commit 9824b8f11373b0df806c135a342da9319ef1d893
Merge: ab048fb... 9adb8c1...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 19 16:24:03 2008 -0700

    Merge branch 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6
    
    * 'for-linus' of git://git390.osdl.marist.edu/pub/scm/linux-2.6:
      [S390] cio: fix orb initialization in cio_start_key
      [S390] cio: Fix driver_data handling for ccwgroup devices.

commit ab048fb1aafff7883a6bbe62b5354fbc2fa5597c
Merge: 5a0cd4e... 2fd6f6e...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 19 16:21:59 2008 -0700

    Merge git://oss.sgi.com:8090/xfs/linux-2.6
    
    * git://oss.sgi.com:8090/xfs/linux-2.6:
      [XFS] Don't do I/O beyond eof when unreserving space
      [XFS] Fix use-after-free with buffers
      [XFS] Prevent lockdep false positives when locking two inodes.
      [XFS] Fix barrier status change detection.
      [XFS] Prevent direct I/O from mapping extents beyond eof
      [XFS] Fix regression introduced by remount fixup
      [XFS] Move memory allocations for log tracing out of the critical path

commit 5a0cd4eb661fea095ff9962060c21c161a9ed43f
Merge: b4df9d8... 7e2c232...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 19 16:18:21 2008 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
      IPoIB: Fix deadlock on RTNL between bcast join comp and ipoib_stop()
      RDMA/nes: Fix client side QP destroy
      IB/mlx4: Fix up fast register page list format
      mlx4_core: Set RAE and init mtt_sz field in FRMR MPT entries

commit b4df9d88a62c6db4cee0d96507a27527bf205dde
Merge: 902f2ac... ec5d498...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 19 16:17:12 2008 -0700

    Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      sched: fix deadlock in setting scheduler parameter to zero
      sched: fix 2.6.27-rc5 couldn't boot on tulsa machine randomly

commit 902f2ac9da7975a5a04fc835860f2a7096c481d3
Merge: 06d4a22... 2344abb...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 19 16:16:50 2008 -0700

    Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      clockevents: make device shutdown robust
      clocksource, acpi_pm.c: fix check for monotonicity
      clockevents: remove WARN_ON which was used to gather information

commit 06d4a22be3af824cfcbf53ac84d95bd700a949c2
Merge: b971963... ba0593b...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 19 16:11:09 2008 -0700

    Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86: completely disable NOPL on 32 bits
      x86/paravirt: Remove duplicate paravirt_pagetable_setup_{start, done}()
      xen: fix for xen guest with mem > 3.7G
      x86: fix possible x86_64 and EFI regression
      arch/x86/kernel/kdebugfs.c: introduce missing kfree

commit b9719635f85b1d3c54775b53ea45fdd8e7496682
Merge: e72a68f... 2d291e9...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 19 16:05:05 2008 -0700

    Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc
    
    * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc:
      Fix compile failure with non modular builds
      powerpc: Holly board needs dtbImage target
      powerpc: Fix interrupt values for DMA2 in MPC8610 HPCD device tree

commit e72a68fc26887d2097fd7f14794aeb7c17851a5d
Merge: 1cce92a... 58005b3...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 19 16:04:42 2008 -0700

    Merge master.kernel.org:/home/rmk/linux-2.6-arm
    
    * master.kernel.org:/home/rmk/linux-2.6-arm:
      [ARM] 5255/1: Update jornada ssp to remove build errors/warnings
      [ARM] omap: back out 'internal_clock' support
      [ARM] 5249/1: davinci: remove redundant check in davinci_psc_config()

commit 1cce92aef225171705c3f53a871938abca2177de
Merge: 79d57ab... 3d431a7...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 19 16:03:38 2008 -0700

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6
    
    * 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6:
      avr32: nmi_enter() without nmi_exit()
      avr32: fix sys_sync_file_range() call convention
      avr32: add generic_find_next_le_bit bit function
      avr32: add .gitignore files
      atstk1000: fix build breakage with BOARD_ATSTK100X_SW2_CUSTOM=y

commit 79d57ab98b7bc32e5bb20683814cfb76dbb54a9e
Merge: a19eee5... 9744197...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 19 16:02:52 2008 -0700

    Merge branch 'for-linus' of git://neil.brown.name/md
    
    * 'for-linus' of git://neil.brown.name/md:
      md: Don't wait UNINTERRUPTIBLE for other resync to finish

commit a19eee5e5e8b11b4a37490f1272d9509dcfcb263
Merge: 764527a... 9843099...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 19 16:02:05 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
      sparc64: Fix SMP bootup with CONFIG_STACK_DEBUG or ftrace.
      sparc64: Fix OOPS in psycho_pcierr_intr_other().

commit 764527a1b3294b4560203979f39a3671b9a26676
Merge: 45e9c0d... e727240...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Fri Sep 19 16:01:37 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      e100: Use pci_pme_active to clear PME_Status and disable PME#
      e1000: prevent corruption of EEPROM/NVM
      forcedeth: call restore mac addr in nv_shutdown path
      bnx2: Promote vector field in bnx2_irq structure from u16 to unsigned int
      sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH
      sctp: do not enable peer features if we can't do them.
      sctp: set the skb->ip_summed correctly when sending over loopback.
      udp: Fix rcv socket locking

commit 3d431a742728e6b619ce57a030a92d228c13d1d2
Author: Manfred Spraul <manfred@colorfullife.com>
Date:   Wed Aug 20 15:39:59 2008 +0200

    avr32: nmi_enter() without nmi_exit()
    
    While updating the rcu code, I noticed that do_nmi() for AVR32 is odd:
    There is an nmi_enter() call without an nmi_exit().
    This can't be correct, it breaks rcu (at least the preempt version) and
    lockdep.
    
    [haavard.skinnemoen@atmel.com: fixed another case that returned directly]
    Signed-off-by: Haavard Skinnemoen <haavard.skinnemoen@atmel.com>

commit 73d4393d1df4ff3892b040396f101ede94e9e846
Author: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
Date:   Wed Sep 17 13:39:45 2008 +0200

    avr32: fix sys_sync_file_range() call convention
    
    On AVR32, all parameters beyond the 5th are passed on the stack. System
    calls don't use the stack -- they borrow a callee-saved register
    instead. This means that syscalls that take 6 parameters must be called
    through a stub that pushes the last parameter on the stack.
    
    This patch adds a stub for sync_file_range syscall on AVR32
    architecture.  Tested with uClibc snapshot.
    
    Signed-off-by: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
    Signed-off-by: Haavard Skinnemoen <haavard.skinnemoen@atmel.com>

commit e37925ebdb9738fc7968119198c6997e79093c02
Author: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
Date:   Wed Sep 10 15:52:04 2008 +0200

    avr32: add generic_find_next_le_bit bit function
    
    This patch implements the generic_find_next_le_bit bit function for AVR32
    architecture. This is used by EXT4 file system.
    
    Signed-off-by: Hans-Christian Egtvedt <hans-christian.egtvedt@atmel.com>
    Signed-off-by: Haavard Skinnemoen <haavard.skinnemoen@atmel.com>

commit 1b771c12b56fdea6c0596a69c63b097b62ce9f41
Author: Markus Heidelberg <markus.heidelberg@web.de>
Date:   Mon Sep 8 00:22:45 2008 +0200

    avr32: add .gitignore files
    
    Ignore Kernel binaries, kernel/vmlinux.lds and a log file.
    
    Signed-off-by: Markus Heidelberg <markus.heidelberg@web.de>
    Signed-off-by: Haavard Skinnemoen <haavard.skinnemoen@atmel.com>

commit 7fb61a7b6f9111245867fa2bce47949f4298d430
Author: Haavard Skinnemoen <haavard.skinnemoen@atmel.com>
Date:   Fri Sep 19 17:56:54 2008 +0200

    atstk1000: fix build breakage with BOARD_ATSTK100X_SW2_CUSTOM=y
    
    The #ifdef surrounding the code adding the mmc controller had a typo,
    causing it to be compiled even when mmc was supposed to be disabled.
    
    Signed-off-by: Haavard Skinnemoen <haavard.skinnemoen@atmel.com>

commit 9744197c3d7b329590c2be33ad7b17409bd798fe
Author: NeilBrown <neilb@suse.de>
Date:   Fri Sep 19 11:49:54 2008 +1000

    md: Don't wait UNINTERRUPTIBLE for other resync to finish
    
    When two md arrays share some block device (e.g each uses different
    partitions on the one device), a resync of one array will wait for
    the resync on the other to finish.
    
    This can be a long time and as it currently waits TASK_UNINTERRUPTIBLE,
    the softlockup code notices and complains.
    
    So use TASK_INTERRUPTIBLE instead and make sure to flush signals
    before calling schedule.
    
    Signed-off-by: NeilBrown <neilb@suse.de>

commit e7272403d2f9be3dbb7cc185fcc390e781b1af6b
Author: Rafael J. Wysocki <rjw@sisk.pl>
Date:   Fri Aug 8 00:18:04 2008 +0200

    e100: Use pci_pme_active to clear PME_Status and disable PME#
    
    Currently e100 uses pci_enable_wake() to clear pending wake-up events
    and disable PME# during intitialization, but that function is not
    suitable for this purpose, because it immediately returns error code
    if device_may_wakeup() returns false for given device.
    
    Make e100 use pci_pme_active(), which carries out exactly the
    required operations, instead.
    
    Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 78566fecbb12a7616ae9a88b2ffbc8062c4a89e3
Author: Christopher Li <chrisl@vmware.com>
Date:   Fri Sep 5 14:04:05 2008 -0700

    e1000: prevent corruption of EEPROM/NVM
    
    Andrey reports e1000 corruption, and that a patch in vmware's ESX fixed
    it.
    
    The EEPROM corruption is triggered by concurrent access of the EEPROM
    read/write. Putting a lock around it solve the problem.
    
    [akpm@linux-foundation.org: use DEFINE_SPINLOCK to avoid confusing lockdep]
    Signed-off-by: Christopher Li <chrisl@vmware.com>
    Reported-by: Andrey Borzenkov <arvidjaar@mail.ru>
    Cc: Zach Amsden <zach@vmware.com>
    Cc: Pratap Subrahmanyam <pratap@vmware.com>
    Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
    Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>
    Cc: Bruce Allan <bruce.w.allan@intel.com>
    Cc: PJ Waskiewicz <peter.p.waskiewicz.jr@intel.com>
    Cc: John Ronciak <john.ronciak@intel.com>
    Cc: Jeff Garzik <jeff@garzik.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit f55c21fd9a92a444e55ad1ca4e4732d56661bf2e
Author: Yinghai Lu <yhlu.kernel@gmail.com>
Date:   Sat Sep 13 13:10:31 2008 -0700

    forcedeth: call restore mac addr in nv_shutdown path
    
    after
    
    | commit f735a2a1a4f2a0f5cd823ce323e82675990469e2
    | Author: Tobias Diedrich <ranma+kernel@tdiedrich.de>
    | Date:   Sun May 18 15:02:37 2008 +0200
    |
    |    [netdrvr] forcedeth: setup wake-on-lan before shutting down
    |
    |    When hibernating in 'shutdown' mode, after saving the image the suspend hook
    |    is not called again.
    |    However, if the device is in promiscous mode, wake-on-lan will not work.
    |    This adds a shutdown hook to setup wake-on-lan before the final shutdown.
    |
    |    Signed-off-by: Tobias Diedrich <ranma+kernel@tdiedrich.de>
    |    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>
    
    my servers with nvidia ck804 and mcp55 will reverse mac address with kexec.
    
    it turns out that we need to restore the mac addr in nv_shutdown().
    
    [akpm@linux-foundation.org: fix typo in printk]
    Signed-off-by: Yinghai Lu <yhlu.kernel@gmail.com>
    Cc: Tobias Diedrich <ranma+kernel@tdiedrich.de>
    Cc: Ayaz Abdulla <aabdulla@nvidia.com>
    Cc: Jeff Garzik <jeff@garzik.org>
    Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 27ed9ddfde8d2967076c51815e4ce297c4a18139
Author: Benjamin Li <benli@broadcom.com>
Date:   Thu Sep 18 16:46:11 2008 -0700

    bnx2: Promote vector field in bnx2_irq structure from u16 to unsigned int
    
    The bnx2 driver stores/uses the irq value from the pci_dev internally.
    But when it stores the irq value, it has been performing an
    integer demotion.  Because of the recent changes made to
    arch/x86/kernel/io_apic.c, the new method in creating the irq value
    (using build_irq_for_pci_dev()) has exposed this bug on x86 systems.
    
    Because of this demotion when calling request_irq() from
    bnx2_request_irq(), the driver would get a return code of -EINVAL.
    This is because the kernel could not find the requested irq descriptor.
    By storing the irq value properly, the kernel can find the correct
    irq descriptor and the bnx2 driver can operate normally.
    
    Signed-off-by: Benjamin Li <benli@broadcom.com>
    Signed-off-by: Michael Chan <mchan@broadcom.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit add52379dde2e5300e2d574b172e62c6cf43b3d3
Author: Vlad Yasevich <vladislav.yasevich@hp.com>
Date:   Thu Sep 18 16:28:27 2008 -0700

    sctp: Fix oops when INIT-ACK indicates that peer doesn't support AUTH
    
    If INIT-ACK is received with SupportedExtensions parameter which
    indicates that the peer does not support AUTH, the packet will be
    silently ignore, and sctp_process_init() do cleanup all of the
    transports in the association.
    When T1-Init timer is expires, OOPS happen while we try to choose
    a different init transport.
    
    The solution is to only clean up the non-active transports, i.e
    the ones that the peer added.  However, that introduces a problem
    with sctp_connectx(), because we don't mark the proper state for
    the transports provided by the user.  So, we'll simply mark
    user-provided transports as ACTIVE.  That will allow INIT
    retransmissions to work properly in the sctp_connectx() context
    and prevent the crash.
    
    Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 0ef46e285c062cbe35d60c0adbff96f530d31c86
Author: Vlad Yasevich <vladislav.yasevich@hp.com>
Date:   Thu Sep 18 16:27:38 2008 -0700

    sctp: do not enable peer features if we can't do them.
    
    Do not enable peer features like addip and auth, if they
    are administratively disabled localy.  If the peer resports
    that he supports something that we don't, neither end can
    use it so enabling it is pointless.  This solves a problem
    when talking to a peer that has auth and addip enabled while
    we do not.  Found by Andrei Pelinescu-Onciul <andrei@iptel.org>.
    
    Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 58005b325394b18b8b6a737e06b4128deb2c4e63
Author: Kristoffer Ericson <kristoffer.ericson@gmail.com>
Date:   Thu Sep 18 12:19:39 2008 +0100

    [ARM] 5255/1: Update jornada ssp to remove build errors/warnings
    
    * Adds ssp functions into header so we don't get
    "implicit declaration" error at builtime.
    * Converts jornada_ssp_start/end functions into voids with
    proper declarations (to avoid "prototype..." warning).
    * Sorts include files in alphabetical order
    * Minor comment changes
    
    Signed-off-by: Kristoffer Ericson <Kristoffer.Ericson@gmail.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

commit a3028b8ed1e1e9930bfa70ce4555fb7f9fad3dcc
Author: Vlad Yasevich <vladislav.yasevich@hp.com>
Date:   Thu Sep 18 02:48:25 2008 -0700

    sctp: set the skb->ip_summed correctly when sending over loopback.
    
    Loopback used to clobber the ip_summed filed which sctp then used
    to figure out if it needed to do checksumming or not.  Now that
    loopback doesn't do that any more, sctp needs to set the ip_summed
    field correctly.
    
    Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 7e8bc3c6db9b4b74842b1c70bbf5c2a99a112b0d
Author: Russell King <rmk@dyn-67.arm.linux.org.uk>
Date:   Wed Sep 17 20:58:11 2008 +0100

    [ARM] omap: back out 'internal_clock' support
    
    The structures weren't ready for this change:
    
    arch/arm/plat-omap/devices.c:320: error: 'struct omap_mmc_conf' has no member named 'internal_clock'
    arch/arm/plat-omap/devices.c:326: error: implicit declaration of function 'omap_ctrl_readl'
    arch/arm/plat-omap/devices.c:326: error: 'OMAP2_CONTROL_DEVCONF0' undeclared (first use in this function)
    arch/arm/plat-omap/devices.c:328: error: implicit declaration of function 'omap_ctrl_writel'
    
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

commit 380b0fdfd0227d7604cd91ad97fb846ba643e0e7
Author: roelkluin <roel.kluin@gmail.com>
Date:   Mon Sep 15 20:56:44 2008 +0100

    [ARM] 5249/1: davinci: remove redundant check in davinci_psc_config()
    
    id is unsigned, check is redundant.
    
    Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

commit 2d291e902791e1c8d72bc223b6f063bbb27a1280
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Tue Sep 9 14:04:18 2008 +0000

    Fix compile failure with non modular builds
    
    Commit deac93df26b20cf8438339b5935b5f5643bc30c9 ("lib: Correct printk
    %pF to work on all architectures") broke the non modular builds by
    moving an essential function into modules.c.  Fix this by moving it
    out again and into asm/sections.h as an inline.  To do this, the
    definition of struct ppc64_opd_entry has been lifted out of modules.c
    and put in asm/elf.h where it belongs.
    
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
    Signed-off-by: Paul Mackerras <paulus@samba.org>

commit 32dde0f975e430f00f03f80f7dbab585d8b45eab
Author: Josh Boyer <jwboyer@linux.vnet.ibm.com>
Date:   Tue Sep 9 04:00:28 2008 +0000

    powerpc: Holly board needs dtbImage target
    
    One of the changes in the bootwrapper makefile introduced the dtbImage
    targets for boards that need a simple zImage with a DTB embedded in
    them (595be948cce574ff2d5dde5d0426a636a4363c70, "[POWERPC]
    bootwrapper: Build multiple cuImages").  When this was done, it broke
    booting on the Holly board as the zImage.holly wrapper did not get the
    DTB embedded properly.
    
    This changes the target for the Holly board to a dtbImage so that the
    wrapper includes the vmlinux, wrapper bits, and DTB.
    
    Signed-off-by: Josh Boyer <jwboyer@linux.vnet.ibm.com>
    Signed-off-by: Paul Mackerras <paulus@samba.org>

commit 2fd6f6ec64ff347447d26646ac6188f3658b383c
Author: Lachlan McIlroy <lachlan@sgi.com>
Date:   Wed Sep 17 16:52:50 2008 +1000

    [XFS] Don't do I/O beyond eof when unreserving space
    
    When unreserving space with boundaries that are not block aligned we round
    up the start and round down the end boundaries and then use this function,
    xfs_zero_remaining_bytes(), to zero the parts of the blocks that got
    dropped during the rounding. The problem is we don't consider if these
    blocks are beyond eof. Worse still is if we encounter delayed allocations
    beyond eof we will try to use the magic delayed allocation block number as
    a real block number. If the file size is ever extended to expose these
    blocks then we'll go through xfs_zero_eof() to zero them anyway.
    
    SGI-PV: 983683
    
    SGI-Modid: xfs-linux-melb:xfs-kern:32055a
    
    Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>
    Signed-off-by: Christoph Hellwig <hch@infradead.org>

commit e1f5dbd7077eebec794452a516cb02f1669b036d
Author: Lachlan McIlroy <lachlan@sgi.com>
Date:   Wed Sep 17 16:52:13 2008 +1000

    [XFS] Fix use-after-free with buffers
    
    We have a use-after-free issue where log completions access buffers via
    the buffer log item and the buffer has already been freed. Fix this by
    taking a reference on the buffer when attaching the buffer log item and
    release the hold when the buffer log item is detached and we no longer
    need the buffer. Also create a new function xfs_buf_item_free() to combine
    some common code.
    
    SGI-PV: 985757
    
    SGI-Modid: xfs-linux-melb:xfs-kern:32025a
    
    Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>
    Signed-off-by: Christoph Hellwig <hch@infradead.org>

commit f9114eba1eb08ee75fd0f1eee780f0290fb3c043
Author: David Chinner <david@fromorbit.com>
Date:   Wed Sep 17 16:51:21 2008 +1000

    [XFS] Prevent lockdep false positives when locking two inodes.
    
    If we call xfs_lock_two_inodes() to grab both the iolock and the ilock,
    then drop the ilocks on both inodes, then grab them again (as
    xfs_swap_extents() does) then lockdep will report a locking order problem.
    This is a false positive.
    
    To avoid this, disallow xfs_lock_two_inodes() fom locking both inode locks
    at once - force calers to make two separate calls. This means that nested
    dropping and regaining of the ilocks will retain the same lockdep subclass
    and so lockdep will not see anything wrong with this code.
    
    SGI-PV: 986238
    
    SGI-Modid: xfs-linux-melb:xfs-kern:31999a
    
    Signed-off-by: David Chinner <david@fromorbit.com>
    Signed-off-by: Christoph Hellwig <hch@infradead.org>
    Signed-off-by: Peter Leckie <pleckie@sgi.com>
    Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>

commit b5b8c9acd547244eb2b7d0280ba38b9dd01971cc
Author: David Chinner <david@fromorbit.com>
Date:   Wed Sep 17 16:50:50 2008 +1000

    [XFS] Fix barrier status change detection.
    
    The current code in xlog_iodone() uses the wrong macro to check if the
    barrier has been cleared due to an EOPNOTSUPP error form the lower layer.
    
    SGI-PV: 986143
    
    SGI-Modid: xfs-linux-melb:xfs-kern:31984a
    
    Signed-off-by: David Chinner <david@fromorbit.com>
    Signed-off-by: Nathaniel W. Turner <nate@houseofnate.net>
    Signed-off-by: Peter Leckie <pleckie@sgi.com>
    Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>

commit 364f358a734ddcd827c662ccbfa58ee3ac510762
Author: Lachlan McIlroy <lachlan@sgi.com>
Date:   Wed Sep 17 16:50:14 2008 +1000

    [XFS] Prevent direct I/O from mapping extents beyond eof
    
    With the help from some tracing I found that we try to map extents beyond
    eof when doing a direct I/O read. It appears that the way to inform the
    generic direct I/O path (ie do_direct_IO()) that we have breached eof is
    to return an unmapped buffer from xfs_get_blocks_direct(). This will cause
    do_direct_IO() to jump to the hole handling code where is will check for
    eof and then abort.
    
    This problem was found because a direct I/O read was trying to map beyond
    eof and was encountering delayed allocations. The delayed allocations
    beyond eof are speculative allocations and they didn't get converted when
    the direct I/O flushed the file because there was only enough space in the
    current AG to convert and write out the dirty pages within eof. Note that
    xfs_iomap_write_allocate() wont necessarily convert all the delayed
    allocation passed to it - it will return after allocating the first extent
    - so if the delayed allocation extends beyond eof then it will stay that
    way.
    
    SGI-PV: 983683
    
    SGI-Modid: xfs-linux-melb:xfs-kern:31929a
    
    Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>
    Signed-off-by: Christoph Hellwig <hch@infradead.org>

commit 6efdf281777eb07fac28ac2b2d7df1e619ee6da1
Author: Christoph Hellwig <hch@infradead.org>
Date:   Wed Sep 17 16:49:33 2008 +1000

    [XFS] Fix regression introduced by remount fixup
    
    Logically we would return an error in xfs_fs_remount code to prevent users
    from believing they might have changed mount options using remount which
    can't be changed.
    
    But unfortunately mount(8) adds all options from mtab and fstab to the
    mount arguments in some cases so we can't blindly reject options, but have
    to check for each specified option if it actually differs from the
    currently set option and only reject it if that's the case.
    
    Until that is implemented we return success for every remount request, and
    silently ignore all options that we can't actually change.
    
    SGI-PV: 985710
    
    SGI-Modid: xfs-linux-melb:xfs-kern:31908a
    
    Signed-off-by: Christoph Hellwig <hch@infradead.org>
    Signed-off-by: Tim Shimmin <tes@sgi.com>
    Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>

commit 31bd61f2bb79e098117d823e054342b03aa87668
Author: Lachlan McIlroy <lachlan@sgi.com>
Date:   Wed Sep 17 16:45:37 2008 +1000

    [XFS] Move memory allocations for log tracing out of the critical path
    
    Memory allocations for log->l_grant_trace and iclog->ic_trace are done on
    demand when the first event is logged. In xlog_state_get_iclog_space() we
    call xlog_trace_iclog() under a spinlock and allocating memory here can
    cause us to sleep with a spinlock held and deadlock the system.
    
    For the log grant tracing we use KM_NOSLEEP but that means we can lose
    trace entries. Since there is no locking to serialize the log grant
    tracing we could race and have multiple allocations and leak memory.
    
    So move the allocations to where we initialize the log/iclog structures.
    Use KM_NOFS to avoid recursing into the filesystem and drop log->l_trace
    since it's not even used.
    
    SGI-PV: 983738
    
    SGI-Modid: xfs-linux-melb:xfs-kern:31896a
    
    Signed-off-by: Lachlan McIlroy <lachlan@sgi.com>
    Signed-off-by: Christoph Hellwig <hch@infradead.org>

commit 45e9c0de2e86485f8b6633fd64ab19cfbff167f6
Author: Arjan van de Ven <arjan@linux.intel.com>
Date:   Mon Sep 15 16:43:18 2008 -0700

    warn: Turn the netdev timeout WARN_ON() into a WARN()
    
    this patch turns the netdev timeout WARN_ON_ONCE() into a WARN_ONCE(),
    so that the device and driver names are inside the warning message.
    This helps automated tools like kerneloops.org to collect the data
    and do statistics, as well as making it more likely that humans
    cut-n-paste the important message as part of a bugreport.
    
    Signed-off-by: Arjan van de Ven <arjan@linux.intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit c8b0f4382cd7b5e58b17bd30d16898b7f249813c
Merge: 1b901aa... 02b71b7...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 16 19:36:06 2008 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6:
      slub: fixed uninitialized counter in struct kmem_cache_node

commit 1b901aa2b5debe0df02e9d6bb8d86e342b6d47b5
Merge: ef3d771... a834795...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 16 19:35:49 2008 -0700

    Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus
    
    * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
      [MIPS] VR41xx: unsigned irq cannot be negative

commit ef3d7714f6b75b51825ad0384b5ce48358427e50
Author: David Miller <davem@davemloft.net>
Date:   Tue Sep 16 15:00:11 2008 -0700

    Fix PNP build failure, bugzilla #11276
    
    This fill fix the following regression list entry:
    
    Bug-Entry	: http://bugzilla.kernel.org/show_bug.cgi?id=11276
    Subject		: build error: CONFIG_OPTIMIZE_INLINING=y causes gcc 4.2 to do stupid things
    Submitter	: Randy Dunlap <randy.dunlap@oracle.com>
    Date		: 2008-08-06 17:18 (38 days old)
    References	: http://marc.info/?l=linux-kernel&m=121804329014332&w=4
    		  http://lkml.org/lkml/2008/7/22/353
    Handled-By	: Bjorn Helgaas <bjorn.helgaas@hp.com>
    Patch		: http://lkml.org/lkml/2008/7/22/364
    
    with what I believe is a better fix than the one referenced
    in the regression entry above.
    
    These PNP header interfaces try to work in such a way that
    you can reference some of them even if PNP is not enabled,
    and the compiler was expected to optimize everything away.
    
    Which is mostly fine, except that there was one interface
    for which there was not provided an inline "NOP" implementation.
    
    Once we add that, all of these compile failures cannot handle
    any more.
    
    pnp: Provide NOP inline implementation of pnp_get_resource() when !PNP
    
    Fixes kernel bugzilla #11276.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 49f276be7ce12d90b6941a000b09e61b68e6c4f2
Author: Stephen Hemminger <stephen.hemminger@vyatta.com>
Date:   Tue Sep 16 16:04:12 2008 -0700

    hpplus: fix build regression
    
    This fixes kernel regression for 2.6.27-rc in
          http://bugzilla.kernel.org/show_bug.cgi?id=11547
    The change to split 8390 into old isa and non-isa versions
    overlooked this driver.
    
    Signed-off-by: Stephen Hemminger <shemminger@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit e95926d05d028a6bf0ab60b21b484c3d622fdcd1
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Tue Sep 16 19:32:30 2008 -0700

    Revert "b43/b43legacy: add RFKILL_STATE_HARD_BLOCKED support"
    
    This reverts commit bc19d6e0b74ef03a3baf035412c95192b54dfc6f, which as
    Larry Finger reports causes the radio LED on his system to no longer
    respond to rfkill switch events.
    
    Reported-by: Larry Finger <Larry.Finger@lwfinger.net>
    Requested-by: John W. Linville <linville@tuxdriver.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 612f9d338a6060f814ef35b7108b43407a5df423
Author: Timur Tabi <timur@freescale.com>
Date:   Tue Sep 9 14:43:39 2008 -0500

    powerpc: Fix interrupt values for DMA2 in MPC8610 HPCD device tree
    
    For Freescale 8xxx devices that use an MPIC, the interrupt numbers in
    the device tree must be 16 greater than the values documented in the
    reference manual.  In these chips, the MPIC is wired to use the first
    16 numbers for external interrupts, but the documentation numbers
    internal interrupts from 0.
    
    In the MPC8610 HPCD device tree, the interrupt properties for the DMA
    channels for DMA2 were not the adjusted values.  This fixes that.
    
    Signed-off-by: Timur Tabi <timur@freescale.com>
    Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
    Signed-off-by: Paul Mackerras <paulus@samba.org>

commit 2344abbcbdb82140050e8be29d3d55e4f6fe860b
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Tue Sep 16 11:32:50 2008 -0700

    clockevents: make device shutdown robust
    
    The device shut down does not cleanup the next_event variable of the
    clock event device. So when the device is reactivated the possible
    stale next_event value can prevent the device to be reprogrammed as it
    claims to wait on a event already.
    
    This is the root cause of the resurfacing suspend/resume problem,
    where systems need key press to come back to life.
    
    Fix this by setting next_event to KTIME_MAX when the device is shut
    down. Use a separate function for shutdown which takes care of that
    and only keep the direct set mode call in the broadcast code, where we
    can not touch the next_event value.
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

commit 7e2c23285454ecc8c8159b86d6343efe222ca3ae
Merge: e8224e4... 29bdc88... d7ffd50...
Author: Roland Dreier <rolandd@cisco.com>
Date:   Tue Sep 16 11:57:52 2008 -0700

    Merge branches 'ipoib', 'mlx4' and 'nes' into for-linus

commit e8224e4b804b4fd26723191c1891101a5959bb8a
Author: Yossi Etigin <yossi.openib@gmail.com>
Date:   Tue Sep 16 11:57:45 2008 -0700

    IPoIB: Fix deadlock on RTNL between bcast join comp and ipoib_stop()
    
    Taking rtnl_lock in ipoib_mcast_join_complete() causes a deadlock with
    ipoib_stop().  We avoid it by scheduling the piece of code that takes
    the lock on ipoib_workqueue instead of executing it directly.  This
    works because we only flush the ipoib_workqueue with the RTNL not held.
    
    The deadlock happens because ipoib_stop() calls ipoib_ib_dev_down()
    which calls ipoib_mcast_dev_flush(), which calls ipoib_mcast_free(),
    which calls ipoib_mcast_leave(). The latter calls
    ib_sa_free_multicast(), and this waits until the multicast completion
    handler finishes.  This handler is ipoib_mcast_join_complete(), which
    waits for the rtnl_lock(), which was already taken by ipoib_stop().
    
    This bug was introduced in commit a77a57a1 ("IPoIB: Fix deadlock on
    RTNL in ipoib_stop()").
    
    Signed-off-by: Yossi Etigin <yosefe@voltaire.com>
    Signed-off-by: Roland Dreier <rolandd@cisco.com>

commit d7ffd5076d4407d54b25bc4b25f3002f74fbafde
Author: Faisal Latif <flatif@neteffect.com>
Date:   Tue Sep 16 11:56:26 2008 -0700

    RDMA/nes: Fix client side QP destroy
    
    Fix QP not being destroyed properly on the client, which leads to
    userspace programs hanging on exit.  This is a missing chunk from the
    connection management rewrite in commit 6492cdf3 ("RDMA/nes: CM
    connection setup/teardown rework").
    
    Signed-off-by: Faisal Latif <flatif@neteffect.com>
    Signed-off-by: Roland Dreier <rolandd@cisco.com>

commit 9843099ff46467461d6476a827f6f9701682dbac
Author: David S. Miller <davem@davemloft.net>
Date:   Tue Sep 16 11:44:00 2008 -0700

    sparc64: Fix SMP bootup with CONFIG_STACK_DEBUG or ftrace.
    
    Based upon a report by Meelis Roos.
    
    Any function call can try to access the current
    thread register via the _mcount hooks when the kernel
    is built with -pg (via ftrace or STACK_DEBUG).
    
    That can't be setup properly very early on during
    the bootup of other cpus for sun4u and some early
    sun4v systems.
    
    So add notrace markers to these specific functions, so
    that _mcount doesn't get invoked too early.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit f948cc6ab9e61a8e88d70ee9aafc690e6d26f92c
Author: David S. Miller <davem@davemloft.net>
Date:   Tue Sep 16 09:53:42 2008 -0700

    sparc64: Fix OOPS in psycho_pcierr_intr_other().
    
    We no longer put the top-level PCI controller device into the
    PCI layer device list.  So pbm->pci_bus->self is always NULL.
    
    Therefore, use direct PCI config space accesses to get at
    the PCI controller's PCI_STATUS register.
    
    Tested by Meelis Roos.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 9adb8c1d4f0ac78b3469e377ce5f8a846cbaedaf
Author: Stefan Weinhuber <wein@de.ibm.com>
Date:   Tue Sep 16 09:32:19 2008 -0700

    [S390] cio: fix orb initialization in cio_start_key
    
    The functions cio_tm_start_key and cio_start_key use the same private
    orb structure of a subchannel, so the orb needs to be cleared of old
    data before it is used again. A respective memset is missing from
    cio_start_key and hereby added.
    
    Signed-off-by: Stefan Weinhuber <wein@de.ibm.com>
    Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

commit f26fd5d6e5006eae75a389c7ce74ed16761d094b
Author: Cornelia Huck <cornelia.huck@de.ibm.com>
Date:   Tue Sep 16 09:32:18 2008 -0700

    [S390] cio: Fix driver_data handling for ccwgroup devices.
    
    Since 16f7f9564c3ae190954f2ec55f385a268b93ac4d, we've seen
    oopses when grouping/ungrouping devices:
    
    Unable to handle kernel pointer dereference at virtual kernel address 0000000000
    114000
    Oops: 0004 [#1] PREEMPT SMP
    Modules linked in: bonding qeth_l2 dm_multipath sunrpc qeth_l3 dm_mod qeth chsc_
    sch ccwgroup
    CPU: 1 Not tainted 2.6.26-29.x.20080815-s390xdefault #1
    Process iperf (pid: 24412, task: 000000003f446038, ksp: 000000003c929e08)
    Krnl PSW : 0404d00180000000 000003e00006f6e6 (qeth_irq+0xda/0xb28 [qeth])
               R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:1 PM:0 EA:3
    Krnl GPRS: 0000000000000000 000003e000000003 0000000000000000 0000000000114ccc
               000000003fb82e48 000003e00006f60c 000000000000000c 000000003ce72100
               0000000000114944 000000003fb82e48 0000000000114ccc 000000003fe8fd28
               000003e000066000 000003e000076128 000000003fe8fdb8 000000003fe8fd28
    Krnl Code: 000003e00006f6da: bf3f2024            icm     %r3,15,36(%r2)
               000003e00006f6de: a774023c            brc     7,3e00006fb56
               000003e00006f6e2: a7280000            lhi     %r2,0
              >000003e00006f6e6: 5020a1a0            st      %r2,416(%r10)
               000003e00006f6ea: 58109000            l       %r1,0(%r9)
               000003e00006f6ee: a7111000            tmll    %r1,4096
               000003e00006f6f2: a77400f9            brc     7,3e00006f8e4
               000003e00006f6f6: 8810000c            srl     %r1,12
    Call Trace:
    ([<000000003fe8fd20>] 0x3fe8fd20)
     [<000000000033bf2a>] ccw_device_call_handler+0xb2/0xd8
     [<0000000000339e1c>] ccw_device_irq+0x124/0x164
     [<0000000000339758>] io_subchannel_irq+0x8c/0x118
     [<00000000003309ba>] do_IRQ+0x192/0x1bc
     [<0000000000114f66>] io_return+0x0/0x8
     [<00000000001149cc>] sysc_do_svc+0x0/0x22
    ([<0000000000114a18>] sysc_noemu+0x10/0x16)
     [<00000200002e047c>] 0x200002e047c
    Last Breaking-Event-Address:
     [<000003e00006f6d6>] qeth_irq+0xca/0xb28 [qeth]
    
    The problem is that dev->driver_data for a ccw device is NULL,
    while it should point to the ccwgroup device it is a member of.
    This happened due to incorrect cleanup if creating a ccwgroup
    device failed because the ccw devices were already grouped.
    
    Fix this by setting cdev[i] to NULL in the error handling of
    ccwgroup_create_from_string() after we give up our reference and
    by checking if the driver_data points to the ccwgroup device in
    ccwgroup_release() just to be really sure.
    
    Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

commit ba0593bf553c450a03dbc5f8c1f0ff58b778a0c8
Author: H. Peter Anvin <hpa@zytor.com>
Date:   Tue Sep 16 09:29:40 2008 -0700

    x86: completely disable NOPL on 32 bits
    
    Completely disable NOPL on 32 bits.  It turns out that Microsoft
    Virtual PC is so broken it can't even reliably *fail* in the presence
    of NOPL.
    
    This leaves the infrastructure in place but disables it
    unconditionally.
    
    Signed-off-by: H. Peter Anvin <hpa@zytor.com>

commit a83479545d0e693da0886fd28d041d3a5c1bc966
Author: roel kluin <roel.kluin@gmail.com>
Date:   Mon Sep 15 20:50:54 2008 -0400

    [MIPS] VR41xx: unsigned irq cannot be negative
    
    Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
    Acked-by: Yoichi Yuasa <yoichi_yuasa@tripeaks.co.jp>
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

commit 29bdc88384c2b24e37e5760df0dc898546083d6b
Author: Vladimir Sokolovsky <vlad@mellanox.co.il>
Date:   Mon Sep 15 14:25:23 2008 -0700

    IB/mlx4: Fix up fast register page list format
    
    Byte swap the addresses in the page list for fast register work requests
    to big endian to match what the HCA expectx.  Also, the addresses must
    have the "present" bit set so that the HCA knows it can access them.
    Otherwise the HCA will fault the first time it accesses the memory
    region.
    
    Signed-off-by: Vladimir Sokolovsky <vlad@mellanox.co.il>
    Signed-off-by: Roland Dreier <rolandd@cisco.com>

commit 93821778def10ec1e69aa3ac10adee975dad4ff3
Author: Herbert Xu <herbert@gondor.apana.org.au>
Date:   Mon Sep 15 11:48:46 2008 -0700

    udp: Fix rcv socket locking
    
    The previous patch in response to the recursive locking on IPsec
    reception is broken as it tries to drop the BH socket lock while in
    user context.
    
    This patch fixes it by shrinking the section protected by the
    socket lock to sock_queue_rcv_skb only.  The only reason we added
    the lock is for the accounting which happens in that function.
    
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 02b71b70129aaaa38f280af2aa5a767a4dec9107
Author: Salman Qazi <sqazi@google.com>
Date:   Thu Sep 11 12:25:41 2008 -0700

    slub: fixed uninitialized counter in struct kmem_cache_node
    
    Initialized total objects atomic for the node in init_kmem_cache_node.  The
    uninitialized value was ruining the stats in /proc/slabinfo.
    
    Acked-by: Christoph Lameter <cl@linux-foundation.org>
    Signed-off-by: Salman Qazi <sqazi@google.com>
    Signed-off-by: Pekka Enberg <penberg@cs.helsinki.fi>

commit bc45eb8950b8c14487385cfd2bda1613ca8d9703
Merge: 2123870... ba95487...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Sep 14 22:50:43 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
      crypto: talitos - Avoid consecutive packets going out with same IV

commit ba95487df97f9c45cfdae2a47de56235e7a13dc5
Author: Kim Phillips <kim.phillips@freescale.com>
Date:   Sun Sep 14 13:41:19 2008 -0700

    crypto: talitos - Avoid consecutive packets going out with same IV
    
    The SEC's h/w IV out implementation DMAs the trailing encrypted payload
    block of the last encryption to ctx->iv.  Since the last encryption may
    still be pending completion, we can sufficiently prevent successive
    packets from being transmitted with the same IV by xoring with sequence
    number.
    
    Also initialize alg_list earlier to prevent oopsing on a failed probe.
    
    Signed-off-by: Kim Phillips <kim.phillips@freescale.com>
    Signed-off-by: Lee Nipper <lee.nipper@freescale.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

commit 5132895f14a57607152f7865dc862fb076ce2585
Author: Alex Nixon <alex.nixon@citrix.com>
Date:   Wed Sep 3 14:36:40 2008 +0100

    x86/paravirt: Remove duplicate paravirt_pagetable_setup_{start, done}()
    
    They were already called once in arch/x86/kernel/setup.c - we don't need to call them again.
    
    fixes:
    
      http://bugzilla.kernel.org/show_bug.cgi?id=11485
    
    Signed-off-by: Alex Nixon <alex.nixon@citrix.com>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>

commit 5670a43d710a12fcbbfaefd3991002768b488d82
Author: Jeremy Fitzhardinge <jeremy@goop.org>
Date:   Sun Sep 14 07:42:23 2008 -0700

    xen: fix for xen guest with mem > 3.7G
    
    PFN_PHYS() can truncate large addresses unless its passed a suitable
    large type.  This is fixed more generally in the patch series
    introducing phys_addr_t, but we need a short-term fix to solve a
    Xen regression reported by Roberto De Ioris.
    
    Reported-by: Roberto De Ioris <roberto@unbit.it>
    Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>

commit 212387055902b65f79463d1934033255aa6b99e1
Author: Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de>
Date:   Sat Sep 13 22:29:31 2008 +0200

    Add Uwe Kleine-König to .mailmap
    
    There are a few commits that misencoded my name (or used "oe" instead of
    "ö").  So add a correct version to .mailmap.
    
    Signed-off-by: Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 6bfb09a1005193be5c81ebac9f3ef85210142650
Merge: 7c22a3d... 88c381b...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sat Sep 13 14:51:22 2008 -0700

    Merge master.kernel.org:/home/rmk/linux-2.6-arm
    
    * master.kernel.org:/home/rmk/linux-2.6-arm:
      [ARM] Fix PCI_DMA_BUS_IS_PHYS for ARM
      [ARM] 5247/1: tosa: SW_EAR_IN support
      [ARM] 5246/1: tosa: add proper clock alias for tc6393xb clock
      [ARM] 5245/1: Fix warning about unused return value in drivers/pcmcia
      [ARM] OMAP: Fix MMC device data
      imx serial: fix rts handling for non imx1 based hardware
      imx serial: set RXD mux bit on i.MX27 and i.MX31
      i.MX serial: fix init failure
      pcm037: add rts/cts support for serial port

commit 7c22a3d853804d2716ef4f90cdd693a83819ba11
Merge: 0cb60ef... 97b697a...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sat Sep 13 14:48:14 2008 -0700

    Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev
    
    * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
      [libata] LBA28/LBA48 off-by-one bug in ata.h
      sata_inic162x: enable LED blinking
      ata: duplicate variable sparse warning

commit 0cb60efd03ed82d02f44a14594714367e59e8abc
Merge: c19e808... 395a125...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sat Sep 13 14:47:33 2008 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
      PCI: re-add debug prints for unmodified BARs
      PCI: fix pciehp_free_irq()
      PCI Hotplug: fakephp: fix deadlock... again
      PCI: Fix printk warnings in setup-bus.c
      PCI: Fix printk warnings in probe.c
      PCI/iommu: blacklist DMAR on Intel G31/G33 chipsets

commit c19e80808b34b3de5c20884f11f58c3b6988daff
Merge: 344a782... cff502a...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sat Sep 13 14:46:57 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      niu: panic on reset
      netlink: fix overrun in attribute iteration
      [Bluetooth] Fix regression from using default link policy
      ath9k: Assign seq# when mac80211 requests this

commit 344a7829c421ce6c626cb94c6576f66a7c28a871
Merge: 8e82f8c... 7d4ee28...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sat Sep 13 14:45:42 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
      sparc: Fix user_regset 'n' field values.
      sparc64: Fix PCI error interrupt registry on PSYCHO.
      sparc32: Fix function signature of of_bus_sbus_get_flags().
      sparc64: Fix interrupt register calculations on Psycho and Sabre.

commit 8e82f8c34b1759ae0d80fe96101746ec51fb1ba4
Author: Alex Dubov <oakad@yahoo.com>
Date:   Sat Sep 13 02:33:26 2008 -0700

    memstick: fix MSProHG 8-bit interface mode support
    
    - 8-bit interface mode never worked properly.  The only adapter I have
      which supports the 8b mode (the Jmicron) had some problems with its
      clock wiring and they discovered it only now.  We also discovered that
      ProHG media is more sensitive to the ordering of initialization
      commands.
    
    - Make the driver fall back to highest supported mode instead of always
      falling back to serial.  The driver will attempt the switch to 8b mode
      for any new MSPro card, but not all of them support it.  Previously,
      these new cards ended up in serial mode, which is not the best idea
      (they work fine with 4b, after all).
    
    - Edit some macros for better conformance to Sony documentation
    
    Signed-off-by: Alex Dubov <oakad@yahoo.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 8d99f83b9478768d3a8d7d1bcd9bd182c75a0447
Author: Andrew Morton <akpm@linux-foundation.org>
Date:   Sat Sep 13 02:33:25 2008 -0700

    rescan_partitions(): make device capacity errors non-fatal
    
    Herton Krzesinski reports that the error-checking changes in
    04ebd4aee52b06a2c38127d9208546e5b96f3a19 ("block/ioctl.c and
    fs/partition/check.c: check value returned by add_partition") cause his
    buggy USB camera to no longer mount.  "The camera is an Olympus X-840.
    The original issue comes from the camera itself: its format program
    creates a partition with an off by one error".
    
    Buggy devices happen.  It is better for the kernel to warn and to proceed
    with the mount.
    
    Reported-by: Herton Ronaldo Krzesinski <herton@mandriva.com.br>
    Cc: Abdel Benamrouche <draconux@gmail.com>
    Cc: Jens Axboe <jens.axboe@oracle.com>
    Cc: Alan Stern <stern@rowland.harvard.edu>
    Cc: David Brownell <david-b@pacbell.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 42cde4309b8f2671610be049352df2f8716e8809
Author: Ben Dooks <ben-linux@fluff.org>
Date:   Sat Sep 13 02:33:24 2008 -0700

    spi_s3c24xx: fix section warning
    
    Fix the section mismatch warning generated by the incorrect naming of
    s3c24xx_spidrv which should be s3c24xx_spi_driver:
    
    WARNING: drivers/spi/spi_s3c24xx.o(.data+0x4):
      Section mismatch in reference from the variable s3c24xx_spidrv
      to the (unknown reference) .exit.text:(unknown)
    
    Signed-off-by: Ben Dooks <ben-linux@fluff.org>
    Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 3aa04f1b07352be89960bddca4db0d5d8c09510c
Author: Haavard Skinnemoen <haavard.skinnemoen@atmel.com>
Date:   Sat Sep 13 02:33:23 2008 -0700

    atmel_lcdfb: disable LCD and DMA engines when suspending
    
    When suspending the system with atmel_lcdfb enabled, I sometimes see
    this:
    
    	atmel_lcdfb atmel_lcdfb.0: FIFO underflow 0x10
    
    Which can be explained by the fact that we're not stopping the LCD
    controller and its DMA engine when suspending, we're just gating the
    clocks to them.
    
    There's another potential issue which may be harder to trigger but
    much more nasty: If we gate the clocks at _just_ the right moment,
    e.g. when the DMA engine is doing a bus transaction, we may cause the
    DMA engine to violate the system bus protocol and cause a lockup.
    
    Avoid these issues by shutting down the LCD controller before entering
    suspend (and restarting it when resuming). This prevents the underrun
    from happening in the first place, and prevents whatever nastiness is
    happening when the bus clock stops in the middle of a DMA transfer.
    
    Signed-off-by: Haavard Skinnemoen <haavard.skinnemoen@atmel.com>
    Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 8275d102f8dbaa4f437f6b03b00d85bfb4e16025
Author: Robin Holt <holt@sgi.com>
Date:   Sat Sep 13 02:33:22 2008 -0700

    ia64: fix panic during `modprobe -r xpc'
    
    If you are on ia64 and you modprobe xpc then modprobe -r xpc, you
    immediately get a panic.  xpc depends on xp which depends on gru for a
    symbol.  That symbol is only used when we are running on UV hardware.
    
    Currently, the GRU driver detects we are not on UV hardware and does no
    initializing.  It does not do the same check when unloading.  As a result,
    the gru driver attempts to tear down stuff that was not setup.
    
    This is a simple two-line workaround to get us through this release.  Once
    2.6.28 is opened, we need to rework the symbols that xp is depending on
    from gru so the gru driver can properly fail to load when hardware is not
    available.
    
    Signed-off-by: Robin Holt <holt@sgi.com>
    Cc: "Luck, Tony" <tony.luck@intel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit ecc9a04de66e7b2d40d539cc39d5798bc46553e9
Author: Ming Lei <tom.leiming@gmail.com>
Date:   Sat Sep 13 02:33:21 2008 -0700

    MAINTAINERS: fix USB VIDEO CLASS mail list address
    
    It should be linux-uvc-devel@lists.berlios.de.
    
    Signed-off-by: Ming Lei <tom.leiming@gmail.com>
    Cc: Mauro Carvalho Chehab <mchehab@infradead.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 9f986a8cdf94a5855201cf67db6ffdf926bc4cd9
Author: David Brownell <dbrownell@users.sourceforge.net>
Date:   Sat Sep 13 02:33:20 2008 -0700

    Documentation/ABI: /sys/class/gpio
    
    Provide summary ABI docs about the /sys/class/gpio files.
    
    Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
    Cc: Greg Kroah-Hartman <gregkh@suse.de>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 5bead2a0680687b9576d57c177988e8aa082b922
Author: Mel Gorman <mel@csn.ul.ie>
Date:   Sat Sep 13 02:33:19 2008 -0700

    mm: mark the correct zone as full when scanning zonelists
    
    The iterator for_each_zone_zonelist() uses a struct zoneref *z cursor when
    scanning zonelists to keep track of where in the zonelist it is.  The
    zoneref that is returned corresponds to the the next zone that is to be
    scanned, not the current one.  It was intended to be treated as an opaque
    list.
    
    When the page allocator is scanning a zonelist, it marks elements in the
    zonelist corresponding to zones that are temporarily full.  As the
    zonelist is being updated, it uses the cursor here;
    
      if (NUMA_BUILD)
            zlc_mark_zone_full(zonelist, z);
    
    This is intended to prevent rescanning in the near future but the zoneref
    cursor does not correspond to the zone that has been found to be full.
    This is an easy misunderstanding to make so this patch corrects the
    problem by changing zoneref cursor to be the current zone being scanned
    instead of the next one.
    
    Signed-off-by: Mel Gorman <mel@csn.ul.ie>
    Cc: Andy Whitcroft <apw@shadowen.org>
    Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Cc: <stable@kernel.org>		[2.6.26.x]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 7e96445533ac3f4f7964646a202ff3620602fab4
Author: Ned Forrester <nforrester@whoi.edu>
Date:   Sat Sep 13 02:33:18 2008 -0700

    pxa2xx_spi: dma bugfixes
    
    Fixes two DMA bugs in the pxa2xx_spi driver.  The first bug is in all
    versions of this driver; the second was introduced in the 2.6.20 kernel,
    and prevents using the driver with chips like m25p16 flash (which can
    issue large DMA reads).
    
     1. Zero length transfers are permitted for use to insert timing,
        but pxa2xx_spi.c will fail if this is requested in DMA mode.
        Fixed by using programmed I/O (PIO) mode for such transfers.
    
     2. Transfers larger than 8191 are not permitted in DMA mode.  A
        test for length rejects all large transfers regardless of DMA
        or PIO mode.  Worked around by rejecting only large transfers
        with DMA mapped buffers, and forcing all other transfers
        larger than 8191 to use PIO mode.  A rate limited warning is
        issued for DMA transfers forced to PIO mode.
    
    This patch should apply to all kernels back to and including 2.6.20;
    it was test patched against 2.6.20.  An additional patch would be
    required for older kernels, but those versions are very buggy anyway.
    
    Signed-off-by: Ned Forrester <nforrester@whoi.edu>
    Cc: Vernon Sauder <vernoninhand@gmail.com>
    Cc: Eric Miao <eric.y.miao@gmail.com>
    Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
    Cc: <stable@kernel.org>		[2.6.25.x, 2.6.26.x]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 8423597d676615f3dd2d9ab36f59f147086b90b8
Author: Ned Forrester <nforrester@whoi.edu>
Date:   Sat Sep 13 02:33:17 2008 -0700

    pxa2xx_spi: chipselect bugfixes
    
    Fixes several chipselect bugs in the pxa2xx_spi driver.  These bugs are in
    all versions of this driver and prevent using it with chips like m25p16
    flash.
    
     1. The spi_transfer.cs_change flag is handled too early:
        before spi_transfer.delay_usecs applies, thus making the
        delay ineffective at holding chip select.
    
     2. spi_transfer.delay_usecs is ignored on the last transfer
        of a message (likewise not holding chipselect long enough).
    
     3. If spi_transfer.cs_change is set on the last transfer, the
        chip select is always disabled, instead of the intended
        meaning: optionally holding chip select enabled for the
        next message.
    
    Those first three bugs were fixed with a relocation of delays
    and chip select de-assertions.
    
     4. If a message has the cs_change flag set on the last transfer,
        and had the chip select stayed enabled as requested (see 3,
        above), it would not have been disabled if the next message is
        for a different chip.  Fixed by dropping chip select regardless
        of cs_change at end of a message, if there is no next message
        or if the next message is for a different chip.
    
    This patch should apply to all kernels back to and including 2.6.20;
    it was test patched against 2.6.20.  An additional patch would be
    required for older kernels, but those versions are very buggy anyway.
    
    Signed-off-by: Ned Forrester <nforrester@whoi.edu>
    Cc: Vernon Sauder <vernoninhand@gmail.com>
    Cc: Eric Miao <eric.y.miao@gmail.com>
    Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
    Cc: <stable@kernel.org>		[2.6.25.x, 2.6.26.x]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit aa77d96ba94326db4f50d2aa36602824dd03286a
Author: Peter Korsgaard <jacmet@sunsite.dk>
Date:   Sat Sep 13 02:33:15 2008 -0700

    spi_mpc83xx: reject invalid transfer sizes
    
    Error out on transfer length != multiple of bytes per word with -EINVAL.
    Fixes a buffer overrun crash if length < bytes per word.
    
    Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
    Acked-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
    Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 53604dbe1371c3c4458c2d741adbd8cfd8fe8e79
Author: Peter Korsgaard <jacmet@sunsite.dk>
Date:   Sat Sep 13 02:33:14 2008 -0700

    spi_mpc83xx: fix clockrate calculation for low speed
    
    Commit a61f5345 (spi_mpc83xx clockrate fixes) broke clockrate calculation
    for low speeds.  SPMODE_DIV16 should be set if the divider is higher than
    64, not only if the divider gets clipped to 1024.
    
    Furthermore, the clipping check was off by a factor 16 as well.
    
    Signed-off-by: Peter Korsgaard <jacmet@sunsite.dk>
    Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit d7a3e4959c28bccc25dd33315809ffcf40f7493e
Author: Hugh Dickins <hugh@veritas.com>
Date:   Sat Sep 13 02:33:13 2008 -0700

    mm: ifdef Quicklists in /proc/meminfo
    
    A "Quicklists:          0 kB" line has just started appearing in
    /proc/meminfo, but most architectures (including x86) don't have
    them configured, so #ifdef it, like the highmem lines.
    
    And those architectures which do have quicklists configured are
    using them for page tables: so let's place it next to PageTables.
    
    Signed-off-by: Hugh Dickins <hugh@veritas.com>
    Acked-by: Christoph Lameter <cl@linux-foundation.org>
    Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 1558182f651798164418abf53f76786da0ea4a6f
Author: Eric Sesterhenn <snakebyte@gmx.de>
Date:   Sat Sep 13 02:33:12 2008 -0700

    bfs: fix Lockdep warning
    
    This fixes:
    
      =============================================
      [ INFO: possible recursive locking detected ]
      2.6.27-rc5-00283-g70bb089 #68
      ---------------------------------------------
      touch/6855 is trying to acquire lock:
       (&info->bfs_lock){--..}, at: [<c02262f5>] bfs_delete_inode+0x9e/0x18c
    
      but task is already holding lock:
       (&info->bfs_lock){--..}, at: [<c0226c00>] bfs_create+0x45/0x187
    
      other info that might help us debug this:
      2 locks held by touch/6855:
       #0:  (&type->i_mutex_dir_key#5){--..}, at: [<c018ad13>] do_filp_open+0x10b/0x62f
       #1:  (&info->bfs_lock){--..}, at: [<c0226c00>] bfs_create+0x45/0x187
    
      stack backtrace:
      Pid: 6855, comm: touch Not tainted 2.6.27-rc5-00283-g70bb089 #68
       [<c013e769>] validate_chain+0x458/0x9f4
       [<c013bece>] ? trace_hardirqs_off+0xb/0xd
       [<c013f36b>] __lock_acquire+0x666/0x6e0
       [<c013f440>] lock_acquire+0x5b/0x77
       [<c02262f5>] ? bfs_delete_inode+0x9e/0x18c
       [<c06aab74>] mutex_lock_nested+0xbc/0x234
       [<c02262f5>] ? bfs_delete_inode+0x9e/0x18c
       [<c02262f5>] ? bfs_delete_inode+0x9e/0x18c
       [<c02262f5>] bfs_delete_inode+0x9e/0x18c
       [<c0226257>] ? bfs_delete_inode+0x0/0x18c
       [<c01925e1>] generic_delete_inode+0x94/0xfe
       [<c019265d>] generic_drop_inode+0x12/0x12f
       [<c0191b7e>] iput+0x4b/0x4e
       [<c0226d1e>] bfs_create+0x163/0x187
       [<c0188b42>] vfs_create+0xa6/0x114
       [<c018adb5>] do_filp_open+0x1ad/0x62f
       [<c0107cdc>] ? native_sched_clock+0x82/0x96
       [<c06ac309>] ? _spin_unlock+0x27/0x3c
       [<c019379e>] ? alloc_fd+0xbf/0xc9
       [<c06ae2f4>] ? sub_preempt_count+0x9d/0xab
       [<c019379e>] ? alloc_fd+0xbf/0xc9
       [<c0180391>] do_sys_open+0x42/0xb8
       [<c041d564>] ? trace_hardirqs_on_thunk+0xc/0x10
       [<c0180449>] sys_open+0x1e/0x26
       [<c01038bd>] sysenter_do_call+0x12/0x31
       =======================
    
    The problem is that we don't unlock the bfs->lock mutex before calling
    iput (we do in the other cases).
    
    Signed-off-by: Eric Sesterhenn <snakebyte@gmx.de>
    Cc: Tigran Aivazian <tigran@aivazian.fsnet.co.uk>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit b261dfea48e81636516f4fa653667097638a8a62
Author: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>
Date:   Sat Sep 13 02:33:10 2008 -0700

    coredump_filter: add description of bit 4
    
    There is no description of bit 4 of coredump_filter in the
    documentation.  This patch adds it.
    
    Signed-off-by: Hidehiro Kawai <hidehiro.kawai.ez@hitachi.com>
    Cc: Roland McGrath <roland@redhat.com>
    Cc: Mel Gorman <mel@csn.ul.ie>
    Acked-by: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 024994310e10cd7632f43b6873558820308c1af1
Author: Li Zefan <lizf@cn.fujitsu.com>
Date:   Sat Sep 13 02:33:09 2008 -0700

    cpuset: hotplug documentation fix
    
    If all the cpus in a cpuset are offlined, the tasks in it will be moved to
    the nearest ancestor with non-empty cpus.
    
    Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
    Acked-by: Paul Jackson <pj@sgi.com>
    Cc: Paul Menage <menage@google.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 4e74339af6a59c061cf02f1ac497766bca1de19a
Author: Li Zefan <lizf@cn.fujitsu.com>
Date:   Sat Sep 13 02:33:08 2008 -0700

    cpuset: avoid changing cpuset's cpus when -errno returned
    
    After the patch:
    
    commit 0b2f630a28d53b5a2082a5275bc3334b10373508
    Author: Miao Xie <miaox@cn.fujitsu.com>
    Date:   Fri Jul 25 01:47:21 2008 -0700
    
        cpusets: restructure the function update_cpumask() and update_nodemask()
    
    It might happen that 'echo 0 > /cpuset/sub/cpus' returned failure but 'cpus'
    has been changed, because cpus was changed before calling heap_init() which
    may return -ENOMEM.
    
    This patch restores the orginal behavior.
    
    Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
    Acked-by: Paul Menage <menage@google.com>
    Cc: Paul Jackson <pj@sgi.com>
    Cc: Miao Xie <miaox@cn.fujitsu.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit dea420ce0e2973e8ef1fd11fde6804c8d03a82ad
Author: Hiroshi DOYU <Hiroshi.DOYU@nokia.com>
Date:   Sat Sep 13 02:33:07 2008 -0700

    include/linux/ioport.h: add missing macro argument for devm_release_* family
    
    akpm: these have no callers at this time, but they shall soon, so let's
    get them right.
    
    [akpm@linux-foundation.org: coding-style fixes]
    Signed-off-by: Hiroshi DOYU <Hiroshi.DOYU@nokia.com>
    Cc: Tony Lindgren <tony@atomide.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 665020c35e89a9e0643e21561e4f8f967f4f2c4b
Author: Alexey Dobriyan <adobriyan@gmail.com>
Date:   Sat Sep 13 02:33:06 2008 -0700

    proc: more debugging for "already registered" case
    
    Print parent directory name as well.
    
    The aim is to catch non-creation of parent directory when proc_mkdir will
    return NULL and all subsequent registrations go directly in /proc instead
    of intended directory.
    
    Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    [ Fixed insane printk string while at it.  - Linus ]
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 97b697a11b07e2ebfa69c488132596cc5eb24119
Author: Taisuke Yamada <tai@rakugaki.org>
Date:   Sat Sep 13 16:46:15 2008 -0400

    [libata] LBA28/LBA48 off-by-one bug in ata.h
    
    I recently bought 3 HGST P7K500-series 500GB SATA drives and
    had trouble accessing the block right on the LBA28-LBA48 border.
    Here's how it fails (same for all 3 drives):
    
      # dd if=/dev/sdc bs=512 count=1 skip=268435455 > /dev/null
      dd: reading `/dev/sdc': Input/output error
      0+0 records in
      0+0 records out
      0 bytes (0 B) copied, 0.288033 seconds, 0.0 kB/s
      # dmesg
      ata1.00: exception Emask 0x0 SAct 0x0 SErr 0x0 action 0x0
      ata1.00: BMDMA stat 0x25
      ata1.00: cmd c8/00:08:f8:ff:ff/00:00:00:00:00/ef tag 0 dma 4096 in
      res 51/04:08:f8:ff:ff/00:00:00:00:00/ef Emask 0x1 (device error)
      ata1.00: status: { DRDY ERR }
      ata1.00: error: { ABRT }
      ata1.00: configured for UDMA/33
      ata1: EH complete
      ...
    
    After some investigations, it turned out this seems to be caused
    by misinterpretation of the ATA specification on LBA28 access.
    Following part is the code in question:
    
      === include/linux/ata.h ===
      static inline int lba_28_ok(u64 block, u32 n_block)
      {
        /* check the ending block number */
        return ((block + n_block - 1) < ((u64)1 << 28)) && (n_block <= 256);
      }
    
    HGST drive (sometimes) fails with LBA28 access of {block = 0xfffffff,
    n_block = 1}, and this behavior seems to be comformant. Other drives,
    including other HGST drives are not that strict, through.
    
    >From the ATA specification:
    (http://www.t13.org/Documents/UploadedDocuments/project/d1410r3b-ATA-ATAPI-6.pdf)
    
      8.15.29  Word (61:60): Total number of user addressable sectors
      This field contains a value that is one greater than the total number
      of user addressable sectors (see 6.2). The maximum value that shall
      be placed in this field is 0FFFFFFFh.
    
    So the driver shouldn't use the value of 0xfffffff for LBA28 request
    as this exceeds maximum user addressable sector. The logical maximum
    value for LBA28 is 0xffffffe.
    
    The obvious fix is to cut "- 1" part, and the patch attached just do
    that. I've been using the patched kernel for about a month now, and
    the same fix is also floating on the net for some time. So I believe
    this fix works reliably.
    
    Just FYI, many Windows/Intel platform users also seems to be struck
    by this, and HGST has issued a note pointing to Intel ICH8/9 driver.
    
      "28-bit LBA command is being used to access LBAs 29-bits in length"
    http://www.hitachigst.com/hddt/knowtree.nsf/cffe836ed7c12018862565b000530c74/b531b8bce8745fb78825740f00580e23
    
    Also, *BSDs seems to have similar fix included sometime around ~2004,
    through I have not checked out exact portion of the code.
    
    Signed-off-by: Taisuke Yamada <tai@rakugaki.org>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 99580664aa83ca04bb52988d504a4195b41833b0
Author: Bob Stewart <bob@evoria.net>
Date:   Thu Sep 11 11:50:03 2008 +0200

    sata_inic162x: enable LED blinking
    
    Enable LED blinking.
    
    Signed-off-by: Bob Stewart <bob@evoria.net>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit da3ceb2288d0b50373b69d57a81c34fdd7cd11aa
Author: Stephen Hemminger <shemminger@vyatta.com>
Date:   Mon Sep 8 09:31:39 2008 -0700

    ata: duplicate variable sparse warning
    
    drivers/ata/ata_piix.c:1502:7: warning: symbol 'rc' shadows an earlier one
    
    Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
    Signed-off-by: Jeff Garzik <jgarzik@redhat.com>

commit 88c381bf09d7b3f2c2e8749150087aff2c434be4
Author: Russell King <rmk@dyn-67.arm.linux.org.uk>
Date:   Sat Sep 13 21:23:06 2008 +0100

    [ARM] Fix PCI_DMA_BUS_IS_PHYS for ARM
    
    PCI_DMA_BUS_IS_PHYS was defined to be zero, which meant we ignored
    the DMA mask for IDE and SCSI transfers.  This is wrong - we have
    no DMA translation hardware.  We want to obey DMA masks so that the
    block layer performs bouncing itself.
    
    Reported-by: Mikael Pettersson <mikpe@it.uu.se>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

commit 68ddb1d963c44da913b0331b633828c48206351b
Merge: c33de47... 9fbe604...
Author: Russell King <rmk@dyn-67.arm.linux.org.uk>
Date:   Sat Sep 13 20:10:59 2008 +0100

    Merge branch 'for-rmk' of git://pasiphae.extern.pengutronix.de/git/imx/linux-2.6.git

commit c33de47bce74e0c890f9f830a7641371524edbc1
Author: Dmitry Baryshkov <dbaryshkov@gmail.com>
Date:   Thu Sep 11 01:28:51 2008 +0100

    [ARM] 5247/1: tosa: SW_EAR_IN support
    
    Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
    Acked-by: Eric Miao <eric.miao@marvell.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

commit 7bdb22c9d4b4f526b81770cd719d2f5dddf0373d
Author: Dmitry Baryshkov <dbaryshkov@gmail.com>
Date:   Wed Sep 10 10:30:37 2008 +0100

    [ARM] 5246/1: tosa: add proper clock alias for tc6393xb clock
    
    Add clock alias for clock that is used by tc6393xb device on tosa.
    As that chip plays pretty major part in tosa life and is currently
    disabled, this is 2.4.27 material.
    
    Signed-off-by: Dmitry Baryshkov <dbaryshkov@gmail.com>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

commit 632480ea6548ae66e89a49ef037fd593c7a52418
Author: Jürgen Schindele <linux@schindele.name>
Date:   Mon Sep 8 22:06:29 2008 +0100

    [ARM] 5245/1: Fix warning about unused return value in drivers/pcmcia
    
    Fix warning when compiling "drivers/pcmcia/soc-common.c"
    The return value of the function "device_create_file"
    was not used / assigned.
    
    Signed-off-by: Jrgen Schindele <linux@schindele.name>
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

commit 395a125c6237802b19bf22b41017c99ff57f1024
Author: Yinghai Lu <yhlu.kernel@gmail.com>
Date:   Tue Sep 9 12:27:52 2008 -0700

    PCI: re-add debug prints for unmodified BARs
    
    Print out for device BAR values before the kernel tries to update them.
    Also make related output use KERN_DEBUG.
    
    Signed-off-by: Yinghai Lu <yhlu.kernel@gmail.com>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>

commit cff502a38394fd33693f6233e03fca363dfa956d
Author: Santwona Behera <santwona.behera@sun.com>
Date:   Fri Sep 12 16:04:26 2008 -0700

    niu: panic on reset
    
    The reset_task function in the niu driver does not reset the tx and rx
    buffers properly. This leads to panic on reset. This patch is a
    modified implementation of the previously posted fix.
    
    Signed-off-by: Santwona Behera <santwona.behera@sun.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 7d4ee289d139d27b619c08c9809e7b1088c100aa
Author: David S. Miller <davem@davemloft.net>
Date:   Fri Sep 12 15:01:31 2008 -0700

    sparc: Fix user_regset 'n' field values.
    
    As noticed by Russell King, we were not setting this properly
    to the number of entries, but rather the total size.
    
    This results in the core dumping code allocating waayyyy too
    much memory.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 80a56ab626c70468be92e74cf3d288ffaed23fdb
Author: David S. Miller <davem@davemloft.net>
Date:   Fri Sep 12 15:13:15 2008 -0700

    sparc64: Fix PCI error interrupt registry on PSYCHO.
    
    We need to pass IRQF_SHARED, otherwise we get things like:
    
    IRQ handler type mismatch for IRQ 33
    current handler: PSYCHO_UE
    Call Trace:
     [000000000048394c] request_irq+0xac/0x120
     [00000000007c5f6c] psycho_scan_bus+0x98/0x158
     [00000000007c2bc0] pcibios_init+0xdc/0x12c
     [0000000000426a5c] do_one_initcall+0x1c/0x160
     [00000000007c0180] kernel_init+0x9c/0xfc
     [0000000000427050] kernel_thread+0x30/0x60
     [00000000006ae1d0] rest_init+0x10/0x60
    
    on e3500 and similar systems.
    
    On a single board, the UE interrupts of two Psycho nodes
    are funneled through the same interrupt, from of_debug=3
    dump:
    
    /pci@b,4000: direct translate 2ee --> 21
     ...
    /pci@b,2000: direct translate 2ee --> 21
    
    Decimal "33" mentioned above is the hex "21" mentioned here.
    
    Thanks to Meelis Roos for dumps and testing.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 0ad5bce7409d681a5655c66e64bb0eb740b89c1f
Author: Jeremy Fitzhardinge <jeremy@goop.org>
Date:   Thu Sep 11 16:42:00 2008 -0700

    x86: fix possible x86_64 and EFI regression
    
    Russ Anderson reported a boot crash with EFI and latest mainline:
    
     BIOS-e820: 00000000fffa0000 - 00000000fffac000 (reserved)
    Pid: 0, comm: swapper Not tainted 2.6.27-rc5-00100-gec0c15a-dirty #5
    
    Call Trace:
     [<ffffffff80849195>] early_idt_handler+0x55/0x69
     [<ffffffff80313e52>] __memcpy+0x12/0xa4
     [<ffffffff80859015>] efi_init+0xce/0x932
     [<ffffffff80869c83>] setup_early_serial8250_console+0x2d/0x36a
     [<ffffffff80238688>] __insert_resource+0x18/0xc8
     [<ffffffff8084f6de>] setup_arch+0x3a7/0x632
     [<ffffffff808499ed>] start_kernel+0x91/0x367
     [<ffffffff80849393>] x86_64_start_kernel+0xe3/0xe7
     [<ffffffff808492b0>] x86_64_start_kernel+0x0/0xe7
    
     RIP 0x10
    
    Such a crash is possible if the CPU in this system is a 64-bit
    processor which doesn't support NX (ie, old Intel P4 -based64-bit
    processors).
    
    Certainly, if we support such processors, then we should start with
    _PAGE_NX initially clear in __supported_pte_flags, and then set it once
    we've established that the processor does indeed support NX.  That will
    prevent early_ioremap - or anything else - from trying to set it.
    
    The simple fix is to simply call check_efer() earlier.
    
    Reported-by: Russ Anderson <rja@sgi.com>
    Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>

commit d58b622b5de9747c82fcc3548f3ec87a02c24dce
Merge: 1045b03... 7c6a329...
Author: David S. Miller <davem@davemloft.net>
Date:   Thu Sep 11 19:11:50 2008 -0700

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/holtmann/bluetooth-2.6

commit 1045b03e07d85f3545118510a587035536030c1c
Author: Vegard Nossum <vegard.nossum@gmail.com>
Date:   Thu Sep 11 19:05:29 2008 -0700

    netlink: fix overrun in attribute iteration
    
    kmemcheck reported this:
    
      kmemcheck: Caught 16-bit read from uninitialized memory (f6c1ba30)
      0500110001508abf050010000500000002017300140000006f72672e66726565
       i i i i i i i i i i i i i u u u u u u u u u u u u u u u u u u u
                                       ^
    
      Pid: 3462, comm: wpa_supplicant Not tainted (2.6.27-rc3-00054-g6397ab9-dirty #13)
      EIP: 0060:[<c05de64a>] EFLAGS: 00010296 CPU: 0
      EIP is at nla_parse+0x5a/0xf0
      EAX: 00000008 EBX: fffffffd ECX: c06f16c0 EDX: 00000005
      ESI: 00000010 EDI: f6c1ba30 EBP: f6367c6c ESP: c0a11e88
       DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
      CR0: 8005003b CR2: f781cc84 CR3: 3632f000 CR4: 000006d0
      DR0: c0ead9bc DR1: 00000000 DR2: 00000000 DR3: 00000000
      DR6: ffff4ff0 DR7: 00000400
       [<c05d4b23>] rtnl_setlink+0x63/0x130
       [<c05d5f75>] rtnetlink_rcv_msg+0x165/0x200
       [<c05ddf66>] netlink_rcv_skb+0x76/0xa0
       [<c05d5dfe>] rtnetlink_rcv+0x1e/0x30
       [<c05dda21>] netlink_unicast+0x281/0x290
       [<c05ddbe9>] netlink_sendmsg+0x1b9/0x2b0
       [<c05beef2>] sock_sendmsg+0xd2/0x100
       [<c05bf945>] sys_sendto+0xa5/0xd0
       [<c05bf9a6>] sys_send+0x36/0x40
       [<c05c03d6>] sys_socketcall+0x1e6/0x2c0
       [<c020353b>] sysenter_do_call+0x12/0x3f
       [<ffffffff>] 0xffffffff
    
    This is the line in nla_ok():
    
      /**
       * nla_ok - check if the netlink attribute fits into the remaining bytes
       * @nla: netlink attribute
       * @remaining: number of bytes remaining in attribute stream
       */
      static inline int nla_ok(const struct nlattr *nla, int remaining)
      {
              return remaining >= sizeof(*nla) &&
                     nla->nla_len >= sizeof(*nla) &&
                     nla->nla_len <= remaining;
      }
    
    It turns out that remaining can become negative due to alignment in
    nla_next(). But GCC promotes "remaining" to unsigned in the test
    against sizeof(*nla) above. Therefore the test succeeds, and the
    nla_for_each_attr() may access memory outside the received buffer.
    
    A short example illustrating this point is here:
    
      #include <stdio.h>
    
      main(void)
      {
              printf("%d\n", -1 >= sizeof(int));
      }
    
    ...which prints "1".
    
    This patch adds a cast in front of the sizeof so that GCC will make
    a signed comparison and fix the illegal memory dereference. With the
    patch applied, there is no kmemcheck report.
    
    Signed-off-by: Vegard Nossum <vegard.nossum@gmail.com>
    Acked-by: Thomas Graf <tgraf@suug.ch>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 7c6a329e444725f24c02192ac493d8a7cd9fa638
Author: Marcel Holtmann <marcel@holtmann.org>
Date:   Fri Sep 12 03:11:54 2008 +0200

    [Bluetooth] Fix regression from using default link policy
    
    To speed up the Simple Pairing connection setup, the support for the
    default link policy has been enabled. This is in contrast to settings
    the link policy on every connection setup. Using the default link policy
    is the preferred way since there is no need to dynamically change it for
    every connection.
    
    For backward compatibility reason and to support old userspace the
    HCISETLINKPOL ioctl has been switched over to using hci_request() to
    issue the HCI command for setting the default link policy instead of
    just storing it in the HCI device structure.
    
    However the hci_request() can only be issued when the device is
    brought up. If used on a device that is registered, but still down
    it will timeout and fail. This is problematic since the command is
    put on the TX queue and the Bluetooth core tries to submit it to
    hardware that is not ready yet. The timeout for these requests is
    10 seconds and this causes a significant regression when setting up
    a new device.
    
    The userspace can perfectly handle a failure of the HCISETLINKPOL
    ioctl and will re-submit it later, but the 10 seconds delay causes
    a problem. So in case hci_request() is called on a device that is
    still down, just fail it with ENETDOWN to indicate what happens.
    
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

commit a551b98d5f6fce5897d497abd8bfb262efb33d2a
Merge: d1c6d2e... 50bed2e...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Sep 11 11:50:15 2008 -0700

    Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block
    
    * 'for-linus' of git://git.kernel.dk/linux-2.6-block:
      sg: disable interrupts inside sg_copy_buffer

commit d1c6d2e547148c5aa0c0a4ff6aac82f7c6da1d8b
Author: David Howells <dhowells@redhat.com>
Date:   Thu Sep 11 17:18:56 2008 +0100

    MN10300: Change the fault handler to check in_atomic() not in_interrupt()
    
    Change the MN10300 fault handler to make it check in_atomic() rather than
    in_interrupt() as commit 6edaf68a87d17570790fd55f0c451a29ec1d6703 did for other
    architectures:
    
    	Author: Peter Zijlstra <a.p.zijlstra@chello.nl>
    	Date:   Wed Dec 6 20:32:18 2006 -0800
    
    	[PATCH] mm: arch do_page_fault() vs in_atomic()
    
    	In light of the recent pagefault and filemap_copy_from_user work I've
    	gone through all the arch pagefault handlers to make sure the
    	inc_preempt_count() 'feature' works as expected.
    
    	Several sections of code (including the new filemap_copy_from_user)
    	rely on the fact that faults do not take locks under increased preempt
    	count.
    
    Signed-off-by: David Howells <dhowells@redhat.com>
    Acked-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 50bed2e2862a8f3a4f7d683d0d27292e71ef18b9
Author: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Date:   Thu Sep 11 18:35:39 2008 +0200

    sg: disable interrupts inside sg_copy_buffer
    
    The callers of sg_copy_buffer must disable interrupts before calling
    it (since it uses kmap_atomic). Some callers use it on
    interrupt-disabled code but some need to take the trouble to disable
    interrupts just for this. No wonder they forget about it and we hit a
    bug like:
    
    http://bugzilla.kernel.org/show_bug.cgi?id=11529
    
    James said that it might be better to disable interrupts inside the
    function rather than risk the callers getting it wrong.
    
    Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
    Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

commit 6d242a263618ba7f0f9a41dd91b347d19e704bbe
Merge: a0a4a2c... 2dc75d3...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Sep 11 08:42:55 2008 -0700

    Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block
    
    * 'for-linus' of git://git.kernel.dk/linux-2.6-block:
      block: disable sysfs parts of the disk command filter

commit a0a4a2cb0d69446c084792a40884d911dfc3cf27
Merge: 29cd195... 534e38b...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Sep 11 08:42:14 2008 -0700

    Merge branch 'kvm-updates/2.6.27' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm
    
    * 'kvm-updates/2.6.27' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm:
      KVM: VMX: Always return old for clear_flush_young() when using EPT
      KVM: SVM: fix guest global tlb flushes with NPT
      KVM: SVM: fix random segfaults with NPT enabled

commit 29cd195e078db0d90dd447a156039513ecdd8f16
Merge: c529b7e... 01b291b...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Sep 11 08:41:17 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
      [SCSI] fix check of PQ and PDT bits for WLUNs
      [SCSI] make scsi_check_sense HARDWARE_ERROR return ADD_TO_MLQUEUE on retry
      [SCSI] scsi_dh: make check_sense return ADD_TO_MLQUEUE
      [SCSI] zfcp: Remove duplicated unlikely() macros.
      [SCSI] zfcp: channel cannot be detached due to refcount imbalance
      [SCSI] zfcp: Fix reference counter for remote ports
      [SCSI] zfcp: Simplify ccw notify handler
      [SCSI] zfcp: Correctly query end flag in gpn_ft response
      [SCSI] zfcp: Fix request queue locking
      [SCSI] sd: select CRC_T10DIF only when necessary

commit c529b7e2db948e240c48c54a83d0b6279275e57d
Merge: e2858ce... e7b1403...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Sep 11 08:40:32 2008 -0700

    Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6
    
    * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
      [IA64] prevent ia64 from invoking irq handlers on offline CPUs
      [IA64] arch/ia64/sn/pci/tioca_provider.c: introduce missing kfree
      [IA64] fix up bte.h
      [IA64] fix compile failure with non modular builds

commit e2858ce3ed519500e3b9af1c16c25250ff16cd5c
Merge: 9a0e4c8... 5c89468...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Thu Sep 11 08:40:11 2008 -0700

    Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-udf-2.6
    
    * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-udf-2.6:
      udf: add llseek method
      udf: Fix error paths in udf_new_inode()
      udf: Fix lock inversion between iprune_mutex and alloc_mutex (v2)

commit 69da6b87fcb270f758fe75141c32e041f8db510c
Author: Jouni Malinen <jouni.malinen@atheros.com>
Date:   Mon Aug 11 14:01:50 2008 +0300

    ath9k: Assign seq# when mac80211 requests this
    
    Use TX control flag IEEE80211_TX_CTL_ASSIGN_SEQ as a request to update
    the seq# for the frames. This will likely require some further cleanup
    to get seq# correctly for Beacons vs. other frames and also potentially
    for multiple BSSes. Anyway, this is better than ending up sending out
    most frames with seq# 0.
    
    (This is a backport of patch w/ same title already in net-next-2.6.
    It is verified to fix http://bugzilla.kernel.org/show_bug.cgi?id=11394
    and it should be acceptable for -rc due to the driver being new
    in 2.6.27.)
    
    Signed-off-by: Jouni Malinen <jouni.malinen@atheros.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 2dc75d3c3b49c64fd26b4832a7efb75546cb3fc5
Author: Jens Axboe <jens.axboe@oracle.com>
Date:   Thu Sep 11 14:20:23 2008 +0200

    block: disable sysfs parts of the disk command filter
    
    We still have life time issues with the sysfs command filter kobject,
    so disable it for 2.6.27 release. We can revisit this and make it work
    properly for 2.6.28, for 2.6.27 release it's too risky.
    
    Signed-off-by: Jens Axboe <jens.axboe@oracle.com>

commit 7736c09c6cf9521f2413d78856a66f4a37046e84
Author: Russell King <rmk@dyn-67.arm.linux.org.uk>
Date:   Tue Sep 9 10:16:22 2008 +0100

    [ARM] OMAP: Fix MMC device data
    
    OMAPs MMC device data was passing the wrong structure via the platform
    device.  Moreover, a missing function means that both sx1_defconfig
    and omap_h2_1610_defconfig builds failed with
    
    	undefined reference to `omap_set_mmc_info'
    
    errors.  Fix this by updating the MMC support from the omapzoom tree.
    
    Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

commit f1926ce63b996b42772b39e4b47bb4ef4ba748b4
Author: Dominik Brodowski <linux@dominikbrodowski.net>
Date:   Thu Sep 11 11:09:49 2008 +0200

    clocksource, acpi_pm.c: fix check for monotonicity
    
    Actually check the monotonicity of the ACPI PMTMR ten times, only delay for
    0.9 miliseconds at most, and bail out early if some problem is determined.
    
    Reported-by: Jochen Voß <jochen.voss@googlemail.com>
    Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>

commit 6ef62164e794c480259ac158aa6c8c7b85746545
Merge: e75b986... adee14b...
Author: Ingo Molnar <mingo@elte.hu>
Date:   Thu Sep 11 11:13:58 2008 +0200

    Merge commit 'v2.6.27-rc6' into timers/urgent

commit 534e38b447df47f129a6d3ec3af6705c1e3f651e
Author: Sheng Yang <sheng.yang@intel.com>
Date:   Mon Sep 8 15:12:30 2008 +0800

    KVM: VMX: Always return old for clear_flush_young() when using EPT
    
    As well as discard fake accessed bit and dirty bit of EPT.
    
    Signed-off-by: Sheng Yang <sheng.yang@intel.com>
    Signed-off-by: Avi Kivity <avi@qumranet.com>

commit e5eab0cede4b1ffaca4ad857d840127622038e55
Author: Joerg Roedel <joerg.roedel@amd.com>
Date:   Tue Sep 9 19:11:51 2008 +0200

    KVM: SVM: fix guest global tlb flushes with NPT
    
    Accesses to CR4 are intercepted even with Nested Paging enabled. But the code
    does not check if the guest wants to do a global TLB flush. So this flush gets
    lost. This patch adds the check and the flush to svm_set_cr4.
    
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Avi Kivity <avi@qumranet.com>

commit 44874f84918e37b64bec6df1587e5fe2fdf6ab62
Author: Joerg Roedel <joerg.roedel@amd.com>
Date:   Wed Aug 27 14:18:43 2008 +0200

    KVM: SVM: fix random segfaults with NPT enabled
    
    This patch introduces a guest TLB flush on every NPF exit in KVM. This fixes
    random segfaults and #UD exceptions in the guest seen under some workloads
    (e.g. long running compile workloads or tbench). A kernbench run with and
    without that fix showed that it has a slowdown lower than 0.5%
    
    Cc: stable@kernel.org
    Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
    Signed-off-by: Alexander Graf <agraf@suse.de>
    Signed-off-by: Avi Kivity <avi@qumranet.com>

commit ec5d498991e87c74730509508b25c3959192b7e7
Author: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>
Date:   Wed Sep 10 17:00:19 2008 -0700

    sched: fix deadlock in setting scheduler parameter to zero
    
    Andrei Gusev wrote:
    
    > I played witch scheduler settings. After doing something like:
    > echo -n 1000000 >sched_rt_period_us
    >
    > command is locked. I found in kernel.log:
    >
    > Sep 11 00:39:34 zaratustra
    > Sep 11 00:39:34 zaratustra Pid: 4495, comm: bash Tainted: G        W
    > (2.6.26.3 #12)
    > Sep 11 00:39:34 zaratustra EIP: 0060:[<c0213fc7>] EFLAGS: 00210246 CPU: 0
    > Sep 11 00:39:34 zaratustra EIP is at div64_u64+0x57/0x80
    > Sep 11 00:39:34 zaratustra EAX: 0000389f EBX: 00000000 ECX: 00000000
    > EDX: 00000000
    > Sep 11 00:39:34 zaratustra ESI: d9800000 EDI: d9800000 EBP: 0000389f
    > ESP: ea7a6edc
    > Sep 11 00:39:34 zaratustra DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
    > Sep 11 00:39:34 zaratustra Process bash (pid: 4495, ti=ea7a6000
    > task=ea744000 task.ti=ea7a6000)
    > Sep 11 00:39:34 zaratustra Stack: 00000000 000003e8 d9800000 0000389f
    > c0119042 00000000 00000000 00000001
    > Sep 11 00:39:34 zaratustra 00000000 00000000 ea7a6f54 00010000 00000000
    > c04d2e80 00000001 000e7ef0
    > Sep 11 00:39:34 zaratustra c01191a3 00000000 00000000 ea7a6fa0 00000001
    > ffffffff c04d2e80 ea5b2480
    > Sep 11 00:39:34 zaratustra Call Trace:
    > Sep 11 00:39:34 zaratustra [<c0119042>] __rt_schedulable+0x52/0x130
    > Sep 11 00:39:34 zaratustra [<c01191a3>] sched_rt_handler+0x83/0x120
    > Sep 11 00:39:34 zaratustra [<c01a76a6>] proc_sys_call_handler+0xb6/0xd0
    > Sep 11 00:39:34 zaratustra [<c01a76c0>] proc_sys_write+0x0/0x20
    > Sep 11 00:39:34 zaratustra [<c01a76d9>] proc_sys_write+0x19/0x20
    > Sep 11 00:39:34 zaratustra [<c016cc68>] vfs_write+0xa8/0x140
    > Sep 11 00:39:34 zaratustra [<c016cdd1>] sys_write+0x41/0x80
    > Sep 11 00:39:34 zaratustra [<c0103051>] sysenter_past_esp+0x6a/0x91
    > Sep 11 00:39:34 zaratustra =======================
    > Sep 11 00:39:34 zaratustra Code: c8 41 0f ad f3 d3 ee f6 c1 20 0f 45 de
    > 31 f6 0f ad ef d3 ed f6 c1 20 0f 45 fd 0f 45 ee 31 c9 39 eb 89 fe 89 ea
    > 77 08 89 e8 31 d2 <f7> f3 89 c1 89 f0 8b 7c 24 08 f7 f3 8b 74 24 04 89
    > ca 8b 1c 24
    > Sep 11 00:39:34 zaratustra EIP: [<c0213fc7>] div64_u64+0x57/0x80 SS:ESP
    > 0068:ea7a6edc
    > Sep 11 00:39:34 zaratustra ---[ end trace 4eaa2a86a8e2da22 ]---
    
    fix the boundary condition.
    
    sysctl_sched_rt_period=0 makes exception at to_ratio().
    
    Signed-off-by: Hiroshi Shimamoto <h-shimamoto@ct.jp.nec.com>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>

commit baf25731e54d06eb13dc4eda78c6dc7da4ce84e8
Author: Zhang, Yanmin <yanmin_zhang@linux.intel.com>
Date:   Tue Sep 9 11:26:33 2008 +0800

    sched: fix 2.6.27-rc5 couldn't boot on tulsa machine randomly
    
    On my tulsa x86-64 machine, kernel 2.6.25-rc5 couldn't boot randomly.
    
    Basically, function __enable_runtime forgets to reset rt_rq->rt_throttled
    to 0. When every cpu is up, per-cpu migration_thread is created and it runs
    very fast, sometimes to mark the corresponding rt_rq->rt_throttled to 1 very
    quickly. After all cpus are up, with below calling chain:
    
       sched_init_smp => arch_init_sched_domains => build_sched_domains => ...
    => cpu_attach_domain => rq_attach_root => set_rq_online => ...
    => _enable_runtime
    
    _enable_runtime is called against every rt_rq again, so rt_rq->rt_time is
    reset to 0, but rt_rq->rt_throttled might be still 1. Later on function
    do_sched_rt_period_timer couldn't reset it, and all RT tasks couldn't be
    scheduled to run on that cpu. here is RT task migration_thread which is
    woken up when a task is migrated to another cpu.
    
    Below patch fixes it against 2.6.27-rc5.
    
    Signed-off-by: Zhang Yanmin <yanmin_zhang@linux.intel.com>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>

commit bdba4d6b77fcc76f206986d7cc55f1feb20301f8
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Sep 10 23:38:51 2008 -0700

    sparc32: Fix function signature of of_bus_sbus_get_flags().
    
    This doesn't match the function pointer type it gets assigned
    to.  Luckily, this was harmless.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 9a0e4c8038390342f48e574b157a1971e2f07348
Merge: 9e7222c... 46dfa04...
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Wed Sep 10 14:16:53 2008 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/bart/ide-2.6:
      add deprecated ide-scsi to feature-removal-schedule.txt
      ide: Fix pointer arithmetic in hpt3xx driver code (3rd try)

commit 9e7222c83560186686319f2892f43fc557baed2d
Author: Geert Uytterhoeven <geert@linux-m68k.org>
Date:   Wed Sep 10 22:15:19 2008 +0200

    m68k: Update defconfigs for 2.6.27-rc6
    
    Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 5368f69c8b155d6e82dfc622d817c882689e9cd9
Author: Geert Uytterhoeven <geert@linux-m68k.org>
Date:   Wed Sep 10 22:15:18 2008 +0200

    VIDEO_SH_MOBILE_CEU should depend on HAS_DMA
    
    commit 0d3244d6439c8c31d2a29efd587c7aca9042c8aa ("V4L/DVB (8342):
    sh_mobile_ceu_camera: Add SuperH Mobile CEU driver V3") introduced
    VIDEO_SH_MOBILE_CEU, which selects VIDEOBUF_DMA_CONTIG. This circumvents the
    dependency on HAS_DMA of VIDEOBUF_DMA_CONTIG.
    
    Add a dependency on HAS_DMA to VIDEO_SH_MOBILE_CEU to fix this.
    
    Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
    Acked-by: Paul Mundt <lethal@linux-sh.org>
    Acked-by: Magnus Damm <damm@igel.co.jp>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit ebfb2c63405f2410897674f14e41c031c9302909
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Sep 10 14:08:27 2008 -0700

    sparc64: Fix interrupt register calculations on Psycho and Sabre.
    
    Use the IMAP offset calculation for OBIO devices as documented in the
    programmer's manual.  Which is "0x10000 + ((ino & 0x1f) << 3)"
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 36223a399f639b13b7a454349565934e6d3e2db0
Author: Daniel J Blueman <daniel.blueman@gmail.com>
Date:   Wed Sep 10 21:07:55 2008 +0100

    swiotlb: fix back-off path when memory allocation fails
    
    This fixes a SWIOTLB oops
    
    With SWIOTLB being enabled and straight-forward page allocation
    failure [1], the swiotlb_alloc_coherent fall-back path hits an
    issue [2], resulting in my webcam failing to work.
    
    At the time of oops, RDI is clearly a pointer to a structure which
    has arrived as NULL, leading to the typo in swiotlb_map_single's
    callsite arguments.
    
    Correctly passing the device structure [3] addresses the issue and
    gets my webcam working again (the allocation failure still occuring).
    
     --- [1]
    
    skype: page allocation failure. order:3, mode:0x1
    Pid: 5895, comm: skype Not tainted 2.6.27-rc6-235c-debug #1
    
    Call Trace:
     [<ffffffff802b7cf0>] __alloc_pages_internal+0x4a0/0x5d0
     [<ffffffff802d5ddd>] alloc_pages_current+0xad/0x110
     [<ffffffff802b4ccd>] __get_free_pages+0x1d/0x60
     [<ffffffff8046cd39>] swiotlb_alloc_coherent+0x49/0x180
     [<ffffffff80212731>] dma_alloc_coherent+0x281/0x310
     [<ffffffff805621c0>] hcd_buffer_alloc+0x50/0x90
     [<ffffffff805547fd>] usb_buffer_alloc+0x2d/0x40
     [<ffffffffa0056763>] uvc_alloc_urb_buffers+0x53/0xf0 [uvcvideo]
     [<ffffffffa0056958>] uvc_init_video+0x158/0x3e0 [uvcvideo]
     [<ffffffffa0056c17>] uvc_video_enable+0x37/0x80 [uvcvideo]
     [<ffffffffa0055853>] uvc_v4l2_do_ioctl+0x723/0x1260 [uvcvideo]
     [<ffffffff8026dd61>] ? trace_hardirqs_off_caller+0x21/0xc0
     [<ffffffff8026dd61>] ? trace_hardirqs_off_caller+0x21/0xc0
     [<ffffffffa0032c9f>] video_usercopy+0x19f/0x390 [videodev]
     [<ffffffffa0055130>] ? uvc_v4l2_do_ioctl+0x0/0x1260 [uvcvideo]
     [<ffffffff8026d0ce>] ? put_lock_stats+0xe/0x30
     [<ffffffffa0054dad>] uvc_v4l2_ioctl+0x4d/0x80 [uvcvideo]
     [<ffffffffa0045083>] native_ioctl+0x83/0x90 [compat_ioctl32]
     [<ffffffffa004534e>] v4l_compat_ioctl32+0x2be/0x1da4 [compat_ioctl32]
     [<ffffffff806aad21>] ? do_page_fault+0x3d1/0xae0
     [<ffffffff80270ccd>] ? trace_hardirqs_on+0xd/0x10
     [<ffffffff80270c59>] ? trace_hardirqs_on_caller+0x149/0x1b0
     [<ffffffff80270ccd>] ? trace_hardirqs_on+0xd/0x10
     [<ffffffff80329afa>] compat_sys_ioctl+0x8a/0x3c0
     [<ffffffff806a700d>] ? trace_hardirqs_off_thunk+0x3a/0x3c
     [<ffffffff8022f816>] sysenter_dispatch+0x7/0x2c
     [<ffffffff806a6fce>] ? trace_hardirqs_on_thunk+0x3a/0x3f
    
    Mem-Info:
    Node 0 DMA per-cpu:
    CPU    0: hi:    0, btch:   1 usd:   0
    CPU    1: hi:    0, btch:   1 usd:   0
    Node 0 DMA32 per-cpu:
    CPU    0: hi:  186, btch:  31 usd:   3
    CPU    1: hi:  186, btch:  31 usd:   0
    Node 0 Normal per-cpu:
    CPU    0: hi:  186, btch:  31 usd:  23
    CPU    1: hi:  186, btch:  31 usd: 179
    Active:78545 inactive:48683 dirty:31 writeback:0 unstable:2
     free:830202 slab:17516 mapped:17473 pagetables:3496 bounce:0
    Node 0 DMA free:36kB min:28kB low:32kB high:40kB active:0kB
    inactive:0kB present:15156kB pages_scanned:0 all_unreclaimable? no
    lowmem_reserve[]: 0 3207 3956 3956
    Node 0 DMA32 free:3197192kB min:6512kB low:8140kB high:9768kB
    active:0kB inactive:0kB present:3284896kB pages_scanned:0
    all_unreclaimable? no
    lowmem_reserve[]: 0 0 748 748
    Node 0 Normal free:123580kB min:1516kB low:1892kB high:2272kB
    active:314180kB inactive:194732kB present:766464kB pages_scanned:0
    all_unreclaimable? no
    lowmem_reserve[]: 0 0 0 0
    Node 0 DMA: 1*4kB 0*8kB 0*16kB 1*32kB 0*64kB 0*128kB 0*256kB 0*512kB
    0*1024kB 0*2048kB 0*4096kB = 36kB
    Node 0 DMA32: 4*4kB 3*8kB 2*16kB 3*32kB 4*64kB 5*128kB 3*256kB 5*512kB
    4*1024kB 5*2048kB 776*4096kB = 3197224kB
    Node 0 Normal: 14*4kB 14*8kB 8*16kB 6*32kB 1*64kB 3*128kB 3*256kB
    2*512kB 4*1024kB 1*2048kB 28*4096kB = 123560kB
    64847 total pagecache pages
    0 pages in swap cache
    Swap cache stats: add 0, delete 0, find 0/0
    Free swap  = 502752kB
    Total swap = 502752kB
    1048576 pages RAM
    52120 pages reserved
    71967 pages shared
    143004 pages non-shared
    
     --- [2]
    
    BUG: unable to handle kernel NULL pointer dereference at 00000000000002c8
    IP: [<ffffffff8046c84c>] map_single+0x1c/0x280
    PGD 10e54e067 PUD 10e595067 PMD 0
    Oops: 0000 [1] PREEMPT SMP DEBUG_PAGEALLOC
    CPU 0
    Modules linked in: kvm_intel kvm microcode uvcvideo compat_ioctl32
    videodev v4l1_compat shpchp pci_hotplug
    Pid: 5895, comm: skype Not tainted 2.6.27-rc6-235c-debug #1
    RIP: 0010:[<ffffffff8046c84c>]  [<ffffffff8046c84c>] map_single+0x1c/0x280
    RSP: 0018:ffff88010e78d988  EFLAGS: 00210296
    RAX: 0000780000000000 RBX: 0000000000000000 RCX: 0000000000000002
    RDX: 0000000000005000 RSI: 0000000000000000 RDI: 0000000000000000
    RBP: ffff88010e78d9e8 R08: 0000000000000000 R09: 0000000000000001
    R10: ffff88010e78d698 R11: 0000000000000001 R12: 0000000000000002
    R13: 0000000000000000 R14: 0000000000005000 R15: ffff88012f1c9968
    FS:  0000000000000000(0000) GS:ffffffff80a6cdc0(0063) knlGS:00000000f6355b90
    CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
    CR2: 00000000000002c8 CR3: 000000010e57d000 CR4: 00000000000026e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process skype (pid: 5895, threadinfo ffff88010e78c000, task ffff88012b9cc460)
    Stack:  0000000200000000 0000000000005000 0000000000000000 0000000000000000
     00000000000017b8 0000000000000000 ffff88010e78d9c8 0000000000000000
     0000000000000002 0000000000000000 0000000000005000 ffff88012f1c9968
    Call Trace:
     [<ffffffff8046cbb0>] swiotlb_map_single_attrs+0x60/0xf0
     [<ffffffff8046cc4c>] swiotlb_map_single+0xc/0x10
     [<ffffffff8046cdee>] swiotlb_alloc_coherent+0xfe/0x180
     [<ffffffff80212731>] dma_alloc_coherent+0x281/0x310
     [<ffffffff805621c0>] hcd_buffer_alloc+0x50/0x90
     [<ffffffff805547fd>] usb_buffer_alloc+0x2d/0x40
     [<ffffffffa0056763>] uvc_alloc_urb_buffers+0x53/0xf0 [uvcvideo]
     [<ffffffffa0056958>] uvc_init_video+0x158/0x3e0 [uvcvideo]
     [<ffffffffa0056c17>] uvc_video_enable+0x37/0x80 [uvcvideo]
     [<ffffffffa0055853>] uvc_v4l2_do_ioctl+0x723/0x1260 [uvcvideo]
     [<ffffffff8026dd61>] ? trace_hardirqs_off_caller+0x21/0xc0
     [<ffffffff8026dd61>] ? trace_hardirqs_off_caller+0x21/0xc0
     [<ffffffffa0032c9f>] video_usercopy+0x19f/0x390 [videodev]
     [<ffffffffa0055130>] ? uvc_v4l2_do_ioctl+0x0/0x1260 [uvcvideo]
     [<ffffffff8026d0ce>] ? put_lock_stats+0xe/0x30
     [<ffffffffa0054dad>] uvc_v4l2_ioctl+0x4d/0x80 [uvcvideo]
     [<ffffffffa0045083>] native_ioctl+0x83/0x90 [compat_ioctl32]
     [<ffffffffa004534e>] v4l_compat_ioctl32+0x2be/0x1da4 [compat_ioctl32]
     [<ffffffff806aad21>] ? do_page_fault+0x3d1/0xae0
     [<ffffffff80270ccd>] ? trace_hardirqs_on+0xd/0x10
     [<ffffffff80270c59>] ? trace_hardirqs_on_caller+0x149/0x1b0
     [<ffffffff80270ccd>] ? trace_hardirqs_on+0xd/0x10
     [<ffffffff80329afa>] compat_sys_ioctl+0x8a/0x3c0
     [<ffffffff806a700d>] ? trace_hardirqs_off_thunk+0x3a/0x3c
     [<ffffffff8022f816>] sysenter_dispatch+0x7/0x2c
     [<ffffffff806a6fce>] ? trace_hardirqs_on_thunk+0x3a/0x3f
    
    Code: 45 31 c0 48 89 e5 e8 a4 ff ff ff c9 c3 66 90 55 48 89 e5 41 57
    41 56 41 55 41 54 53 48 83 ec 38 48 89 75 b0 48 89 55 a8 89 4d a4 <48>
    8b 87 c8 02 00 00 48 85 c0 0f 84 1c 02 00 00 48 8b 58 08 48
    RIP  [<ffffffff8046c84c>] map_single+0x1c/0x280
     RSP <ffff88010e78d988>
    CR2: 00000000000002c8
    ---[ end trace 5d15baeeb7025a0e ]---
    
     --- [3]
    
    ffffffff8046c830 <map_single>:
    map_single():
    /store/kernel/linux/lib/swiotlb.c:291
    ffffffff8046c830:       55                      push   %rbp
    ffffffff8046c831:       48 89 e5                mov    %rsp,%rbp
    ffffffff8046c834:       41 57                   push   %r15
    ffffffff8046c836:       41 56                   push   %r14
    ffffffff8046c838:       41 55                   push   %r13
    ffffffff8046c83a:       41 54                   push   %r12
    ffffffff8046c83c:       53                      push   %rbx
    ffffffff8046c83d:       48 83 ec 38             sub    $0x38,%rsp
    ffffffff8046c841:       48 89 75 b0             mov    %rsi,-0x50(%rbp)
    ffffffff8046c845:       48 89 55 a8             mov    %rdx,-0x58(%rbp)
    ffffffff8046c849:       89 4d a4                mov    %ecx,-0x5c(%rbp)
    dma_get_seg_boundary():
    /store/kernel/linux/include/linux/dma-mapping.h:80
    ffffffff8046c84c:       48 8b 87 c8 02 00 00    mov    0x2c8(%rdi),%rax <----
    
     --- [4]
    
    Signed-off-by: Daniel J Blueman <daniel.blueman@gmail.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 46dfa040f6c26f416a0979a7cd5a2d81f08121d5
Author: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
Date:   Wed Sep 10 22:22:34 2008 +0200

    add deprecated ide-scsi to feature-removal-schedule.txt
    
    Signed-off-by: FUJITA Tomonori <fujita.tomonori@lab.ntt.co.jp>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit 62ff2ecf7a4e69f7271b7f7a57aaee76ffe610f2
Author: Masoud Sharbiani <masouds@google.com>
Date:   Wed Sep 10 22:22:34 2008 +0200

    ide: Fix pointer arithmetic in hpt3xx driver code (3rd try)
    
    git commit 74811f355f4f69a187fa74892dcf2a684b84ce99 causes crash at
    module load (or boot) time on my machine with a hpt374 controller.
    The reason for this is that for initializing second controller which sets
    (hwif->dev == host->dev[1]) to true (1), adds 1 to a void ptr, which
    advances it by one byte instead of advancing it by sizeof(hpt_info) bytes.
    Because of this, all initialization functions get corrupted data in info
    variable which causes a crash at boot time.
    
    This patch fixes that and makes my machine boot again.
    
    The card itself is a HPT374 raid conroller: Here is the lspci -v output:
    03:06.0 RAID bus controller: HighPoint Technologies, Inc. HPT374 (rev
    07)
            Subsystem: HighPoint Technologies, Inc. Unknown device 0001
            Flags: bus master, 66MHz, medium devsel, latency 120, IRQ 28
            I/O ports at 8000 [size=8]
            I/O ports at 7800 [size=4]
            I/O ports at 7400 [size=8]
            I/O ports at 7000 [size=4]
            I/O ports at 6800 [size=256]
            Expansion ROM at fe8e0000 [disabled] [size=128K]
            Capabilities: [60] Power Management version 2
    
    03:06.1 RAID bus controller: HighPoint Technologies, Inc. HPT374 (rev
    07)
            Subsystem: HighPoint Technologies, Inc. Unknown device 0001
            Flags: bus master, 66MHz, medium devsel, latency 120, IRQ 28
            I/O ports at 9800 [size=8]
            I/O ports at 9400 [size=4]
            I/O ports at 9000 [size=8]
            I/O ports at 8800 [size=4]
            I/O ports at 8400 [size=256]
            Capabilities: [60] Power Management version 2
    
    Signed-off-by: Masoud Sharbiani <masouds@google.com>
    Cc: Sergei Shtylyov <sshtylyov@ru.mvista.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    [bart: use dev_get_drvdata() per Sergei's suggestion]
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>

commit e7b140365b86aaf94374214c6f4e6decbee2eb0a
Author: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Date:   Sun Aug 31 11:06:30 2008 -0700

    [IA64] prevent ia64 from invoking irq handlers on offline CPUs
    
    Make ia64 refrain from clearing a given to-be-offlined CPU's bit in the
    cpu_online_mask until it has processed pending irqs.  This change
    prevents other CPUs from being blindsided by an apparently offline CPU
    nevertheless changing globally visible state.  Also remove the existing
    redundant cpu_clear(cpu, cpu_online_map).
    
    Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Signed-off-by: Tony Luck <tony.luck@intel.com>

commit a5827f40afafc864f57a1c44915f0bfaf3d94f53
Author: Adrian Bunk <bunk@kernel.org>
Date:   Thu Aug 28 01:05:26 2008 +0300

    PCI: fix pciehp_free_irq()
    
    This patch fixes an obvious bug (loop was never entered) caused by
    commit 820943b6fc4781621dee52ba026106758a727dd3
    (pciehp: cleanup pcie_poll_cmd).
    
    Reported-by: Adrian Bunk <bunk@kernel.org>
    Signed-off-by: Adrian Bunk <bunk@kernel.org>
    Acked-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>

commit 6bf6a1a49377c32a02939ec835553703994f3e41
Author: Julia Lawall <julia@diku.dk>
Date:   Wed Sep 10 13:57:19 2008 +0200

    [IA64] arch/ia64/sn/pci/tioca_provider.c: introduce missing kfree
    
    Error handling code following a kmalloc should free the allocated data.
    
    Signed-off-by: Julia Lawall <julia@diku.dk>
    Signed-off-by: Tony Luck <tony.luck@intel.com>

commit 47633cf0d60bde5581d039ac1283ef4377a6e782
Author: Robin Holt <holt@sgi.com>
Date:   Tue Sep 9 10:34:44 2008 -0500

    [IA64] fix up bte.h
    
    bte.h expects a #define of L1_CACHE_MASK which is currently only
    in bte.c.  This small patch gets bte.h to include cleanly and makes
    BTE_UNALIGNED_COPY not report errors.
    
    Signed-off-by: Robin Holt <holt@sgi.com>
    Signed-off-by: Tony Luck <tony.luck@intel.com>

commit 4611a771fc8e5ad77d27f25268846abb425101a0
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Tue Sep 9 17:56:47 2008 -0500

    [IA64] fix compile failure with non modular builds
    
    Broke the non modular builds by moving an essential function into
    modules.c.  Fix this by moving it out again and into asm/sections.h as
    an inline.  To do this, the definitions of struct fdesc and struct
    got_val have been lifted out of modules.c and put in asm/elf.h where
    they belong.
    
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
    Signed-off-by: Tony Luck <tony.luck@intel.com>

commit f461a1d80c865e5ec4d24107adbab8b010b60e32
Author: Julia Lawall <julia@diku.dk>
Date:   Wed Sep 10 13:57:43 2008 +0200

    arch/x86/kernel/kdebugfs.c: introduce missing kfree
    
    Error handling code following a kmalloc should free the allocated data.
    Note that at the point of the change, node has not yet been stored in d, so
    it is not affected by the existing cleanup code.
    
    The semantic match that finds the problem is as follows:
    (http://www.emn.fr/x-info/coccinelle/)
    
    // <smpl>
    @r exists@
    local idexpression x;
    statement S;
    expression E;
    identifier f,l;
    position p1,p2;
    expression *ptr != NULL;
    @@
    
    (
    if ((x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...)) == NULL) S
    |
    x@p1 = \(kmalloc\|kzalloc\|kcalloc\)(...);
    ...
    if (x == NULL) S
    )
    <... when != x
         when != if (...) { <+...x...+> }
    x->f = E
    ...>
    (
     return \(0\|<+...x...+>\|ptr\);
    |
     return@p2 ...;
    )
    
    @script:python@
    p1 << r.p1;
    p2 << r.p2;
    @@
    
    print "* file: %s kmalloc %s return %s" % (p1[0].file,p1[0].line,p2[0].line)
    // </smpl>
    
    Signed-off-by: Julia Lawall <julia@diku.dk>
    Signed-off-by: Ingo Molnar <mingo@elte.hu>

commit 0e116227a01580acf47437adba3afadf21b6bd5f
Author: Tao Ma <tao.ma@oracle.com>
Date:   Wed Sep 3 01:57:14 2008 +0800

    ocfs2: Fix a bug in direct IO read.
    
    ocfs2 will become read-only if we try to read the bytes which pass
    the end of i_size. This can be easily reproduced by following steps:
    1. mkfs a ocfs2 volume with bs=4k cs=4k and nosparse.
    2. create a small file(say less than 100 bytes) and we will create the file
       which is allocated 1 cluster.
    3. read 8196 bytes from the kernel using O_DIRECT which exceeds the limit.
    4. The ocfs2 volume becomes read-only and dmesg shows:
    OCFS2: ERROR (device sda13): ocfs2_direct_IO_get_blocks:
    Inode 66010 has a hole at block 1
    File system is now read-only due to the potential of on-disk corruption.
    Please run fsck.ocfs2 once the file system is unmounted.
    
    So suppress the ERROR message.
    
    Signed-off-by: Tao Ma <tao.ma@oracle.com>
    Signed-off-by: Mark Fasheh <mfasheh@suse.com>

commit e75b986af7881ed8d8ccb1ed154045ed17cfebd0
Author: Thomas Gleixner <tglx@linutronix.de>
Date:   Tue Sep 9 21:38:57 2008 +0200

    clockevents: remove WARN_ON which was used to gather information
    
    The issue of the endless reprogramming loop due to a too small
    min_delta_ns was fixed with the previous updates of the clock events
    code, but we had no information about the spread of this problem. I
    added a WARN_ON to get automated information via kerneloops.org and to
    get some direct reports, which allowed me to analyse the affected
    machines.
    
    The WARN_ON has served its purpose and would be annoying for a release
    kernel. Remove it and just keep the information about the increase of
    the min_delta_ns value.
    
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

commit 48902025af4da44dbbc0231061e542d6d40e712e
Author: Alex Chiang <achiang@hp.com>
Date:   Fri Sep 5 14:05:03 2008 -0700

    PCI Hotplug: fakephp: fix deadlock... again
    
    Commit fe99740cac117f208707488c03f3789cf4904957 (construct one
    fakephp slot per PCI slot) introduced a regression, causing a
    deadlock when removing a PCI device.
    
    We also never actually removed the device from the PCI core.
    
    So we:
    
    	- remove the device from the PCI core
    	- do not directly call remove_slot() to prevent deadlock
    
    Yu Zhao reported and diagnosed this defect.
    
    Signed-off-by: Alex Chiang <achiang@hp.com>
    Acked-by: Yu Zhao <yu.zhao@intel.com>
    Cc: Matthew Wilcox <matthew@wil.cx>
    Cc: Kristen Carlson Accardi <kristen.c.accardi@intel.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>

commit 53bc88701be91e7f631ad31418b32392aa952e9b
Author: Johann Felix Soden <johfel@users.sourceforge.net>
Date:   Fri Aug 22 20:25:10 2008 +0200

    PCI: Fix printk warnings in setup-bus.c
    
    Again, the cleaned up code introduced some resource warnings:
    drivers/pci/setup-bus.c: In function 'pci_bus_dump_res':
    drivers/pci/setup-bus.c:542: warning: format '%llx' expects type 'long long unsigned int', but argument 5 has type 'resource_size_t'
    drivers/pci/setup-bus.c:542: warning: format '%llx' expects type 'long long unsigned int', but argument 6 has type 'resource_size_t'
    
    Fix those up too.
    
    Signed-off-by: Johann Felix Soden <johfel@users.sourceforge.net>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>

commit 4ca8a7726fb0e8094fdb56f2ae2d69fcf9254eae
Author: Johann Felix Soden <johfel@users.sourceforge.net>
Date:   Fri Aug 22 20:46:59 2008 +0200

    PCI: Fix printk warnings in probe.c
    
    The cleaned up resource code in probe.c introduced some warnings:
    drivers/pci/probe.c: In function 'pci_read_bridge_bases':
    drivers/pci/probe.c:386: warning: format '%llx' expects type 'long long unsigned int', but argument 3 has type 'resource_size_t'
    drivers/pci/probe.c:386: warning: format '%llx' expects type 'long long unsigned int', but argument 4 has type 'resource_size_t'
    drivers/pci/probe.c:398: warning: format '%llx' expects type 'long long unsigned int', but argument 3 has type 'resource_size_t'
    drivers/pci/probe.c:398: warning: format '%llx' expects type 'long long unsigned int', but argument 4 has type 'resource_size_t'
    drivers/pci/probe.c:434: warning: format '%llx' expects type 'long long unsigned int', but argument 4 has type 'resource_size_t'
    drivers/pci/probe.c:434: warning: format '%llx' expects type 'long long unsigned int', but argument 5 has type 'resource_size_t'
    
    So fix them up.
    
    Signed-off-by: Johann Felix Soden <johfel@users.sourceforge.net>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>

commit cbda1ba898647aeb4ee770b803c922f595e97731
Author: David Woodhouse <dwmw2@infradead.org>
Date:   Sun Sep 7 16:35:26 2008 +0100

    PCI/iommu: blacklist DMAR on Intel G31/G33 chipsets
    
    Some BIOSes (the Intel DG33BU, for example) wrongly claim to have DMAR
    when they don't. Avoid the resulting crashes when it doesn't work as
    expected.
    
    Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
    Acked-by: Ingo Molnar <mingo@elte.hu>
    Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>

commit 5c89468c12899b84886cb47eec93f0c88e0f896a
Author: Christoph Hellwig <hch@lst.de>
Date:   Mon Sep 8 19:44:17 2008 +0200

    udf: add llseek method
    
    UDF currently doesn't set a llseek method for regular files, which
    means it will fall back to default_llseek.  This means no one can seek
    beyond 2 Gigabytes on udf, and that there's not protection vs
    the i_size updates from writers.
    
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Jan Kara <jack@suse.cz>

commit c9257433f2eaf8803a1f3d3be5d984232db41ffe
Author: Vladimir Sokolovsky <vlad@mellanox.co.il>
Date:   Tue Sep 2 13:38:29 2008 -0700

    mlx4_core: Set RAE and init mtt_sz field in FRMR MPT entries
    
    Set the RAE (remote access enable) bit and correctly initialize the
    MTT size in MPT entries being set up for fast register memory
    regions.  Otherwise the callers can't enable remote access and in fact
    can't fast register at all (since the HCA will think no MTT entries
    are allocated).
    
    Signed-off-by: Vladimir Sokolovsky <vlad@mellanox.co.il>
    Signed-off-by: Roland Dreier <rolandd@cisco.com>

commit 9fbe604456c5ae21768f1c98379e1b81c72adcd3
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Mon Jul 28 21:26:01 2008 +0200

    imx serial: fix rts handling for non imx1 based hardware
    
    The interrupt handler for muxed interrupts (imx2/imx3) was calling
    the rts handling subroutine if the RTSS bit was set.
    (Which indicates the status of the RTS line), leading to an
    interrupt flood on RTS bit low.
    
    This patch fixes the problem by looking at the RTSD bit instead,
    indicating a change in the RTS line.
    
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

commit 4411805b13d4b8c31870b276c2730d585b062db7
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Mon Jul 28 12:10:34 2008 +0200

    imx serial: set RXD mux bit on i.MX27 and i.MX31
    
    RX in i.MX27 and i.MX31 UART lines does not work unless the
    "RXD  Muxed Input Select" bit is set on i.MX27 and i.MX31 processors.
    
    This patch sets the missing RXD mux bit in the UCR3 register.
    
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

commit c45e7d7be891fe94e13d0e7aeee3e0e4ee7118f4
Author: Darius Augulis <augulis.darius@gmail.com>
Date:   Tue Sep 2 10:19:29 2008 +0200

    i.MX serial: fix init failure
    
    Adds extra "out" label to probe function after calling .init form platform data.
    Because .init can return error number caused by gpio request fail.
    
    Signed-off-by: Darius Augulis <augulis.darius@gmail.com>
    Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

commit a9b0623357d2faa49a0f862154ba36c42c4bad2b
Author: Sascha Hauer <s.hauer@pengutronix.de>
Date:   Tue Sep 2 10:19:29 2008 +0200

    pcm037: add rts/cts support for serial port
    
    We have rts/cts pins on the first serial port on the pcm037. Enable it.
    
    Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

commit 01b291bd66564b4bd826326af6bd0b6d17e99439
Author: James Bottomley <James.Bottomley@HansenPartnership.com>
Date:   Thu Aug 21 15:14:14 2008 -0500

    [SCSI] fix check of PQ and PDT bits for WLUNs
    
    For IBM z series certain LUNs can no longer be accessed.
    
    This is because kernel version 2.6.19 a check was introduced not to
    create a generic SCSI device for devices that return PQ=1 and
    PDT=0x1f. For WLUNs (see SAM-3, p. 41ff) generic SCSI devices should
    be created unconditionally without looking at the PQ bit, so add a
    check for WLUNs in with this test.
    
    Acked-by: Martin Petermann <martin@linux.vnet.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit bb0003c1e189d5766b6b39299b08c690c985c4dc
Author: Mike Anderson <andmike@linux.vnet.ibm.com>
Date:   Tue Aug 12 12:11:58 2008 -0700

    [SCSI] make scsi_check_sense HARDWARE_ERROR return ADD_TO_MLQUEUE on retry
    
    Change scsi_check_sense HARDWARE_ERROR check to return ADD_TO_MLQUEUE
    if device->retry_hwerror is set to allow retries to occur without
    restriction of blk_noretry_request check.
    
    Signed-off-by: Mike Anderson <andmike@linux.vnet.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit c7dbb627a2505f42b2e6b3581f3716d73453dd0c
Author: Mike Anderson <andmike@linux.vnet.ibm.com>
Date:   Tue Aug 12 12:11:57 2008 -0700

    [SCSI] scsi_dh: make check_sense return ADD_TO_MLQUEUE
    
    Change scsi_dh check_sense functions to return ADD_TO_MLQUEUE
    to allow retries to occur without restriction of blk_noretry_request
    check.
    
    Signed-off-by: Mike Anderson <andmike@linux.vnet.ibm.com>
    Acked-by: Chandra Seetharaman <sekharan@us.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 025270f0eaa2def673747ed6f77cca41f694f354
Author: Hirofumi Nakagawa <hnakagawa@miraclelinux.com>
Date:   Thu Aug 21 13:43:37 2008 +0200

    [SCSI] zfcp: Remove duplicated unlikely() macros.
    
    Some drivers have duplicated unlikely() macros. IS_ERR() already
    has unlikely() in itself. This patch cleans up such pointless
    codes although there is no real effect on the kernel's behaviour.
    
    Signed-off-by: Hirofumi Nakagawa <hnakagawa@miraclelinux.com>
    Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 6139308dca9437975125290698cb9306240f525c
Author: Swen Schillig <swen@vnet.ibm.com>
Date:   Thu Aug 21 13:43:36 2008 +0200

    [SCSI] zfcp: channel cannot be detached due to refcount imbalance
    
    Due to an imbalance of the nameserver refcounting, channel devices
    couldn't be take offline anymore after the channel was activated.
    
    Signed-off-by: Swen Schillig <swen@vnet.ibm.com>
    Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 9528539cc2d506aa232b0d93881ac4d19738752f
Author: Swen Schillig <swen@vnet.ibm.com>
Date:   Thu Aug 21 13:43:35 2008 +0200

    [SCSI] zfcp: Fix reference counter for remote ports
    
    Fix the remote port reference counter handling during ELS ADISC
    commands and find the remote port by WWPN not by D_IDs that could
    change.
    
    Signed-off-by: Swen Schillig <swen@vnet.ibm.com>
    Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit f48bf7fb00f74d93105ba69522a3f6c9435d6af3
Author: Christof Schmitt <christof.schmitt@de.ibm.com>
Date:   Thu Aug 21 13:43:34 2008 +0200

    [SCSI] zfcp: Simplify ccw notify handler
    
    The notify handler does not change the list of adapters, it only
    triggers erp actions to open or shutdown the adapter. We don't
    need to hold the config semaphore and wait for the erp to complete.
    
    This is a prerequisite for a fix in the s390 common i/o code.
    
    Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
    Signed-off-by: Martin Petermann <martin@linux.vnet.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 47f7bba52b01dd881fbd17b4b50c89ecf186eee2
Author: Christof Schmitt <christof.schmitt@de.ibm.com>
Date:   Thu Aug 21 13:43:33 2008 +0200

    [SCSI] zfcp: Correctly query end flag in gpn_ft response
    
    When the last port entry in the gpn_ft response is already a known
    port, the eval function would skip the end flag and try to attach
    ports with wwpn 0. Fix this by checking the flag first.
    
    Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
    Signed-off-by: Martin Petermann <martin@linux.vnet.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit d4538817287e56abc938900886301a5bdfafbfcd
Author: Christof Schmitt <christof.schmitt@de.ibm.com>
Date:   Thu Aug 21 13:43:32 2008 +0200

    [SCSI] zfcp: Fix request queue locking
    
    The request queue lock can be acquired from softirq context when the
    SCSI midlayer issues commands. Disable softirqs for this lock when
    commands are issued from zfcp.
    
    Signed-off-by: Christof Schmitt <christof.schmitt@de.ibm.com>
    Signed-off-by: Martin Petermann <martin@linux.vnet.ibm.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit bfad9ceac5d11318c99ae8a0d1e926a380a56edd
Author: Stefan Richter <stefanr@s5r6.in-berlin.de>
Date:   Sat Aug 2 19:49:40 2008 +0200

    [SCSI] sd: select CRC_T10DIF only when necessary
    
    Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
    Acked-by: "Martin K. Petersen" <martin.petersen@oracle.com>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>

commit 97e1cfb08616987878f91a46cefdd7fc5fa3dba1
Author: Jan Kara <jack@suse.cz>
Date:   Mon Aug 18 13:44:48 2008 +0200

    udf: Fix error paths in udf_new_inode()
    
    I case we failed to allocate memory for inode when creating it, we did not
    properly free block already allocated for this inode. Move memory allocation
    before the block allocation which fixes this issue (thanks for the idea go to
    Ingo Oeser <ioe-lkml@rameria.de>). Also remove a few superfluous
    initializations already done in udf_alloc_inode().
    
    Reviewed-by: Ingo Oeser <ioe-lkml@rameria.de>
    Signed-off-by: Jan Kara <jack@suse.cz>

commit db0badc58e948b810c7a75cfcc48845e2949ee37
Author: Jan Kara <jack@suse.cz>
Date:   Mon Aug 18 13:40:18 2008 +0200

    udf: Fix lock inversion between iprune_mutex and alloc_mutex (v2)
    
    A memory allocation inside alloc_mutex must not recurse back into the
    filesystem itself because that leads to lock inversion between iprune_mutex and
    alloc_mutex (and thus to deadlocks - see traces below). alloc_mutex is actually
    needed only to update allocation statistics in the superblock so we can drop it
    before we start allocating memory for the inode.
    
    tar           D ffff81015b9c8c90     0  6614   6612
     ffff8100d5a21a20 0000000000000086 0000000000000000 00000000ffff0000
     ffff81015b9c8c90 ffff81015b8f0cd0 ffff81015b9c8ee0 0000000000000000
     0000000000000003 0000000000000000 0000000000000000 0000000000000000
    Call Trace:
     [<ffffffff803c1d8a>] __mutex_lock_slowpath+0x64/0x9b
     [<ffffffff803c1bef>] mutex_lock+0xa/0xb
     [<ffffffff8027f8c2>] shrink_icache_memory+0x38/0x200
     [<ffffffff80257742>] shrink_slab+0xe3/0x15b
     [<ffffffff802579db>] try_to_free_pages+0x221/0x30d
     [<ffffffff8025657e>] isolate_pages_global+0x0/0x31
     [<ffffffff8025324b>] __alloc_pages_internal+0x252/0x3ab
     [<ffffffff8026b08b>] cache_alloc_refill+0x22e/0x47b
     [<ffffffff8026ae37>] kmem_cache_alloc+0x3b/0x61
     [<ffffffff8026b15b>] cache_alloc_refill+0x2fe/0x47b
     [<ffffffff8026b34e>] __kmalloc+0x76/0x9c
     [<ffffffffa00751f2>] :udf:udf_new_inode+0x202/0x2e2
     [<ffffffffa007ae5e>] :udf:udf_create+0x2f/0x16d
     [<ffffffffa0078f27>] :udf:udf_lookup+0xa6/0xad
    ...
    kswapd0       D ffff81015b9d9270     0   125      2
     ffff81015b903c28 0000000000000046 ffffffff8028cbb0 00000000fffffffb
     ffff81015b9d9270 ffff81015b8f0cd0 ffff81015b9d94c0 000000000271b490
     ffffe2000271b458 ffffe2000271b420 ffffe20002728dc8 ffffe20002728d90
    Call Trace:
     [<ffffffff8028cbb0>] __set_page_dirty+0xeb/0xf5
     [<ffffffff8025403a>] get_dirty_limits+0x1d/0x22f
     [<ffffffff803c1d8a>] __mutex_lock_slowpath+0x64/0x9b
     [<ffffffff803c1bef>] mutex_lock+0xa/0xb
     [<ffffffffa0073f58>] :udf:udf_bitmap_free_blocks+0x47/0x1eb
     [<ffffffffa007df31>] :udf:udf_discard_prealloc+0xc6/0x172
     [<ffffffffa007875a>] :udf:udf_clear_inode+0x1e/0x48
     [<ffffffff8027f121>] clear_inode+0x6d/0xc4
     [<ffffffff8027f7f2>] dispose_list+0x56/0xee
     [<ffffffff8027fa5a>] shrink_icache_memory+0x1d0/0x200
     [<ffffffff80257742>] shrink_slab+0xe3/0x15b
     [<ffffffff80257e93>] kswapd+0x346/0x447
    ...
    
    Reported-by: Tibor Tajti <tibor.tajti@gmail.com>
    Reviewed-by: Ingo Oeser <ioe-lkml@rameria.de>
    Signed-off-by: Jan Kara <jack@suse.cz>