists shouldn't be proportional to the number of CPUs
    
    Quicklists store pages for each CPU as caches.  (Each CPU can cache
    node_free_pages/16 pages)
    
    It is used for page table cache.  exit() will increase the cache size,
    while fork() consumes it.
    
    So for example if an apache-style application runs (one parent and many
    child model), one CPU process will fork() while another CPU will process
    the middleware work and exit().
    
    At that time, the CPU on which the parent runs doesn't have page table
    cache at all.  Others (on which children runs) have maximum caches.
    
    	QList_max = (#ofCPUs - 1) x Free / 16
    	=> QList_max / (Free + QList_max) = (#ofCPUs - 1) / (16 + #ofCPUs - 1)
    
    So, How much quicklist memory is used in the maximum case?
    
    This is proposional to # of CPUs because the limit of per cpu quicklist
    cache doesn't see the number of cpus.
    
    Above calculation mean
    
    	 Number of CPUs per node            2    4    8   16
    	 ==============================  ====================
    	 QList_max / (Free + QList_max)   5.8%  16%  30%  48%
    
    Wow! Quicklist can spend about 50% memory at worst case.
    
    My demonstration program is here
    --------------------------------------------------------------------------------
    #define _GNU_SOURCE
    
    #include <stdio.h>
    #include <errno.h>
    #include <stdlib.h>
    #include <string.h>
    #include <sched.h>
    #include <unistd.h>
    #include <sys/mman.h>
    #include <sys/wait.h>
    
    #define BUFFSIZE 512
    
    int max_cpu(void)	/* get max number of logical cpus from /proc/cpuinfo */
    {
      FILE *fd;
      char *ret, buffer[BUFFSIZE];
      int cpu = 1;
    
      fd = fopen("/proc/cpuinfo", "r");
      if (fd == NULL) {
        perror("fopen(/proc/cpuinfo)");
        exit(EXIT_FAILURE);
      }
      while (1) {
        ret = fgets(buffer, BUFFSIZE, fd);
        if (ret == NULL)
          break;
        if (!strncmp(buffer, "processor", 9))
          cpu = atoi(strchr(buffer, ':') + 2);
      }
      fclose(fd);
      return cpu;
    }
    
    void cpu_bind(int cpu)	/* bind current process to one cpu */
    {
      cpu_set_t mask;
      int ret;
    
      CPU_ZERO(&mask);
      CPU_SET(cpu, &mask);
      ret = sched_setaffinity(0, sizeof(mask), &mask);
      if (ret == -1) {
        perror("sched_setaffinity()");
        exit(EXIT_FAILURE);
      }
      sched_yield();	/* not necessary */
    }
    
    #define MMAP_SIZE (10 * 1024 * 1024)	/* 10 MB */
    #define FORK_INTERVAL 1	/* 1 second */
    
    main(int argc, char *argv[])
    {
      int cpu_max, nextcpu;
      long pagesize;
      pid_t pid;
    
      /* set max number of logical cpu */
      if (argc > 1)
        cpu_max = atoi(argv[1]) - 1;
      else
        cpu_max = max_cpu();
    
      /* get the page size */
      pagesize = sysconf(_SC_PAGESIZE);
      if (pagesize == -1) {
        perror("sysconf(_SC_PAGESIZE)");
        exit(EXIT_FAILURE);
      }
    
      /* prepare parent process */
      cpu_bind(0);
      nextcpu = cpu_max;
    
    loop:
    
      /* select destination cpu for child process by round-robin rule */
      if (++nextcpu > cpu_max)
        nextcpu = 1;
    
      pid = fork();
    
      if (pid == 0) { /* child action */
    
        char *p;
        int i;
    
        /* consume page tables */
        p = mmap(0, MMAP_SIZE, PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, 0, 0);
        i = MMAP_SIZE / pagesize;
        while (i-- > 0) {
          *p = 1;
          p += pagesize;
        }
    
        /* move to other cpu */
        cpu_bind(nextcpu);
    /*
        printf("a child moved to cpu%d after mmap().\n", nextcpu);
        fflush(stdout);
     */
    
        /* back page tables to pgtable_quicklist */
        exit(0);
    
      } else if (pid > 0) { /* parent action */
    
        sleep(FORK_INTERVAL);
        waitpid(pid, NULL, WNOHANG);
    
      }
    
      goto loop;
    }
    ----------------------------------------
    
    When above program which does task migration runs, my 8GB box spends
    800MB of memory for quicklist.  This is not memory leak but doesn't seem
    good.
    
    % cat /proc/meminfo
    
    MemTotal:        7701568 kB
    MemFree:         4724672 kB
    (snip)
    Quicklists:       844800 kB
    
    because
    
    - My machine spec is
    	number of numa node: 2
    	number of cpus:      8 (4CPU x2 node)
            total mem:           8GB (4GB x2 node)
            free mem:            about 5GB
    
    - Then, 4.7GB x 16% ~= 880MB.
      So, Quicklist can use 800MB.
    
    So, if following spec machine run that program
    
       CPUs: 64 (8cpu x 8node)
       Mem:  1TB (128GB x8node)
    
    Then, quicklist can waste 300GB (= 1TB x 30%).  It is too large.
    
    So, I don't like cache policies which is proportional to # of cpus.
    
    My patch changes the number of caches
    from:
       per-cpu-cache-amount = memory_on_node / 16
    to
       per-cpu-cache-amount = memory_on_node / 16 / number_of_cpus_on_node.
    
    Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Keiichiro Tokunaga <tokunaga.keiich@jp.fujitsu.com>
    Acked-by: Christoph Lameter <cl@linux-foundation.org>
    Tested-by: David Miller <davem@davemloft.net>
    Acked-by: Mike Travis <travis@sgi.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 4b8561521dbaa3d766b198496b220e984e3bf756
Author: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Date:   Tue Sep 2 14:35:53 2008 -0700

    mm: show quicklist usage in /proc/meminfo
    
    Quicklists can consume several GB of memory.  We should provide a means of
    monitoring this.
    
    After this patch is applied, /proc/meminfo will output the following:
    
    % cat /proc/meminfo
    
    MemTotal:      7715392 kB
    MemFree:       5401600 kB
    Buffers:         80384 kB
    Cached:         300800 kB
    SwapCached:          0 kB
    Active:         235584 kB
    Inactive:       262656 kB
    SwapTotal:     2031488 kB
    SwapFree:      2031488 kB
    Dirty:            3520 kB
    Writeback:           0 kB
    AnonPages:      117696 kB
    Mapped:          38528 kB
    Slab:          1589952 kB
    SReclaimable:    23104 kB
    SUnreclaim:    1566848 kB
    PageTables:      14656 kB
    NFS_Unstable:        0 kB
    Bounce:              0 kB
    WritebackTmp:        0 kB
    CommitLimit:   5889152 kB
    Committed_AS:   393152 kB
    VmallocTotal: 17592177655808 kB
    VmallocUsed:     29056 kB
    VmallocChunk: 17592177626432 kB
    Quicklists:     130944 kB
    HugePages_Total:     0
    HugePages_Free:      0
    HugePages_Rsvd:      0
    HugePages_Surp:      0
    Hugepagesize:    262144 kB
    
    Signed-off-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Cc: Christoph Lameter <cl@linux-foundation.org>
    Cc: Keiichiro Tokunaga <tokunaga.keiich@jp.fujitsu.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 36fd71d293898a59b14e49da1f6e81c1a58f2035
Author: Li Zefan <lizf@cn.fujitsu.com>
Date:   Tue Sep 2 14:35:52 2008 -0700

    devcgroup: fix race against rmdir()
    
    During the use of a dev_cgroup, we should guarantee the corresponding
    cgroup won't be deleted (i.e.  via rmdir).  This can be done through
    css_get(&dev_cgroup->css), but here we can just get and use the dev_cgroup
    under rcu_read_lock.
    
    And also remove checking NULL dev_cgroup, it won't be NULL since a task
    always belongs to a cgroup.
    
    Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
    Acked-by: Serge Hallyn <serue@us.ibm.com>
    Cc: Paul Menage <menage@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 09a2910e54646f7a334702fbafa7a6129dc072e6
Author: Krzysztof Helt <krzysztof.h1@wp.pl>
Date:   Tue Sep 2 14:35:51 2008 -0700

    cirrusfb: check_par fixes
    
    1. Check if virtual resolution fits into memory.
       Otherwise, Linux hangs during panning.
    2. When selected use all available memory to
        maximize yres_virtual to speed up panning
       (previously also xres_virtual was increased).
    3. Simplify memory restriction calculations.
    
    Signed-off-by: Krzysztof Helt <krzysztof.h1@poczta.fm>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 950bbabb5a804690a0201190de5c22837f72f83f
Author: Oleg Nesterov <oleg@tv-sign.ru>
Date:   Tue Sep 2 14:35:49 2008 -0700

    pid_ns: (BUG 11391) change ->child_reaper when init->group_leader exits
    
    We don't change pid_ns->child_reaper when the main thread of the
    subnamespace init exits.  As Robert Rex <robert.rex@exasol.com> pointed
    out this is wrong.
    
    Yes, the re-parenting itself works correctly, but if the reparented task
    exits it needs ->parent->nsproxy->pid_ns in do_notify_parent(), and if the
    main thread is zombie its ->nsproxy was already cleared by
    exit_task_namespaces().
    
    Introduce the new function, find_new_reaper(), which finds the new
    ->parent for the re-parenting and changes ->child_reaper if needed.  Kill
    the now unneeded exit_child_reaper().
    
    Also move the changing of ->child_reaper from zap_pid_ns_processes() to
    find_new_reaper(), this consolidates the games with ->child_reaper and
    makes it stable under tasklist_lock.
    
    Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11391
    
    Reported-by: Robert Rex <robert.rex@exasol.com>
    Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
    Acked-by: Serge Hallyn <serue@us.ibm.com>
    Acked-by: Pavel Emelyanov <xemul@openvz.org>
    Acked-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit add0d4dfd660e9e4fd0af3eac3cad23583c9558f
Author: Oleg Nesterov <oleg@tv-sign.ru>
Date:   Tue Sep 2 14:35:48 2008 -0700

    pid_ns: zap_pid_ns_processes: fix the ->child_reaper changing
    
    zap_pid_ns_processes() sets pid_ns->child_reaper = NULL, this is wrong.
    
    Yes, we have already killed all tasks in this namespace, and sys_wait4()
    doesn't see any child.  But this doesn't mean ->children list is empty, we
    may have EXIT_DEAD tasks which are not visible to do_wait().  In that case
    the subsequent forget_original_parent() will crash the kernel because it
    will try to re-parent these tasks to the NULL reaper.
    
    Even if there are no childs, it is not good that forget_original_parent()
    uses reaper == NULL.
    
    Change the code to set ->child_reaper = init_pid_ns.child_reaper instead.
    We could use pid_ns->parent->child_reaper as well, I think this does not
    really matter.  These EXIT_DEAD tasks are not visible to the new ->parent
    after re-parenting, they will silently do release_task() eventually.
    
    Note that we must change ->child_reaper, otherwise
    forget_original_parent() will use reaper == father, and in that case we
    will hit the (correct) BUG_ON(!list_empty(&father->children)).
    
    Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
    Acked-by: Serge Hallyn <serue@us.ibm.com>
    Acked-by: Sukadev Bhattiprolu <sukadev@linux.vnet.ibm.com>
    Acked-by: Pavel Emelyanov <xemul@openvz.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit e385ea63f44b475e034a78b6d8bc6bb50caf72ca
Author: David Brownell <dbrownell@users.sourceforge.net>
Date:   Tue Sep 2 14:35:46 2008 -0700

    mmc: at91_mci: don't use coherent dma buffers
    
    At91_mci is abusing dma_free_coherent(), which may not be called with IRQs
    disabled.  I saw "mkfs.ext3" on an MMC card objecting voluminously as each
    write completed:
    
     WARNING: at arch/arm/mm/consistent.c:368 dma_free_coherent+0x2c/0x224()
     [<c002726c>] (dump_stack+0x0/0x14) from [<c00387d4>] (warn_on_slowpath+0x4c/0x68)
     [<c0038788>] (warn_on_slowpath+0x0/0x68) from [<c0028768>] (dma_free_coherent+0x2c/0x224)
      r6:00008008 r5:ffc06000 r4:00000000
     [<c002873c>] (dma_free_coherent+0x0/0x224) from [<c01918ac>] (at91_mci_irq+0x374/0x420)
     [<c0191538>] (at91_mci_irq+0x0/0x420) from [<c0065d9c>] (handle_IRQ_event+0x2c/0x6c)
     ...
    
    This bug has been around for a LONG time.  The MM warning is from late
    2005, but the driver merged a year later ...  so I'm puzzled why nobody
    noticed this before now.
    
    The fix involves noting that this buffer shouldn't be DMA-coherent; it's
    just used for normal DMA writes.  So replace it with standard kmalloc()
    buffering and DMA mapping calls.
    
    This is the quickie fix.  A better one would not rely on allocating large
    bounce buffers.  (Note that dma_alloc_coherent could have failed too, but
    that case was ignored...  kmalloc is a bit more likely to fail though.)
    
    Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
    Acked-by: Pierre Ossman <drzeus-mmc@drzeus.cx>
    Cc: Andrew Victor <linux@maxim.org.za>
    Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Cc: Russell King <rmk@arm.linux.org.uk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 363f66fe06c75270b669c88e321e6b354ba0201e
Author: Will Newton <will.newton@gmail.com>
Date:   Tue Sep 2 14:35:44 2008 -0700

    8250: improve workaround for UARTs that don't re-assert THRE correctly
    
    Recent changes to tighten the check for UARTs that don't correctly
    re-assert THRE (01c194d9278efc15d4785ff205643e9c0bdcef53: "serial 8250:
    tighten test for using backup timer") caused problems when such a UART was
    opened for the second time - the bug could only successfully be detected
    at first initialization.  For users of this version of this particular
    UART IP it is fatal.
    
    This patch stores the information about the bug in the bugs field of the
    port structure when the port is first started up so subsequent opens can
    check this bit even if the test for the bug fails.
    
    David Brownell: "My own exposure to this is that the UART on DaVinci
    hardware, which TI allegedly derived from its original 16550 logic, has
    periodically gone from working to unusable with the mainline 8250.c ...
    and back and forth a bunch.  Currently it's "unusable", a regression from
    some previous versions.  With this patch from Will, it's usable."
    
    Signed-off-by: Will Newton <will.newton@gmail.com>
    Acked-by: Alex Williamson <alex.williamson@hp.com>
    Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
    Cc: David Brownell <david-b@pacbell.net>
    Cc: <stable@kernel.org>		[2.6.26.x]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit bd7aa4b2dafd8e653df265479d99c80747602a50
Author: Henrik Rydberg <rydberg@euromail.se>
Date:   Tue Sep 2 14:35:43 2008 -0700

    MAINTAINERS: add a maintainer for the BCM5974 multitouch driver
    
    Signed-off-by: Henrik Rydberg <rydberg@euromail.se>
    Cc: Dmitry Torokhov <dtor@mail.ru>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 527655835ebac8f58a8f800a10700712a4c2affd
Author: Marcin Slusarz <marcin.slusarz@gmail.com>
Date:   Tue Sep 2 14:35:41 2008 -0700

    mm/bootmem: silence section mismatch warning - contig_page_data/bootmem_node_data
    
    WARNING: vmlinux.o(.data+0x1f5c0): Section mismatch in reference from the variable contig_page_data to the variable .init.data:bootmem_node_data
    The variable contig_page_data references
    the variable __initdata bootmem_node_data
    If the reference is valid then annotate the
    variable with __init* (see linux/init.h) or name the variable:
    *driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console,
    
    Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
    Cc: Johannes Weiner <hannes@saeurebad.de>
    Cc: Sean MacLennan <smaclennan@pikatech.com>
    Cc: Sam Ravnborg <sam@ravnborg.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 39dbbb4523754df4a822c69191a848a03e556dc7
Author: Russ Dill <russ.dill@gmail.com>
Date:   Tue Sep 2 14:35:40 2008 -0700

    acer-wmi: remove debugfs entries upon unloading
    
    The exit function neglects to remove debugfs entries, leading to a BUG
    on reload.
    
    [akpm@linux-foundation.org: cleanups]
    Signed-off-by: Russ Dill <Russ.Dill@gmail.com>
    Acked-by: Carlos Corbacho <carlos@strangeworlds.co.uk>
    Cc: Andi Kleen <ak@linux.intel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 6ccfa806a9cfbbf1cd43d5b6aa47ef2c0eb518fd
Author: Hisashi Hifumi <hifumi.hisashi@oss.ntt.co.jp>
Date:   Tue Sep 2 14:35:40 2008 -0700

    VFS: fix dio write returning EIO when try_to_release_page fails
    
    Dio write returns EIO when try_to_release_page fails because bh is
    still referenced.
    
    The patch
    
        commit 3f31fddfa26b7594b44ff2b34f9a04ba409e0f91
        Author: Mingming Cao <cmm@us.ibm.com>
        Date:   Fri Jul 25 01:46:22 2008 -0700
    
            jbd: fix race between free buffer and commit transaction
    
    was merged into 2.6.27-rc1, but I noticed that this patch is not enough
    to fix the race.
    
    I did fsstress test heavily to 2.6.27-rc1, and found that dio write still
    sometimes got EIO through this test.
    
    The patch above fixed race between freeing buffer(dio) and committing
    transaction(jbd) but I discovered that there is another race, freeing
    buffer(dio) and ext3/4_ordered_writepage.
    
    : background_writeout()
         ->write_cache_pages()
           ->ext3_ordered_writepage()
         	   walk_page_buffers() -> take a bh ref
     	   block_write_full_page() -> unlock_page
    		: <- end_page_writeback
                    : <- race! (dio write->try_to_release_page fails)
          	   walk_page_buffers() ->release a bh ref
    
    ext3_ordered_writepage holds bh ref and does unlock_page remaining
    taking a bh ref, so this causes the race and failure of
    try_to_release_page.
    
    To fix this race, I used the approach of falling back to buffered
    writes if try_to_release_page() fails on a page.
    
    [akpm@linux-foundation.org: cleanups]
    Signed-off-by: Hisashi Hifumi <hifumi.hisashi@oss.ntt.co.jp>
    Cc: Chris Mason <chris.mason@oracle.com>
    Cc: Jan Kara <jack@suse.cz>
    Cc: Mingming Cao <cmm@us.ibm.com>
    Cc: Zach Brown <zach.brown@oracle.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 344c790e3821dac37eb742ddd0b611a300f78b9a
Author: Adam Litke <agl@us.ibm.com>
Date:   Tue Sep 2 14:35:38 2008 -0700

    mm: make setup_zone_migrate_reserve() aware of overlapping nodes
    
    I have gotten to the root cause of the hugetlb badness I reported back on
    August 15th.  My system has the following memory topology (note the
    overlapping node):
    
                Node 0 Memory: 0x8000000-0x44000000
                Node 1 Memory: 0x0-0x8000000 0x44000000-0x80000000
    
    setup_zone_migrate_reserve() scans the address range 0x0-0x8000000 looking
    for a pageblock to move onto the MIGRATE_RESERVE list.  Finding no
    candidates, it happily continues the scan into 0x8000000-0x44000000.  When
    a pageblock is found, the pages are moved to the MIGRATE_RESERVE list on
    the wrong zone.  Oops.
    
    setup_zone_migrate_reserve() should skip pageblocks in overlapping nodes.
    
    Signed-off-by: Adam Litke <agl@us.ibm.com>
    Acked-by: Mel Gorman <mel@csn.ul.ie>
    Cc: Dave Hansen <dave@linux.vnet.ibm.com>
    Cc: Nishanth Aravamudan <nacc@us.ibm.com>
    Cc: Andy Whitcroft <apw@shadowen.org>
    Cc: <stable@kernel.org>		[2.6.25.x, 2.6.26.x]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 169ccbd44eb20f5bb7e4352451eba25397e29749
Author: Adrian Bunk <bunk@kernel.org>
Date:   Tue Sep 2 14:35:37 2008 -0700

    NTFS: update homepage
    
    Update the location of the NTFS homepage in several files.
    
    Signed-off-by: Adrian Bunk <bunk@kernel.org>
    Cc: Jeff Garzik <jeff@garzik.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 06770843c2f0f929a6e0c758dc433902a01aabfb
Author: Breno Leitao <leitao@linux.vnet.ibm.com>
Date:   Tue Sep 2 17:28:58 2008 -0700

    ipv: Re-enable IP when MTU > 68
    
    Re-enable IP when the MTU gets back to a valid size.
    
    This patch just checks if the in_dev is NULL on a NETDEV_CHANGEMTU event
    and if MTU is valid (bigger than 68), then re-enable in_dev.
    
    Also a function that checks valid MTU size was created.
    
    Signed-off-by: Breno Leitao <leitao@linux.vnet.ibm.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 9d7d74029e0f5fde3b88b39892b9b9cfdf4ea10a
Author: Julien Brunel <brunel@diku.dk>
Date:   Tue Sep 2 17:24:28 2008 -0700

    net/xfrm: Use an IS_ERR test rather than a NULL test
    
    In case of error, the function xfrm_bundle_create returns an ERR
    pointer, but never returns a NULL pointer. So a NULL test that comes
    after an IS_ERR test should be deleted.
    
    The semantic match that finds this problem is as follows:
    (http://www.emn.fr/x-info/coccinelle/)
    
    // <smpl>
    @match_bad_null_test@
    expression x, E;
    statement S1,S2;
    @@
    x =  xfrm_bundle_create(...)
    ... when != x = E
    *  if (x != NULL)
    S1 else S2
    // </smpl>
    
    Signed-off-by: Julien Brunel <brunel@diku.dk>
    Signed-off-by: Julia Lawall <julia@diku.dk>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 773b4e02be28220e9ead80a5fdb180031361439a
Author: Senthil Balasubramanian <senthilkumar@atheros.com>
Date:   Mon Sep 1 19:58:20 2008 +0530

    ath9: Fix ath_rx_flush_tid() for IRQs disabled kernel warning message.
    
    This patch addresses an issue with the locking order. ath_rx_flush_tid()
    uses spin_lock/unlock_bh when IRQs are disabled in sta_notify by mac80211.
    
    As node clean up is still pending with ath9k and this problematic portion
    of the code is expected to change anyway, thinking of a proper fix may not
    be worthwhile. So having this interim fix helps the users to get rid of the
    kernel warning message.
    
    Pasted the kernel warning message for reference.
    
    kernel: ath0: No ProbeResp from current AP 00:1b:11:60:7a:3d - assume out of range
    kernel: ------------[ cut here ]------------
    kernel: WARNING: at kernel/softirq.c:136 local_bh_enable+0x3c/0xab()
    kernel: Pid: 1029, comm: ath9k Not tainted 2.6.27-rc4-wt-w1fi-wl
    kernel:
    kernel: Call Trace:
    kernel:  [<ffffffff802278d8>] warn_on_slowpath+0x51/0x77
    kernel:  [<ffffffff80224c51>] check_preempt_wakeup+0xf3/0x123
    kernel:  [<ffffffff80239658>] autoremove_wake_function+0x9/0x2e
    kernel:  [<ffffffff8022c281>] local_bh_enable+0x3c/0xab
    kernel:  [<ffffffffa01ab75a>] ath_rx_node_cleanup+0x38/0x6e [ath9k]
    kernel:  [<ffffffffa01b2280>] ath_node_detach+0x3b/0xb6 [ath9k]
    kernel:  [<ffffffffa01ab09f>] ath9k_sta_notify+0x12b/0x165 [ath9k]
    kernel:  [<ffffffff802366cf>] queue_work+0x1d/0x49
    kernel:  [<ffffffffa018c3fc>] add_todo+0x70/0x99 [mac80211]
    kernel:  [<ffffffffa017de76>] __sta_info_unlink+0x16b/0x19e [mac80211]
    kernel:  [<ffffffffa017e6ed>] sta_info_unlink+0x18/0x43 [mac80211]
    kernel:  [<ffffffffa0182732>] ieee80211_associated+0xaa/0x16d [mac80211]
    kernel:  [<ffffffffa0184a1a>] ieee80211_sta_work+0x4fb/0x6b4 [mac80211]
    kernel:  [<ffffffff80469c58>] thread_return+0x30/0xa9
    kernel:  [<ffffffffa018451f>] ieee80211_sta_work+0x0/0x6b4 [mac80211]
    kernel:  [<ffffffff802362c2>] run_workqueue+0xb1/0x17a
    kernel:  [<ffffffff80236be9>] worker_thread+0xd0/0xdb
    kernel:  [<ffffffff8023964f>] autoremove_wake_function+0x0/0x2e
    kernel:  [<ffffffff80236b19>] worker_thread+0x0/0xdb
    kernel:  [<ffffffff8023954a>] kthread+0x47/0x75
    kernel:  [<ffffffff80223121>] schedule_tail+0x18/0x50
    kernel:  [<ffffffff8020bc49>] child_rip+0xa/0x11
    kernel:  [<ffffffff80239503>] kthread+0x0/0x75
    kernel:  [<ffffffff8020bc3f>] child_rip+0x0/0x11
    kernel:
    kernel: ---[ end trace e9bb5da661055827 ]---
    
    Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 1b96175b7e5801a908718d8b5270a4f7d94fed28
Author: Senthil Balasubramanian <senthilkumar@atheros.com>
Date:   Mon Sep 1 19:45:21 2008 +0530

    ath9k: Incorrect key used when group and pairwise ciphers are different.
    
    Updating sc_keytype multiple times when groupwise and pairwise
    ciphers are different results in incorrect pairwise key type
    assumed for TX control and normal ping fails. This works fine
    for cases where both groupwise and pairwise ciphers are same.
    
    Also use mac80211 provided enums for key length calculation.
    
    Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 445df54fec7c1924f44018c4db2a9613b877f10e
Author: Boaz Harrosh <bharrosh@panasas.com>
Date:   Mon Sep 1 14:47:19 2008 +0300

    rt2x00: Compiler warning unmasked by fix of BUILD_BUG_ON
    
    A "Set" to a sign-bit in an "&" operation causes a compiler warning.
    Make calculations unsigned.
    
    [ The warning was masked by the old definition of BUILD_BUG_ON() ]
    
    Also remove __builtin_constant_p from FIELD_CHECK since BUILD_BUG_ON
    no longer permits non-const values.
    
    Signed-off-by: Boaz Harrosh <bharrosh@panasas.com>
    CC: Ingo Molnar <mingo@elte.hu>
    CC: Rusty Russell <rusty@rustcorp.com.au>
    Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 2b58b209399844995ad48e421267e359e16c03db
Author: Jouni Malinen <jouni.malinen@atheros.com>
Date:   Thu Aug 28 15:12:06 2008 +0300

    mac80211: Fix debugfs union misuse and pointer corruption
    
    debugfs union in struct ieee80211_sub_if_data is misused by including a
    common default_key dentry as a union member. This ends occupying the same
    memory area with the first dentry in other union members (structures;
    usually drop_unencrypted). Consequently, debugfs operations on
    default_key symlinks and drop_unencrypted entry are using the same
    dentry pointer even though they are supposed to be separate ones. This
    can lead to removing entries incorrectly or potentially leaving
    something behind since one of the dentry pointers gets lost.
    
    Fix this by moving the default_key dentry to a new struct
    (common_debugfs) that contains dentries (more to be added in future)
    that are shared by all vif types. The debugfs union must only be used
    for vif type-specific entries to avoid this type of pointer corruption.
    
    Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com>
    Acked-by: Johannes Berg <johannes@sipsolutions.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 9a52028e534b0567913a4144060e774891c00a37
Author: Adrian Bunk <bunk@kernel.org>
Date:   Thu Aug 28 01:05:08 2008 +0300

    wireless/libertas/if_cs.c: fix memory leaks
    
    The leak in if_cs_prog_helper() is obvious.
    
    It looks a bit as if not freeing "fw" in if_cs_prog_real() was done
    intentionally, but I'm not seeing why it shouldn't be freed.
    
    Reported-by: Adrian Bunk <bunk@kernel.org>
    Signed-off-by: Adrian Bunk <bunk@kernel.org>
    Acked-by: Holger Schurig <hs4233@mail.mn-solutions.de>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 667d41008eb8a0e1d495d6c0a6143b43fe587c98
Author: David Kilroy <kilroyd@gmail.com>
Date:   Sat Aug 23 19:03:34 2008 +0100

    orinoco: Multicast to the specified addresses
    
    When multicasting the driver sets the number of group addresses using
    the count from the previous set multicast command. In general this means
    you have to set the multicast addresses twice to get the behaviour you
    want.
    
    If we were multicasting, and reduce the number of addresses we are
    multicasting to, then the driver would write uninitialised data from the
    stack into the group addresses to multicast to.
    
    Only write the multicast addresses we have specifically set.
    
    Signed-off-by: David Kilroy <kilroyd@gmail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit f0b9f5cb4adcec9424142592ca7bf024fe6c91a9
Author: Tomas Winkler <tomas.winkler@intel.com>
Date:   Thu Aug 28 17:25:10 2008 +0800

    iwlwifi: fix 64bit platform firmware loading
    
    This patch fixes loading firmware from memory above 32bit.
    
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Acked-by: Marcel Holtmann <holtmann@linux.intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 1d3e6c61342292140dfe1b921991ee793ec1e0ae
Author: Mohamed Abbas <mohamed.abbas@intel.com>
Date:   Thu Aug 28 17:25:05 2008 +0800

    iwlwifi: fix apm_stop (wrong bit polarity for FLAG_INIT_DONE)
    
    The patch fixes CSR_GP_CNTRL_REG_FLAG_INIT_DONE was set instead of
    cleared which disabled moving device to D0U state.
    
    Signed-off-by: Mohamed Abbas <mohamed.abbas@intel.com>
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit cf88c433bf64b6f7395a39f840bec88a8c58b58b
Author: Tomas Winkler <tomas.winkler@intel.com>
Date:   Thu Aug 28 17:25:04 2008 +0800

    iwlwifi: workaround interrupt handling no some platforms
    
    This patch adds workaround for an interrupt related hardware bug on
    some platforms.  (Apparently these platforms boot-up w/ INTX_DISABLED
    set. -- JWL)
    
    Signed-off-by: Tomas Winkler <tomas.winkler@intel.com>
    Signed-off-by: Zhu Yi <yi.zhu@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 49898852e6aa8a6de9a5bc0bab2cf305b3583bbf
Author: John W. Linville <linville@tuxdriver.com>
Date:   Tue Sep 2 15:07:18 2008 -0400

    iwlwifi: do not use GFP_DMA in iwl_tx_queue_init
    
    GFP_DMA is not necessary for the iwlwifi hardware and it can cause
    allocation failures and/or invoke the OOM killer on lots of systems.
    
    For reference:
    
    	https://bugzilla.redhat.com/show_bug.cgi?id=459709
    
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit d9664741e0e2216770d6e52646474d3982b8eb55
Author: Florian Mickler <florian@mickler.org>
Date:   Tue Sep 2 15:26:34 2008 +0200

    net/wireless/Kconfig: clarify the description for CONFIG_WIRELESS_EXT_SYSFS
    
    Current setup with hal and NetworkManager will fail to work
    without newest hal version with this config option disabled.
    
    Although this will solve itself by time, at the moment it is
    dishonest to say that we don't know any software that uses it,
    if there are many many people relying on old hal versions.
    
    Signed-off-by: Florian Mickler <florian@mickler.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit afa153fd7b6afcd55dd6df6aea06bb53aa1d3608
Merge: ba6271e... 5a61dd9...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 2 11:44:11 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
      ide/Kconfig: mark ide-scsi as deprecated
      ide-disk: remove stale init_idedisk_capacity() documentation
      palm_bk3710: improve IDE registration
      ide: fix hwif_to_node()
      IDE: palm_bk3710: fix compile warning for unused variable
      IDE: compile fix for sff_dma_ops

commit 5a61dd9ec8c5a8e14fbccda3ab042555b692b9b2
Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Date:   Tue Sep 2 20:18:48 2008 +0200

    ide/Kconfig: mark ide-scsi as deprecated
    
    Mark ide-scsi as deprecated and remove stale/bogus documentation.
    
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit ab1b67a6230648cf65b0342d9887fee890160ca8
Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Date:   Tue Sep 2 20:18:47 2008 +0200

    ide-disk: remove stale init_idedisk_capacity() documentation
    
    Acked-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit bfc2f01fc83f982344f09f491f7c18a6b9a16aa8
Author: David Brownell <dbrownell@users.sourceforge.net>
Date:   Tue Sep 2 20:18:47 2008 +0200

    palm_bk3710: improve IDE registration
    
    * fix device tree ... don't forget to set the parent device
    
    * let init/exit code be removed where practical
    
    Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
    [bart: splitted it from bigger DaVinci patch, s/hw.parent/hw.dev/]
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit 96f80219b738f84f90e449385bdede90f2910521
Author: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Date:   Tue Sep 2 20:18:47 2008 +0200

    ide: fix hwif_to_node()
    
    hwif_to_node() incorrectly assumes that hwif->dev always belongs to
    a PCI device.  This results in ide-cs oopsing in init_irq() after
    commit c56c5648a3bd15ff14c50f284b261140cd5b5472 accidentally fixed
    device tree registration for ide-cs.  Fix it by using dev_to_node().
    
    Thanks to Martin Michlmayr and Larry Finger for help with debugging
    the issue.
    
    Reported-by: Martin Michlmayr <tbm@cyrius.com>
    Tested-by: Martin Michlmayr <tbm@cyrius.com>
    Cc: Larry Finger <Larry.Finger@lwfinger.net>
    Cc: Dominik Brodowski <linux@dominikbrodowski.net>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit a1aee8622293138867e7dbd1dd214dfb34cd89d2
Author: Kevin Hilman <khilman@deeprootsystems.com>
Date:   Tue Sep 2 20:18:47 2008 +0200

    IDE: palm_bk3710: fix compile warning for unused variable
    
    Signed-off-by: Kevin Hilman <khilman@deeprootsystems.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit 71fc9fcc70e6ad96215510c1dbcbade05cd95e41
Author: Kevin Hilman <khilman@deeprootsystems.com>
Date:   Tue Sep 2 20:18:46 2008 +0200

    IDE: compile fix for sff_dma_ops
    
    The sff_dma_ops struct should be wrapped by BLK_DEV_IDEDMA_SFF instead
    of BLK_DEV_IDEDMA_PCI.
    
    Signed-off-by: Kevin Hilman <khilman@deeprootsystems.com>
    Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit ba6271ea6324decab4c47c4a55de95188d930792
Merge: 99039e1... ee979a1...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 2 11:05:42 2008 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
      ALSA: hda - Add mic-boost controls to ALC662/663 auto configuration
      ALSA: hda - Fix ALC663 auto-probe
      ALSA: ASoC: fix pxa2xx-i2s clk_get call
      ALSA: hda: Distortion fix for dell_m6_core_init

commit 99039e1352fa451bd46e2c020dc78bcaf2a159d9
Merge: 72a8d12... c4bacef...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 2 11:04:47 2008 -0700

    Merge branch 'audit.b57' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current
    
    * 'audit.b57' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/audit-current:
      [PATCH] audit: Moved variable declaration to beginning of function

commit 72a8d129cf5811b77f0d6c8acef9ac34a12bccf4
Merge: 7ed77e8... b2d2c4c...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 2 11:04:09 2008 -0700

    Merge branch 'for-linus' of git://neil.brown.name/md
    
    * 'for-linus' of git://neil.brown.name/md:
      Fix problem with waiting while holding rcu read lock in md/bitmap.c
      Remove invalidate_partition call from do_md_stop.

commit 7ed77e804650b9095f862a0cfeecaa955224a73e
Author: Arjan van de Ven <arjan@infradead.org>
Date:   Mon Sep 1 15:09:51 2008 -0700

    don't diff generated firmware files
    
    With the new firmware infrastructure in 2.6.27, some files are generated and shouldn't be
    diffed; add these 2 to the "dontdiff" file
    
    Signed-off-by: Arjan van de Ven <arjan@Linux.intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 3df8a905ed09341041a3d1c6309fdb18cc809297
Author: Dennis Jansen <dennis.jansen@web.de>
Date:   Fri Aug 15 01:28:57 2008 +0200

    ACPI: Fix typo in "Disable MWAIT via DMI on broken Compal board"
    
    This fixes a typo in commit 2a2a64714d9c40f7705c4de1e79a5b855c7211a9 "Disable MWAIT via DMI on broken Compal board".
    
    It allows the nomwait dmi check to actually detect the Acer 5220.
    
    Signed-off-by: Dennis Jansen <dennis.jansen@web.de>
    Tested-by: Dennis Jansen <dennis.jansen@web.de>
    Acked-by: Zhao Yakui <yakui.zhao@intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 919fae1686881ed3922ea9de5b0c0a4feff3069e
Merge: e77295d... b67c5f8...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 2 10:59:27 2008 -0700

    Merge git://git.infradead.org/users/dwmw2/random-2.6
    
    * git://git.infradead.org/users/dwmw2/random-2.6:
      [MTD] mtdchar.c: Fix regression in MEMGETREGIONINFO ioctl()
      dabusb_fpga_download(): fix a memory leak
      Remove '#include <stddef.h>' from mm/page_isolation.c
      Fix modules_install on RO nfs-exported trees.

commit e77295dc9e6b52281ae85af4068f13752524e9f4
Merge: 1136cf1... 91b8096...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 2 10:58:11 2008 -0700

    Merge branch 'for-2.6.27' of git://linux-nfs.org/~bfields/linux
    
    * 'for-2.6.27' of git://linux-nfs.org/~bfields/linux:
      nfsd: fix buffer overrun decoding NFSv4 acl
      sunrpc: fix possible overrun on read of /proc/sys/sunrpc/transports
      nfsd: fix compound state allocation error handling
      svcrdma: Fix race between svc_rdma_recvfrom thread and the dto_tasklet

commit 1136cf11066a32d4ac2a476dac302858d763703d
Author: Michael Schmitz <schmitz@biophys.uni-duesseldorf.de>
Date:   Mon Sep 1 20:27:02 2008 +0200

    m68k: atari_keyb_init operator precedence fix
    
    Fix operator precedence bug in atari_keyb_init, which caused a failure on CT60
    
    Signed-off-by: Michael Schmitz <schmitz@debian.org>
    Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 2ecbf813d5e6361eb7c7520a6f5e6afa168df39a
Author: Stephen Rothwell <sfr@canb.auug.org.au>
Date:   Tue Sep 2 03:43:27 2008 +1000

    fix typo in arch/parisc/hpux/fs.c
    
    A parisc allmodconfig build produces this:
    
    arch/parisc/hpux/fs.c:107: error: 'buffer' undeclared (first use in this function)
    
    Introduced by commit da574983de9f9283ba35662c8723627096e160de ("[PATCH]
    fix hpux_getdents()").
    
    Helge Dille also reported this in bugzilla 11461:
    
    	http://bugzilla.kernel.org/show_bug.cgi?id=11461
    
    and he posted an identical patch.
    
    Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
    Signed-off-by: Helge Deller <deller@gmx.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit cbaed698f37494b30b2449b51c728ae48630cb2b
Author: Oleg Nesterov <oleg@tv-sign.ru>
Date:   Sat Aug 30 21:08:40 2008 +0400

    softlockup: minor cleanup, don't check task->state twice
    
    The recent commit 16d9679f33caf7e683471647d1472bfe133d858 changed
    check_hung_task() to filter out the TASK_KILLABLE tasks. We can
    move this check to the caller which has to test t->state anyway.
    
    Signed-off-by: Oleg Nesterov <oleg@tv-sign.ru>
    Acked-by: Andi Kleen <ak@linux.intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 6781f4ae30bbb8ebf31187b3c9304be16966f5a0
Author: Randy Dunlap <randy.dunlap@oracle.com>
Date:   Sun Aug 31 20:31:55 2008 -0700

    kernel/resource.c: fix new kernel-doc warning
    
    Fix kernel-doc warning for new function:
    
    Warning(linux-2.6.27-rc5-git2//kernel/resource.c:448): No description found for parameter 'root'
    
    Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 6b9886a173ff6c9ed528979c4d0a3566c1f61013
Merge: 6ffbb19... 6c7be29...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 2 10:46:56 2008 -0700

    Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6
    
    * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
      drm/radeon: downgrade debug message from info to debug.

commit 6ffbb1964afe1236951f7ac30aa0ed202673e374
Merge: 1586553... c76da9d...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 2 10:45:59 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6:
      [CIFS] Turn off Unicode during session establishment for plaintext authentication
      [CIFS] update cifs change log
      cifs: fix O_APPEND on directio mounts
      [CIFS] Fix plaintext authentication

commit 1586553bc840e17c321f244fc264ea8312678faf
Merge: 44e7ed3... ddef43a...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 2 10:45:01 2008 -0700

    Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block
    
    * 'for-linus' of git://git.kernel.dk/linux-2.6-block:
      block: restore original behavior of /proc/partition when there's no partition
      remove blk_register_filter and blk_unregister_filter in gendisk

commit 44e7ed396114a0c43bb2494877aceeb7782e084a
Merge: 011fec7... dbb8c35...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 2 10:43:38 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
      sparc64: setup_valid_addr_bitmap_from_pavail() should be __init
      sparc: Fix resource flags for PCI children in OF device tree.
      sparc32: Implement smp_call_function_single().

commit 011fec7486028977e2b4012afb84235759c6ad82
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 2 10:38:28 2008 -0700

    Un-break printk strings in x86 PCI probing code
    
    Breaking lines due to some imaginary problem with a long line length is
    often stupid and wrong, but never more so when it splits a string that
    is printed out into multiple lines.  This really ended up making it much
    harder to find where some error strings were printed out, because a
    simple 'grep' didn't work.
    
    I'm sure there is tons more of this particular idiocy hiding in other
    places, but this particular case hit me once more last week. So fix it.
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit ee979a143cfd999adea8a9e272649a3cd9ec84bc
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Sep 2 15:42:20 2008 +0200

    ALSA: hda - Add mic-boost controls to ALC662/663 auto configuration
    
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 24fb9173815045ab3f85a670d7df8af5af6ff3be
Author: Takashi Iwai <tiwai@suse.de>
Date:   Tue Sep 2 14:48:20 2008 +0200

    ALSA: hda - Fix ALC663 auto-probe
    
    Fix the wrong DAC assignment for NID 0x17 mono-pin on ALC663.
    
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit b67c5f87c13f398ec3f4d6b455cb0bbeda8d7ac0
Author: Zev Weiss <zevweiss@gmail.com>
Date:   Mon Sep 1 05:02:12 2008 -0700

    [MTD] mtdchar.c: Fix regression in MEMGETREGIONINFO ioctl()
    
    The MEMGETREGIONINFO ioctl() in mtdchar.c was clobbering user memory by
    overwriting more than intended, due the size of struct mtd_erase_region_info
    changing in commit 0ecbc81adfcb9f15f86b05ff576b342ce81bbef8 ('Support
    for auto locking flash on power up').
    
    Fix avoids this by copying struct members one by one with put_user(), as there
    is no longer a convenient struct to use the size of as the length argument to
    copy_to_user().
    
    Signed-off-by: Zev Weiss <zevweiss@gmail.com>
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

commit 02c0267a40c876a4d70f2000f21fe9ff89fb988e
Author: Adrian Bunk <bunk@kernel.org>
Date:   Thu Aug 28 01:04:30 2008 +0300

    dabusb_fpga_download(): fix a memory leak
    
    This patch fixes a memory leak in an error path.
    
    Reported-by: Adrian Bunk <bunk@kernel.org>
    Signed-off-by: Adrian Bunk <bunk@kernel.org>
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

commit 0ed97ee470c36e05bcaad36c4fb4c501f383ce63
Author: David Woodhouse <David.Woodhouse@intel.com>
Date:   Mon Sep 1 11:10:28 2008 +0100

    Remove '#include <stddef.h>' from mm/page_isolation.c
    
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

commit 1cede1affb3cc5a9520fdbc75b3fbaa6432cbc5a
Author: David Woodhouse <David.Woodhouse@intel.com>
Date:   Mon Sep 1 10:54:46 2008 +0100

    Fix modules_install on RO nfs-exported trees.
    
    Fixes http://bugzilla.kernel.org/show_bug.cgi?id=11355 by avoiding a
    needless rebuild of the firmware/ihex2fw tool.
    
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

commit c4bacefb7aaf49da11a695f29d85d40909f17693
Author: Cordelia <cordsam@linux.vnet.ibm.com>
Date:   Mon Aug 18 09:45:51 2008 -0700

    [PATCH] audit: Moved variable declaration to beginning of function
    
    got rid of compilation warning:
    ISO C90 forbids mixed declarations and code
    
    Signed-off-by: Cordelia Sam <cordesam@gmail.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

commit 91b80969ba466ba4b915a4a1d03add8c297add3f
Author: J. Bruce Fields <bfields@citi.umich.edu>
Date:   Fri Aug 29 19:18:45 2008 -0400

    nfsd: fix buffer overrun decoding NFSv4 acl
    
    The array we kmalloc() here is not large enough.
    
    Thanks to Johann Dahm and David Richter for bug report and testing.
    
    Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
    Cc: David Richter <richterd@citi.umich.edu>
    Tested-by: Johann Dahm <jdahm@umich.edu>

commit 27df6f25ff218072e0e879a96beeb398a79cdbc8
Author: Cyrill Gorcunov <gorcunov@gmail.com>
Date:   Sun Aug 31 19:25:49 2008 +0400

    sunrpc: fix possible overrun on read of /proc/sys/sunrpc/transports
    
    Vegard Nossum reported
    ----------------------
    > I noticed that something weird is going on with /proc/sys/sunrpc/transports.
    > This file is generated in net/sunrpc/sysctl.c, function proc_do_xprt(). When
    > I "cat" this file, I get the expected output:
    >    $ cat /proc/sys/sunrpc/transports
    >    tcp 1048576
    >    udp 32768
    
    > But I think that it does not check the length of the buffer supplied by
    > userspace to read(). With my original program, I found that the stack was
    > being overwritten by the characters above, even when the length given to
    > read() was just 1.
    
    David Wagner added (among other things) that copy_to_user could be
    probably used here.
    
    Ingo Oeser suggested to use simple_read_from_buffer() here.
    
    The conclusion is that proc_do_xprt doesn't check for userside buffer
    size indeed so fix this by using Ingo's suggestion.
    
    Reported-by: Vegard Nossum <vegard.nossum@gmail.com>
    Signed-off-by: Cyrill Gorcunov <gorcunov@gmail.com>
    CC: Ingo Oeser <ioe-lkml@rameria.de>
    Cc: Neil Brown <neilb@suse.de>
    Cc: Chuck Lever <chuck.lever@oracle.com>
    Cc: Greg Banks <gnb@sgi.com>
    Cc: Tom Tucker <tom@opengridcomputing.com>
    Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>

commit c228c24bf1138d4757dbe20615df655815446da3
Author: Andy Adamson <andros@netapp.com>
Date:   Thu Aug 21 08:42:16 2008 -0400

    nfsd: fix compound state allocation error handling
    
    Move the cstate_alloc call so that if it fails, the response is setup to
    encode the NFS error. The out label now means that the
    nfsd4_compound_state has not been allocated.
    
    Signed-off-by: Andy Adamson <andros@netapp.com>
    Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>

commit ddef43a843f620c6742a06633739887a901ec06b
Author: Tejun Heo <tj@kernel.org>
Date:   Mon Sep 1 08:55:10 2008 +0200

    block: restore original behavior of /proc/partition when there's no partition
    
    /proc/partitions didn't use to write out the header if there was no
    partition.  However, recent commit 66c64afe changed the behavior.
    This is nothing major but there's no reason to change user visible
    behavior without a good rationale.  Restore the original behavior.
    
    Note that 2.6.28 has clean up changes scheduled which will replace
    this rather hacky implementation.
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: Greg KH <greg@kroah.com>
    Cc: Kay Sievers <kay.sievers@vrfy.org>
    Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

commit 6e5ea7015c62b672020ee0a7c2764942fe63fa25
Author: Dmitry Baryshkov <dbaryshkov@gmail.com>
Date:   Sun Aug 31 00:45:02 2008 +0400

    ALSA: ASoC: fix pxa2xx-i2s clk_get call
    
    pxa2xx-i2s: probe actual device and use it for clk_get call
    thus fixing error during startup hook
    
    Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
    Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 20f5f95ded9cdab62c26efb146967a75e12533ec
Author: Matthew Ranostay <mranostay@embeddedalley.com>
Date:   Mon Sep 1 08:17:56 2008 +0200

    ALSA: hda: Distortion fix for dell_m6_core_init
    
    Added the EQ distortion fix to the dell_m6_core_init.
    
    Signed-off-by: Matthew Ranostay <mranostay@embeddedalley.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit b2d2c4ceaddc3098f19637a732f74b820a81a9e7
Author: NeilBrown <neilb@suse.de>
Date:   Mon Sep 1 12:48:13 2008 +1000

    Fix problem with waiting while holding rcu read lock in md/bitmap.c
    
    A recent patch to protect the rdev list with rcu locking leaves us
    with a problem because we can sleep on memalloc while holding the
    rcu lock.
    
    The rcu lock is only needed while walking the linked list as
    uninteresting devices (failed or spares) can be removed at any time.
    
    So only take the rcu lock while actually walking the linked list.
    Take a refcount on the rdev during the time when we drop the lock
    and do the memalloc to start IO.
    When we return to the locked code, all the interesting devices
    on the list will not have moved, so we can simply use
    list_for_each_continue_rcu to pick up where we left off.
    
    Signed-off-by: NeilBrown <neilb@suse.de>

commit 271f5a9b8f8ae0db95de72779d115c9d0b9d3cc5
Author: NeilBrown <neilb@suse.de>
Date:   Mon Sep 1 12:32:52 2008 +1000

    Remove invalidate_partition call from do_md_stop.
    
    When stopping an md array, or just switching to read-only, we
    currently call invalidate_partition while holding the mddev lock.
    The main reason for this is probably to ensure all dirty buffers
    are flushed (invalidate_partition calls fsync_bdev).
    
    However if any dirty buffers are found, it will almost certainly cause
    a deadlock as starting writeout will require an update to the
    superblock, and performing that updates requires taking the mddev
    lock - which is already held.
    
    This deadlock can be demonstrated by running "reboot -f -n" with
    a root filesystem on md/raid, and some dirty buffers in memory.
    
    All other calls to stop an array should already happen after a flush.
    The normal sequence is to stop using the array (e.g. umount) which
    will cause __blkdev_put to call sync_blockdev.  Then open the
    array and issue the STOP_ARRAY ioctl while the buffers are all still
    clean.
    
    So this invalidate_partition is normally a no-op, except for one case
    where it will cause a deadlock.
    
    So remove it.
    
    This patch possibly addresses the regression recored in
       http://bugzilla.kernel.org/show_bug.cgi?id=11460
    and
       http://bugzilla.kernel.org/show_bug.cgi?id=11452
    
    though it isn't yet clear how it ever worked.
    
    
    Signed-off-by: NeilBrown <neilb@suse.de>

commit 6c7be29810dd85b4fe75588ec536446c1579d492
Author: Dave Airlie <airlied@redhat.com>
Date:   Mon Sep 1 08:51:52 2008 +1000

    drm/radeon: downgrade debug message from info to debug.
    
    If this triggers its bad, however some machines seem to have been
    triggering it for ages and we didn't know until we added the debug.
    
    So downgrade the debug now so people don't call this a regression.
    
    Signed-off-by: Dave Airlie <airlied@redhat.com>

commit dbb8c35d9063fe233626865cc836fbc102fa083b
Author: David S. Miller <davem@davemloft.net>
Date:   Sat Aug 30 02:04:45 2008 -0700

    sparc64: setup_valid_addr_bitmap_from_pavail() should be __init
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit bef69ea0dcce574a425feb0a5aa4c63dd108b9a6
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Aug 29 20:18:31 2008 -0700

    Resource handling: add 'insert_resource_expand_to_fit()' function
    
    Not used anywhere yet, but this complements the existing plain
    'insert_resource()' functionality with a version that can expand the
    resource we are adding in order to fix up any conflicts it has with
    existing resources.
    
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 00aeb429a0f2daeb21979873060b81095cafe4bd
Merge: 316d967... df91bc2...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Aug 29 14:46:49 2008 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
      ALSA: oxygen: fix distorted output on AK4396-based cards
      Revert "ALSA: hda - Added model selection for iMac 24""

commit 316d9679f33caf7e683471647d1472bfe133d858
Author: Andi Kleen <andi@firstfloor.org>
Date:   Fri Aug 29 20:06:23 2008 +0200

    Don't trigger softlockup detector on network fs blocked tasks
    
    Pulling the ethernet cable on a 2.6.27-rc system with NFS mounts
    currently leads to an ongoing flood of soft lockup detector backtraces
    for all tasks blocked on the NFS mounts when the hickup takes
    longer than 120s.
    
    I don't think NFS problems should be all that noisy.
    
    Luckily there's a reasonably easy way to distingush this case.
    
    Don't report task softlockup warnings for tasks in TASK_KILLABLE
    state, which is used by the network file systems.
    
    I believe this patch is a 2.6.27 candidate.
    
    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit b4609472116bb806a95e98d04767189406c74c70
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Aug 29 14:38:03 2008 -0700

    Revert "x86: fix HPET regression in 2.6.26 versus 2.6.25, check hpet against BAR, v3"
    
    This reverts commit a2bd7274b47124d2fc4dfdb8c0591f545ba749dd.
    
    It wasn't really right to begin with (there's a better fix for the
    problem with e820 reservations clashing with PCI BAR's pending), but it
    also actually causes more regressions, so it should be reverted even
    before the better fix is finalized.
    
    Rafael reports that this commit broke AHCI detection, and thus causes
    the kernel to not boot on his quad core test box.
    
    Reported-and-bisected-by: Rafael J. Wysocki <rjw@sisk.pl>
    Cc: Yinghai Lu <yhlu.kernel@gmail.com>
    Cc: David Witbrodt <dawitbro@sbcglobal.net>
    Cc: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 7c19a3d280297d43ef5ff7c6b205dc208a16d3d1
Author: David S. Miller <davem@davemloft.net>
Date:   Fri Aug 29 14:37:23 2008 -0700

    net: Unbreak userspace usage of linux/mroute.h
    
    Nothing in linux/pim.h should be exported to userspace.
    
    This should fix the XORP build failure reported by
    Jose Calhariz, the debain package maintainer.
    
    Nothing originally in linux/mroute.h was exported to userspace
    ever, but some of this stuff started to be when it was moved into
    this new linux/pim.h, and that was wrong.  If we didn't provide these
    definitions for 10 years we can reasonably expect that applications
    defined this stuff locally or used GLIBC headers providing the
    protocol definitions.  And as such the only result of this can
    be conflict and userland build breakage.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 102396ae65108b026e4e1868e30fa013f45a169e
Author: Jarek Poplawski <jarkao2@gmail.com>
Date:   Fri Aug 29 14:21:52 2008 -0700

    pkt_sched: Fix locking of qdisc_root with qdisc_root_sleeping_lock()
    
    Use qdisc_root_sleeping_lock() instead of qdisc_root_lock() where
    appropriate. The only difference is while dev is deactivated, when
    currently we can use a sleeping qdisc with the lock of noop_qdisc.
    This shouldn't be dangerous since after deactivation root lock could
    be used only by gen_estimator code, but looks wrong anyway.
    
    Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 3cc76caa98b092a8fb3e7b4303c70f847db0651f
Author: Yang Hongyang <yanghy@cn.fujitsu.com>
Date:   Fri Aug 29 14:06:51 2008 -0700

    ipv6: When we droped a packet, we should return NET_RX_DROP instead of 0
    
    Signed-off-by: Yang Hongyang <yanghy@cn.fujitsu.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit df91bc23dcb052ff2da71b3482bf3c5fbf4b8a53
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Fri Aug 29 13:08:34 2008 +0200

    ALSA: oxygen: fix distorted output on AK4396-based cards
    
    When changing the sample rate, the CMI8788's master clock output becomes
    unstable for a short time.  The AK4396 needs the master clock to do SPI
    writes, so writing to an AK4396 control register directly after a sample
    rate change will garble the value.  In our case, this leads to the DACs
    being misconfigured to I2S sample format, which results in a wrong
    output level and horrible distortions on samples louder than -6 dB.
    
    To fix this, we need to wait until the new master clock signal has
    become stable before doing SPI writes.
    
    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit bb23b431db7405f6d79f989ad0236bf6428ba1cb
Author: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Date:   Fri Aug 29 11:47:07 2008 +0200

    remove blk_register_filter and blk_unregister_filter in gendisk
    
    This patch remove blk_register_filter and blk_unregister_filter in
    gendisk, and adds them to sd.c, sr.c. and ide-cd.c
    
    The commit abf5439370491dd6fbb4fe1a7939680d2a9bc9d4 moved cmdfilter
    from gendisk to request_queue. It turned out that in some subsystems
    multiple gendisks share a single request_queue. So we get:
    
    Using physmap partition information
    Creating 3 MTD partitions on "physmap-flash":
    0x00000000-0x01c00000 : "User FS"
    0x01c00000-0x01c40000 : "booter"
    kobject (8511c410): tried to init an initialized object, something is seriously wrong.
    Call Trace:
    [<8036644c>] dump_stack+0x8/0x34
    [<8021f050>] kobject_init+0x50/0xcc
    [<8021fa18>] kobject_init_and_add+0x24/0x58
    [<8021d20c>] blk_register_filter+0x4c/0x64
    [<8021c194>] add_disk+0x78/0xe0
    [<8027d14c>] add_mtd_blktrans_dev+0x254/0x278
    [<8027c8f0>] blktrans_notify_add+0x40/0x78
    [<80279c00>] add_mtd_device+0xd0/0x150
    [<8027b090>] add_mtd_partitions+0x568/0x5d8
    [<80285458>] physmap_flash_probe+0x2ac/0x334
    [<802644f8>] driver_probe_device+0x12c/0x244
    [<8026465c>] __driver_attach+0x4c/0x84
    [<80263c64>] bus_for_each_dev+0x58/0xac
    [<802633ec>] bus_add_driver+0xc4/0x24c
    [<802648e0>] driver_register+0xcc/0x184
    [<80100460>] _stext+0x60/0x1bc
    
    In the long term, we need to fix such subsystems but we need a quick
    fix now. This patch add the command filter support to only sd and sr
    though it might be useful for other SG_IO users (such as cciss).
    
    Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
    Reported-by: Manuel Lauss <mano@roarinelk.homelinux.net>
    Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

commit e3c71a32915fabb095de7108c22672e457631a08
Author: David S. Miller <davem@davemloft.net>
Date:   Thu Aug 28 21:02:58 2008 -0700

    sparc: Fix resource flags for PCI children in OF device tree.
    
    When a device is under an EBUS or ISA bus, the resource flags
    don't get set properly.
    
    Fix this by re-evaluating the resource flags at each level of
    bus as we apply ranges on the way to the root.  And let PCI
    override any existing flags setting, but don't let the
    default flags calculator make such overrides.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit c76da9da1fffa6de263486df54950eb328d58f71
Author: Steve French <sfrench@us.ibm.com>
Date:   Thu Aug 28 15:32:22 2008 +0000

    [CIFS] Turn off Unicode during session establishment for plaintext authentication
    
    LANMAN session setup did not support Unicode (after session setup, unicode can
    still be used though).
    
    Fixes samba bug# 5319
    
    CC: Jeff Layton <jlayton@redhat.com>
    CC: Stable Kernel <stable@vger.kernel.org>
    Signed-off-by: Steve French <sfrench@us.ibm.com>

commit 2e655021b8d50b5d90ce442f3de6bf3667729910
Author: Steve French <sfrench@us.ibm.com>
Date:   Thu Aug 28 15:30:06 2008 +0000

    [CIFS] update cifs change log
    
    Signed-off-by: Steve French <sfrench@us.ibm.com>

commit 838726c4756813576078203eb7e1e219db0da870
Author: Jeff Layton <jlayton@redhat.com>
Date:   Thu Aug 28 07:54:59 2008 -0400

    cifs: fix O_APPEND on directio mounts
    
    The direct I/O write codepath for CIFS is done through
    cifs_user_write(). That function does not currently call
    generic_write_checks() so the file position isn't being properly set
    when the file is opened with O_APPEND.  It's also not doing the other
    "normal" checks that should be done for a write call.
    
    The problem is currently that when you open a file with O_APPEND on a
    mount with the directio mount option, the file position is set to the
    beginning of the file. This makes any subsequent writes clobber the data
    in the file starting at the beginning.
    
    This seems to fix the problem in cursory testing. It is, however
    important to note that NFS disallows the combination of
    (O_DIRECT|O_APPEND). If my understanding is correct, the concern is
    races with multiple clients appending to a file clobbering each others'
    data. Since the write model for CIFS and NFS is pretty similar in this
    regard, CIFS is probably subject to the same sort of races. What's
    unclear to me is why this is a particular problem with O_DIRECT and not
    with buffered writes...
    
    Regardless, disallowing O_APPEND on an entire mount is probably not
    reasonable, so we'll probably just have to deal with it and reevaluate
    this flag combination when we get proper support for O_DIRECT. In the
    meantime this patch at least fixes the existing problem.
    
    Signed-off-by: Jeff Layton <jlayton@redhat.com>
    Cc: Stable Tree <stable@kernel.org>
    Signed-off-by: Steve French <sfrench@us.ibm.com>

commit 66e4f8c076f8803e83879d986a7803a918b2129e
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Aug 27 20:03:22 2008 -0700

    sparc32: Implement smp_call_function_single().
    
    Reported by Stephen Rothwell.
    
    Needed to fix the build when CONFIG_RELAY is enabled.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 6405c9cd9bf7b1c35ed76ef8ee3e217056285702
Merge: bcc55c6... 4c246ed...
Author: Steve French <sfrench@us.ibm.com>
Date:   Thu Aug 28 02:47:00 2008 +0000

    Merge branch 'master' of /pub/scm/linux/kernel/git/torvalds/linux-2.6

commit bcc55c6664a90146149ba0fd93052adc94287b9f
Author: Steve French <sfrench@us.ibm.com>
Date:   Wed Aug 27 21:30:22 2008 +0000

    [CIFS] Fix plaintext authentication
    
    The last eight bytes of the password field were not cleared when doing lanman plaintext password authentication. This patch fixes that.
    
    I tested it with Samba by setting password
    encryption to no in the server's smb.conf.  Other servers also can be
    configured to force plaintext authentication.    Note that plaintexti
    authentication requires setting /proc/fs/cifs/SecurityFlags to 0x30030
    on the client (enabling both LANMAN and also plaintext password support).
    Also note that LANMAN support (and thus plaintext password support) requires
    CONFIG_CIFS_WEAK_PW_HASH to be enabled in menuconfig.
    
    CC: Jeff Layton <jlayton@redhat.com>
    CC: Stable Kernel <stable@vger.kernel.org>
    Signed-off-by: Steve French <sfrench@us.ibm.com>

commit 93a1a5eb70be5cc14990b97ef2460212e32658dc
Author: Takashi Iwai <tiwai@suse.de>
Date:   Wed Aug 27 07:56:43 2008 +0200

    Revert "ALSA: hda - Added model selection for iMac 24""
    
    This reverts commit 3e0e469fa216ec70c93b1593821b759d19ee2e6b.
    
    The patch introduced a wrong detection of other intel Macs with
    ALC88* codec because they share the same PCI SSID (but have different
    codec subsystem-IDs).  See http://lkml.org/lkml/2008/8/24/143
    
    Reported-and-tested-by: Guillaume Chazarain <guichaz@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit 24b8b44780a2c53ecb738f4a1c08d114f5eda27c
Author: Tom Tucker <tom@opengridcomputing.com>
Date:   Wed Aug 13 11:05:41 2008 -0500

    svcrdma: Fix race between svc_rdma_recvfrom thread and the dto_tasklet
    
    RDMA_READ completions are kept on a separate queue from the general
    I/O request queue. Since a separate lock is used to protect the RDMA_READ
    completion queue, a race exists between the dto_tasklet and the
    svc_rdma_recvfrom thread where the dto_tasklet sets the XPT_DATA
    bit and adds I/O to the read-completion queue. Concurrently, the
    recvfrom thread checks the generic queue, finds it empty and resets
    the XPT_DATA bit. A subsequent svc_xprt_enqueue will fail to enqueue
    the transport for I/O and cause the transport to "stall".
    
    The fix is to protect both lists with the same lock and set the XPT_DATA
    bit with this lock held.
    
    Signed-off-by: Tom Tucker <tom@opengridcomputing.com>
    Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>