[cr][git]linux-cr branch, ckpt-v18-rc1, created. v2.6.31-80-g9b540da

orenl at cs.columbia.edu orenl at cs.columbia.edu
Wed Sep 16 11:36:24 PDT 2009


This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "linux-cr".

The branch, ckpt-v18-rc1 has been created
        at  9b540da2481953d874f013ad63638b72eda01ff7 (commit)

- Log -----------------------------------------------------------------
commit 9b540da2481953d874f013ad63638b72eda01ff7
Author: Nathan Lynch <ntl at pobox.com>
Date:   Wed Sep 16 14:15:41 2009 -0400

    powerpc: clone_with_pids implementation
    
    Mostly copy-paste from existing clone code.
    
    (may want to hold off applying this until the ongoing clone_with_pids
    discussion is resolved.)
    
    Signed-off-by: Nathan Lynch <ntl at pobox.com>

commit 7259afee03fe014f061e23adcb622d335f57354b
Author: Nathan Lynch <ntl at pobox.com>
Date:   Wed Sep 16 14:14:43 2009 -0400

    powerpc: enable checkpoint support in Kconfig
    
    Signed-off-by: Nathan Lynch <ntl at pobox.com>

commit a034cb38f3711ab2fa2d5d719740fa7cebbf0497
Author: Nathan Lynch <ntl at pobox.com>
Date:   Wed Sep 16 14:13:53 2009 -0400

    powerpc: wire up checkpoint and restart syscalls
    
    Signed-off-by: Nathan Lynch <ntl at pobox.com>

commit 24a17012b9c4482635cfc40a799f92a47247f09e
Author: Nathan Lynch <ntl at pobox.com>
Date:   Wed Sep 16 14:06:50 2009 -0400

    powerpc: checkpoint/restart implementation
    
    Support for checkpointing and restarting GPRs, FPU state, DABR, and
    Altivec state.
    
    The portion of the checkpoint image manipulated by this code begins
    with a bitmask of features indicating the various contexts saved.
    Fields in image that can vary depending on kernel configuration
    (e.g. FP regs due to VSX) have their sizes explicitly recorded, except
    for GPRS, so migrating between ppc32 and ppc64 won't work yet.
    
    The restart code ensures that the task is not modified until the
    checkpoint image is validated against the current kernel configuration
    and hardware features (e.g. can't restart a task using Altivec on
    non-Altivec systems).
    
    What works:
    * self and external checkpoint of simple (single thread, one open
      file) 32- and 64-bit processes on a ppc64 kernel
    
    What doesn't work:
    * restarting a 32-bit task from a 64-bit task and vice versa
    
    Untested:
    * ppc32 (but it builds)
    
    Signed-off-by: Nathan Lynch <ntl at pobox.com>
    [Oren Laadan <orenl at cs.columbia.edu>] Add arch-specific tty support

commit cac1fe8082a711cf59574cebb97739f0853a2396
Author: Nathan Lynch <ntl at pobox.com>
Date:   Wed Sep 16 14:06:34 2009 -0400

    powerpc: provide APIs for validating and updating DABR
    
    A checkpointed task image may specify a value for the DABR (Data
    Access Breakpoint Register).  The restart code needs to validate this
    value before making any changes to the current task.
    
    ptrace_set_debugreg encapsulates the bounds checking and platform
    dependencies of programming the DABR.  Split this into "validate"
    (debugreg_valid) and "update" (debugreg_update) functions, and make
    them available for use outside of the ptrace code.
    
    Also ptrace_set_debugreg has extern linkage, but no users outside of
    ptrace.c.  Make it static.
    
    Signed-off-by: Nathan Lynch <ntl at pobox.com>

commit 43aabe591a18f477a1acbde1ce35e70d55ecc4fa
Author: Nathan Lynch <ntl at pobox.com>
Date:   Wed Sep 16 14:06:09 2009 -0400

    powerpc: reserve checkpoint arch identifiers
    
    Signed-off-by: Nathan Lynch <ntl at pobox.com>

commit 1cbeacd1ee5ffb294c33b387868f9429d6c497b1
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 14:03:33 2009 -0400

    c/r: support for controlling terminal and job control
    
    Add checkpoint/restart of controlling terminal: current->signal->tty.
    This is only done for session leaders.
    
    If the session leader belongs to the ancestor pid-ns, then checkpoint
    skips this tty; On restart, it will not be restored, and whatever tty
    is in place from parent pid-ns (at restart) will be inherited.
    
    Chagnelog [v1]:
      - Don't restore tty_old_pgrp it pgid is CKPT_PID_NULL
      - Initialize pgrp to NULL in restore_signal
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit cb6da48eb551e53636dc94d4544816e2e6b48a5a
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 14:03:33 2009 -0400

    c/r: correctly restore pgid
    
    The main challenge with restoring the pgid of tasks is that the
    original "owner" (the process with that pid) might have exited
    already. I call these "ghost" pgids. 'mktree' does create these
    processes, but they then exit without participating in the restart.
    
    To solve this, this patch introduces a RESTART_GHOST flag, used for
    "ghost" owners that are created only to pass their pgid to other
    tasks. ('mktree' now makes them call restart(2) instead of exiting).
    
    When a "ghost" task calls restart(2), it will be placed on a wait
    queue until the restart completes and then exit. This guarantees that
    the pgid that it owns remains available for all (regular) restarting
    tasks for when they need it.
    
    Regular tasks perform the restart as before, except that they also
    now restore their old pgrp, which is guaranteed to exist.
    
    Changelog [v2]:
      - Call change_pid() only if new pgrp differs from current one
    Changelog [v1]:
      - Verify that pgid owner is a thread-group-leader.
      - Handle the case of pgid/sid == 0 using root's parent pid-ns
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 06a18852ef703dd9b66445207a7c9450fb8b2c3f
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 14:03:33 2009 -0400

    c/r: [pty 2/2] support for pseudo terminals
    
    This patch adds support for checkpoint and restart of pseudo terminals
    (PTYs). Since PTYs are shared (pointed to by file, and signal), they
    are managed via objhash.
    
    PTYs are master/slave pairs; The code arranges for the master to
    always be checkpointed first, followed by the slave. This is important
    since during restart both ends are created when restoring the master.
    
    In this patch only UNIX98 style PTYs are supported.
    
    Currently only PTYs that are referenced by open files are handled.
    Thus PTYs checkpoint starts with a file in tty_file_checkpoint(). It
    will first checkpoint the master and slave PTYs via tty_checkpoint(),
    and then complete the saving of the file descriptor. This means that
    in the image file, the order of objects is: master-tty, slave-tty,
    file-desc.
    
    During restart, to restore the master side, we open the /dev/ptmx
    device and get a file handle. But at this point we don't know the
    designated objref for this file, because the file is due later on in
    the image stream. On the other hand, we can't just fput() the file
    because it will close the PTY too.
    
    Instead, when we checkpoint the master PTY, we _reserve_ an objref
    for the file (which won't be further used in checkpoint). Then at
    restart, use it to insert the file to objhash.
    
    TODO:
    
    * Better sanitize input from checkpoint image on restore
    * Check the locking when saving/restoring tty_struct state
    * Echo position/buffer isn't saved (is it needed ?)
    * Handle multiple devpts mounts (namespaces)
    * Paths of ptmx and slaves are hard coded (/dev/ptmx, /dev/pts/...)
    
    Changelog[v2]:
      - Don't save/restore tty->{session,pgrp}
      - Fix leak: drop file reference after ckpt_obj_insert()
      - Move get_file() inside locked clause (fix race)
    Changelog[v1]:
      - Adjust include/asm/checkpoint_hdr.h for s390 architecture
      - Add NCC to kernel constants header (ckpt_hdr_const)
      - [Serge Hallyn] fix calculation of canon_datalen
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 9f75fac6b2e131d3ac143f17bb8fad42cd8b47f2
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 14:03:32 2009 -0400

    c/r: [pty 1/2] allow allocation of desired pty slave
    
    During restart, we need to allocate pty slaves with the same
    identifiers as recorded during checkpoint. Modify the allocation code
    to allow an in-kernel caller to request a specific slave identifier.
    
    For this, add a new field to task_struct - 'required_id'. It will
    hold the desired identifier when restoring a (master) pty.
    
    The code in ptmx_open() will use this value only for tasks that try to
    open /dev/ptmx that are restarting (PF_RESTARTING), and if the value
    isn't CKPT_REQUIRED_NONE (-1).
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit a4c2d033dde8c7abe5cf2f16acc861a207bd24fd
Author: Dan Smith <danms at us.ibm.com>
Date:   Wed Sep 16 14:03:27 2009 -0400

    c/r: Add AF_UNIX support (v10)
    
    This patch adds basic checkpoint/restart support for AF_UNIX sockets.  It
    has been tested with a single and multiple processes, and with data inflight
    at the time of checkpoint.  It supports socketpair()s, path-based, and
    abstract sockets.
    
    Changes in v11:
      - Create a struct socket for orphan socket during checkpoint
      - Make sockets proper objhash objects and use checkpoint_obj() on them
      - Rename headerless struct ckpt_hdr_* to struct ckpt_*
      - Remove struct timeval from socket header
      - Save and restore UNIX socket peer credentials
      - Set socket flags on restore using sock_setsockopt() where possible
      - Fail on the TIMESTAMPING_* flags for the moment (with a TODO)
      - Remove other explicit flag checks that are no longer copied blindly
      - Changed functions/variables names to follow existing conventions
      - Use proto_ops->{checkpoint,restart} methods for af_unix
      - Cleanup sock_file_restore()/sock_file_checkpoint()
      - Make ckpt_hdr_socket be part of ckpt_hdr_file_socket
      - Fold do_sock_file_checkpoint() into sock_file_checkpoint()
      - Fold do_sock_file_restore() into sock_file_restore()
      - Move sock_file_{checkpoint,restore} to net/checkpoint.c
      - Properly define sock_file_{checkpoint,restore} in header file
      - sock_file_restore() now calls restore_file_common()
    
    Changes in v10:
      - Moved header structure definitions back to checkpoint_hdr.h
      - Moved AF_UNIX checkpoint/restart code to net/unix/checkpoint.c
      - Make sock_unix_*() functions only compile if CONFIG_UNIX=y
      - Add TODO for CONFIG_UNIX=m case
    
    Changes in v9:
      - Fix double-free of skb's in the list and target holding queue in the
        error path of sock_copy_buffers()
      - Adjust use of ckpt_read_string() to match new signature
    
    Changes in v8:
      - Fix stale dev_alloc_skb() from before the conversion to skb_clone()
      - Fix a couple of broken error paths
      - Fix memory leak of kvec.iov_base on successful return from sendmsg()
      - Fix condition for deciding when to run sock_cptrst_verify()
      - Fix buffer queue copy algorithm to hold the lock during walk(s)
      - Log the errno when either getname() or getpeer() fails
      - Add comments about ancillary messages in the UNIX queue
      - Add TODO comments for credential restore and flags via setsockopt()
      - Add TODO comment about strangely-connected dgram sockets and the use
        of sendmsg(peer)
    
    Changes in v7:
      - Fix failure to free iov_base in error path of sock_read_buffer()
      - Change sock_read_buffer() to use _ckpt_read_obj_type() to get the
        header length and then use ckpt_kread() directly to read the payload
      - Change sock_read_buffers() to sock_unix_read_buffers() and break out
        some common functionality to better accommodate the subsequent INET
        patch
      - Generalize sock_unix_getnames() into sock_getnames() so INET can use it
      - Change skb_morph() to skb_clone() which uses the more common path and
        still avoids the copy
      - Add check to validate the socket type before creating socket
        on restore
      - Comment the CAP_NET_ADMIN override in sock_read_buffer_hdr
      - Strengthen the comment about priming the buffer limits
      - Change the objhash functions to deny direct checkpoint of sockets and
        remove the reference counting function
      - Change SOCKET_BUFFERS to SOCKET_QUEUE
      - Change this,peer objrefs to signed integers
      - Remove names from internal socket structures
      - Fix handling of sock_copy_buffers() result
      - Use ckpt_fill_fname() instead of d_path() for writing CWD
      - Use sock_getname() and sock_getpeer() for proper security hookage
      - Return -ENOSYS for unsupported socket families in checkpoint and restart
      - Use sock_setsockopt() and sock_getsockopt() where possible to save and
        restore socket option values
      - Check for SOCK_DESTROY flag in the global verify function because none
        of our supported socket types use it
      - Check for SOCK_USE_WRITE_QUEUE in AF_UNIX restore function because
        that flag should not be used on such a socket
      - Check socket state in UNIX restart path to validate the subset of valid
        values
    
    Changes in v6:
      - Moved the socket addresses to the per-type header
      - Eliminated the HASCWD flag
      - Remove use of ckpt_write_err() in restart paths
      - Change the order in which buffers are read so that we can set the
        socket's limit equal to the size of the image's buffers (if appropriate)
        and then restore the original values afterwards.
      - Use the ckpt_validate_errno() helper
      - Add a check to make sure that we didn't restore a (UNIX) socket with
        any skb's in the send buffer
      - Fix up sock_unix_join() to not leave addr uninitialized for socketpair
      - Remove inclusion of checkpoint_hdr.h in the socket files
      - Make sock_unix_write_cwd() use ckpt_write_string() and use the new
        ckpt_read_string() for reading the cwd
      - Use the restored realcred credentials in sock_unix_join()
      - Fix error path of the chdir_and_bind
      - Change the algorithm for reloading the socket buffers to use sendmsg()
        on the socket's peer for better accounting
      - For DGRAM sockets, check the backlog value against the system max
        to avoid letting a restart bypass the overloaded queue length
      - Use sock_bind() instead of sock->ops->bind() to gain the security hook
      - Change "restart" to "restore" in some of the function names
    
    Changes in v5:
      - Change laddr and raddr buffers in socket header to be long enough
        for INET6 addresses
      - Place socket.c and sock.h function definitions inside #ifdef
        CONFIG_CHECKPOINT
      - Add explicit check in sock_unix_makeaddr() to refuse if the
        checkpoint image specifies an addr length of 0
      - Split sock_unix_restart() into a few pieces to facilitate:
      - Changed behavior of the unix restore code so that unlinked LISTEN
        sockets don't do a bind()...unlink()
      - Save the base path of a bound socket's path so that we can chdir()
        to the base before bind() if it is a relative path
      - Call bind() for any socket that is not established but has a
        non-zero-length local address
      - Enforce the current sysctl limit on socket buffer size during restart
        unless the user holds CAP_NET_ADMIN
      - Unlink a path-based socket before calling bind()
    
    Changes in v4:
      - Changed the signdness of rcvlowat, rcvtimeo, sndtimeo, and backlog
        to match their struct sock definitions.  This should avoid issues
        with sign extension.
      - Add a sock_cptrst_verify() function to be run at restore time to
        validate several of the values in the checkpoint image against
        limits, flag masks, etc.
      - Write an error string with ctk_write_err() in the obscure cases
      - Don't write socket buffers for listen sockets
      - Sanity check address lengths before we agree to allocate memory
      - Check the result of inserting the peer object in the objhash on
        restart
      - Check return value of sock_cptrst() on restart
      - Change logic in remote getname() phase of checkpoint to not fail for
        closed (et al) sockets
      - Eliminate the memory copy while reading socket buffers on restart
    
    Changes in v3:
      - Move sock_file_checkpoint() above sock_file_restore()
      - Change __sock_file_*() functions to do_sock_file_*()
      - Adjust some of the struct cr_hdr_socket alignment
      - Improve the sock_copy_buffers() algorithm to avoid locking the source
        queue for the entire operation
      - Fix alignment in the socket header struct(s)
      - Move the per-protocol structure (ckpt_hdr_socket_un) out of the
        common socket header and read/write it separately
      - Fix missing call to sock_cptrst() in restore path
      - Break out the socket joining into another function
      - Fix failure to restore the socket address thus fixing getname()
      - Check the state values on restart
      - Fix case of state being TCP_CLOSE, which allows dgram sockets to be
        properly connected (if appropriate) to their peer and maintain the
        sockaddr for getname() operation
      - Fix restoring a listening socket that has been unlink()'d
      - Fix checkpointing sockets with an in-flight FD-passing SKB.  Fail
        with EBUSY.
      - Fix checkpointing listening sockets with an unaccepted connection.
        Fail with EBUSY.
      - Changed 'un' to 'unix' in function and structure names
    
    Changes in v2:
      - Change GFP_KERNEL to GFP_ATOMIC in sock_copy_buffers() (this seems
        to be rather common in other uses of skb_copy())
      - Move the ckpt_hdr_socket structure definition to linux/socket.h
      - Fix whitespace issue
      - Move sock_file_checkpoint() to net/socket.c for symmetry
    
    Cc: Alexey Dobriyan <adobriyan at gmail.com>
    Cc: netdev at vger.kernel.org
    Signed-off-by: Dan Smith <danms at us.ibm.com>
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit abc63753d1be8448be0ad10f4d1e3e2b3c9fa1f4
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:21 2009 -0400

    c/r: introduce checkpoint/restore methods to struct proto_ops
    
    This adds new 'proto_ops' function for checkpointing and restoring
    sockets. This allows the checkpoint/restart code to compile nicely
    when, e.g., AF_UNIX sockets are selected as a module.
    
    It also adds a function 'collecting' a socket for leak-detection
    during full-container checkpoint. This is useful for those sockets
    that hold references to other "collectable" objects. Two examples are
    AF_UNIX buffers which reference the socket of origin, and sockets that
    have file descriptors in-transit.
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit f8b4de0416a935571b40deec9f365a4072212601
Author: Dan Smith <danms at us.ibm.com>
Date:   Wed Sep 16 12:09:20 2009 -0400

    Add common socket helpers to unify the security hooks
    
    This moves the meat out of the bind(), getsockname(), and getpeername() syscalls
    into helper functions that performs security_socket_bind() and then the
    sock->ops->call().  This allows a unification of this behavior between the
    syscalls and the pending socket restart logic.
    
    Acked-by: Serge Hallyn <serue at us.ibm.com>
    Signed-off-by: Dan Smith <danms at us.ibm.com>
    Cc: netdev at vger.kernel.org

commit df973a504a1c46fa41a2a01dfb9db3ce793aac96
Author: Dan Smith <danms at us.ibm.com>
Date:   Wed Sep 16 12:09:20 2009 -0400

    Expose may_setuid() in user.h and add may_setgid() (v2)
    
    Make these helpers available to others.
    
    Changes in v2:
     - Avoid checking the groupinfo in ctx->realcred against the current in
       may_setgid()
    
    Cc: Serge Hallyn <serue at us.ibm.com>
    Signed-off-by: Dan Smith <danms at us.ibm.com>

commit 0e1b2862c4089c9b48079a2dc0b5b6f09e149c26
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:20 2009 -0400

    c/r: [signal 4/4] support for real/virt/prof itimers
    
    This patch adds support for real/virt/prof itimers.
    Expiry and the interval values are both saved in nanoseconds.
    
    Changelog[v1]:
      - [Louis Rilling] Fix saving of signal->it_real_incr if not expired
      - Fix restoring of signal->it_real_incr if expire is zero
      - Save virt/prof expire relative to process accumulated time
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit c0758bc1d7341583001d907841a736a3ef923731
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:19 2009 -0400

    c/r: [signal 3/4] pending signals (private, shared)
    
    This patch adds checkpoint and restart of pending signals queues:
    struct sigpending, both per-task t->sigpending and shared (per-
    thread-group) t->signal->shared_sigpending.
    
    To checkpoint pending signals (private/shared) we first detach the
    signal queue (and copy the mask) to a separate struct sigpending.
    This separate structure can be iterated through without locking.
    
    Once the state is saved, we re-attaches (prepends) the original signal
    queue back to the original struct sigpending.
    
    Signals that arrive(d) in the meantime will be suitably queued after
    these (for real-time signals). Repeated non-realtime signals will not
    be queued because they will already be marked in the pending mask,
    that remains as is. This is the expected behavior of non-realtime
    signals.
    
    Changelog [v4]:
      - Rename headerless struct ckpt_hdr_* to struct ckpt_*
    Changelog [v3]:
      - [Dan Smith] Sanity check for number of pending signals in buffer
    Changelog [v2]:
      - Validate si_errno from checkpoint image
    Changelog [v1]:
      - Fix compilation warnings
      - [Louis Rilling] Remove SIGQUEUE_PREALLOC flag from queued signals
      - [Louis Rilling] Fail if task has posix-timers or SI_TIMER signal
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 6a95fac593f9ed619f0773fcf187d7ac92345611
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:19 2009 -0400

    c/r: [signal 2/4] checkpoint/restart of rlimit
    
    This patch adds checkpoint and restart of rlimit information
    that is part of shared signal_struct.
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 50ab865385b07dd7cc4419466996c2d5a42e0672
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:19 2009 -0400

    c/r: [signal 1/4] blocked and template for shared signals
    
    This patch adds checkpoint/restart of blocked signals mask
    (t->blocked) and a template for shared signals (t->signal).
    
    Because t->signal sharing is tied to threads, we ensure proper sharing
    of t->signal (struct signal_struct) for threads only.
    
    Access to t->signal is protected by locking t->sighand->lock.
    Therefore, the usual checkpoint_obj() invoking the callback
    checkpoint_signal(ctx, signal) is insufficient because the task
    pointer is unavailable.
    
    Instead, handling of t->signal sharing is explicit using helpers
    like ckpt_obj_lookup_add(), ckpt_obj_fetch() and ckpt_obj_insert().
    The actual state is saved (if needed) _after_ the task_objs data.
    
    To prevent tasks from handling restored signals during restart,
    set their mask to block all signals and only restore the original
    mask at the very end (before the last sync point).
    
    Introduce per-task pointer 'ckpt_data' to temporary store data
    for restore actions that are deferred to the end (like restoring
    the signal block mask).
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit a5efaadfd2692d73c822b56ce55179f865295339
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:18 2009 -0400

    c/r: checkpoint and restore (shared) task's sighand_struct
    
    This patch adds the checkpointing and restart of signal handling
    state - 'struct sighand_struct'. Since the contents of this state
    only affect userspace, no input validation is required.
    
    Add _NSIG to kernel constants saved/tested with image header.
    
    Number of signals (_NSIG) is arch-dependent, but is within __KERNEL__
    and not visibile to userspace compile. Therefore, define per arch
    CKPT_ARCH_NSIG in <asm/checkpoint_hdr.h>.
    
    Changelog[v1]:
      - Rename headerless struct ckpt_hdr_* to struct ckpt_*
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 9c8305ef9955573776c85c11286b33c09504e50f
Author: Serge E. Hallyn <serue at us.ibm.com>
Date:   Wed Sep 16 12:09:18 2009 -0400

    c/r: restore file->f_cred
    
    Restore a file's f_cred.  This is set to the cred of the task doing
    the open, so often it will be the same as that of the restarted task.
    
    Changelog[v1]:
      - [Nathan Lynch] discard const from struct cred * where appropriate
    
    Signed-off-by: Serge E. Hallyn <serue at us.ibm.com>

commit ca41a44eb07c98139421ae995d5715a4796a444a
Author: Serge E. Hallyn <serue at us.ibm.com>
Date:   Wed Sep 16 12:09:18 2009 -0400

    c/r: checkpoint and restore task credentials
    
    This patch adds the checkpointing and restart of credentials
    (uids, gids, and capabilities) to Oren's c/r patchset (on top
    of v14).  It goes to great pains to re-use (and define when
    needed) common helpers, in order to make sure that as security
    code is modified, the cr code will be updated.  Some of the
    helpers should still be moved (i.e. _creds() functions should
    be in kernel/cred.c).
    
    When building the credentials for the restarted process, I
    1. create a new struct cred as a copy of the running task's
    cred (using prepare_cred())
    2. always authorize any changes to the new struct cred
    based on the permissions of current_cred() (not the current
    transient state of the new cred).
    
    While this may mean that certain transient_cred1->transient_cred2
    states are allowed which otherwise wouldn't be allowed, the
    fact remains that current_cred() is allowed to transition to
    transient_cred2.
    
    The reconstructed creds are applied to the task at the very
    end of the sys_restart call.  This ensures that any objects which
    need to be re-created (file, socket, etc) are re-created using
    the creds of the task calling sys_restart - preventing an unpriv
    user from creating a privileged object, and ensuring that a
    root task can restart a process which had started out privileged,
    created some privileged objects, then dropped its privilege.
    
    With these patches, the root user can restart checkpoint images
    (created by either hallyn or root) of user hallyn's tasks,
    resulting in a program owned by hallyn.
    
    Changelog:
    	Sep 08: [NTL] discard const from struct cred * where appropriate
    	Jun 15: Fix user_ns handling when !CONFIG_USER_N
    	        Set creator_ref=0 for root_ns (discard @flags)
    		Don't  overwrite global user-ns if CONFIG_USER_NS
    	Jun 10: Merge with ckpt-v16-dev (Oren Laadan)
    	Jun 01: Don't check ordering of groups in group_info, bc
    		set_groups() will sort it for us.
    	May 28: 1. Restore securebits
    		2. Address Alexey's comments: move prototypes out of
    		   sched.h, validate ngroups < NGROUPS_MAX, validate
    		   groups are sorted, and get rid of ckpt_hdr_cred->version.
    		3. remove bogus unused flag RESTORE_CREATE_USERNS
    	May 26: Move group, user, userns, creds c/r functions out
    		of checkpoint/process.c and into the appropriate files.
    	May 26: Define struct ckpt_hdr_task_creds and move task cred
    		objref c/r into {checkpoint_restore}_task_shared().
    	May 26: Take cred refs around checkpoint_write_creds()
    	May 20: Remove the limit on number of groups in groupinfo
    		at checkpoint time
    	May 20: Remove the depth limit on empty user namespaces
    	May 20: Better document checkpoint_user
    	May 18: fix more refcounting: if (userns 5, uid 0) had
    		no active tasks or child user_namespaces, then
    		it shouldn't exist at restart or it, its namespace,
    		and its whole chain of creators will be leaked.
    	May 14: fix some refcounting:
    		1. a new user_ns needs a ref to remain pinned
    		   by its root user
    		2. current_user_ns needs an extra ref bc objhash
    		   drops two on restart
    		3. cred needs a ref for the real credentials bc
    		   commit_creds eats one ref.
    	May 13: folded in fix to userns refcounting.
    
    Signed-off-by: Serge E. Hallyn <serue at us.ibm.com>
    [orenl at cs.columbia.edu: merge with ckpt-v16-dev]

commit c0921ad4a9cdf34d6b5f17ef4dab5c8116fce75c
Author: Serge E. Hallyn <serue at us.ibm.com>
Date:   Wed Sep 16 12:09:17 2009 -0400

    c/r: capabilities: define checkpoint and restore fns
    
    [ Andrew: I am punting on dealing with the subsystem cooperation
    issues in this version, in favor of trying to get LSM issues
    straightened out ]
    
    An application checkpoint image will store capability sets
    (and the bounding set) as __u64s.  Define checkpoint and
    restart functions to translate between those and kernel_cap_t's.
    
    Define a common function do_capset_tocred() which applies capability
    set changes to a passed-in struct cred.
    
    The restore function uses do_capset_tocred() to apply the restored
    capabilities to the struct cred being crafted, subject to the
    current task's (task executing sys_restart()) permissions.
    
    Changelog:
    	Jun 09: Can't choose securebits or drop bounding set if
    		file capabilities aren't compiled into the kernel.
    		Also just store caps in __u32s (looks cleaner).
    	Jun 01: Made the checkpoint and restore functions and the
    		ckpt_hdr_capabilities struct more opaque to the
    		rest of the c/r code, as suggested by Andrew Morgan,
    		and using naming suggested by Oren.
    	Jun 01: Add commented BUILD_BUG_ON() to point out that the
    		current implementation depends on 64-bit capabilities.
    		(Andrew Morgan and Alexey Dobriyan).
    	May 28: add helpers to c/r securebits
    
    Signed-off-by: Serge E. Hallyn <serue at us.ibm.com>

commit 7fcc8381195181c5383546a48a441f99688aab0c
Author: Serge E. Hallyn <serue at us.ibm.com>
Date:   Wed Sep 16 12:09:16 2009 -0400

    c/r: clone_with_pids: define the s390 syscall
    
    Hook up the clone_with_pids system call for s390x.  clone_with_pids()
    takes an additional argument over clone(), which we pass in through
    register 7.  Stub code for using the syscall looks like:
    
    struct target_pid_set {
            int num_pids;
            pid_t *target_pids;
            unsigned long flags;
    };
    
        register unsigned long int __r2 asm ("2") = (unsigned long int)(stack);
        register unsigned long int __r3 asm ("3") = (unsigned long int)(flags);
        register unsigned long int __r4 asm ("4") = (unsigned long int)(NULL);
        register unsigned long int __r5 asm ("5") = (unsigned long int)(NULL);
        register unsigned long int __r6 asm ("6") = (unsigned long int)(NULL);
        register unsigned long int __r7 asm ("7") = (unsigned long int)(setp);
        register unsigned long int __result asm ("2");
        __asm__ __volatile__(
                " lghi %%r1,332\n"
                " svc 0\n"
                : "=d" (__result)
                : "0" (__r2), "d" (__r3),
                  "d" (__r4), "d" (__r5), "d" (__r6), "d" (__r7)
                : "1", "cc", "memory"
        );
                __result;
        })
    
        struct target_pid_set pid_set;
        int pids[1] = { 19799 };
        pid_set.num_pids = 1;
        pid_set.target_pids = &pids[0];
        pid_set.flags = 0;
    
        rc = do_clone_with_pids(topstack, clone_flags, setp);
        if (rc == 0)
    	printf("Child\n");
        else if (rc > 0)
    	printf("Parent: child pid %d\n", rc);
        else
    	printf("Error %d\n", rc);
    
    Changelog[v18]:
      - Set return value for self-checkpoint
    
    Signed-off-by: Serge E. Hallyn <serue at us.ibm.com>

commit fd3a1df99fa52b983d46b8b771db209638a0507a
Author: Dan Smith <danms at us.ibm.com>
Date:   Wed Sep 16 12:09:16 2009 -0400

    c/r: define s390-specific checkpoint-restart code
    
    Implement the s390 arch-specific checkpoint/restart helpers.  This
    is on top of Oren Laadan's c/r code.
    
    With these, I am able to checkpoint and restart simple programs as per
    Oren's patch intro.  While on x86 I never had to freeze a single task
    to checkpoint it, on s390 I do need to.  That is a prereq for consistent
    snapshots (esp with multiple processes) anyway so I don't see that as
    a problem.
    
    Changelog:
        Jun 15:
                . Fix checkpoint and restart compat wrappers
        May 28:
                . Export asm/checkpoint_hdr.h to userspace
                . Define CKPT_ARCH_ID for S390
        Apr 11:
                . Introduce ckpt_arch_vdso()
        Feb 27:
                . Add checkpoint_s390.h
                . Fixed up save and restore of PSW, with the non-address bits
                  properly masked out
        Feb 25:
                . Make checkpoint_hdr.h safe for inclusion in userspace
                . Replace comment about vsdo code
                . Add comment about restoring access registers
                . Write and read an empty ckpt_hdr_head_arch record to appease
                  code (mktree) that expects it to be there
                . Utilize NUM_CKPT_WORDS in checkpoint_hdr.h
        Feb 24:
                . Use CKPT_COPY() to unify the un/loading of cpu and mm state
                . Fix fprs definition in ckpt_hdr_cpu
                . Remove debug WARN_ON() from checkpoint.c
        Feb 23:
                . Macro-ize the un/packing of trace flags
                . Fix the crash when externally-linked
                . Break out the restart functions into restart.c
                . Remove unneeded s390_enable_sie() call
        Jan 30:
                . Switched types in ckpt_hdr_cpu to __u64 etc.
                  (Per Oren suggestion)
                . Replaced direct inclusion of structs in
                  ckpt_hdr_cpu with the struct members.
                  (Per Oren suggestion)
                . Also ended up adding a bunch of new things
                  into restart (mm_segment, ksp, etc) in vain
                  attempt to get code using fpu to not segfault
                  after restart.
    
    Signed-off-by: Serge E. Hallyn <serue at us.ibm.com>
    Signed-off-by: Dan Smith <danms at us.ibm.com>

commit 33acb5303e51ccc1824993dd42ba337bb88d22f8
Author: Dan Smith <danms at us.ibm.com>
Date:   Wed Sep 16 12:09:15 2009 -0400

    c/r: add CKPT_COPY() macro
    
    As suggested by Dave[1], this provides us a way to make the copy-in and
    copy-out processes symmetric.  CKPT_COPY_ARRAY() provides us a way to do
    the same thing but for arrays.  It's not critical, but it helps us unify
    the checkpoint and restart paths for some things.
    
    Changelog:
        Mar 04:
                . Removed semicolons
                . Added build-time check for __must_be_array in CKPT_COPY_ARRAY
        Feb 27:
                . Changed CKPT_COPY() to use assignment, eliminating the need
                  for the CKPT_COPY_BIT() macro
                . Add CKPT_COPY_ARRAY() macro to help copying register arrays,
                  etc
                . Move the macro definitions inside the CR #ifdef
        Feb 25:
                . Changed WARN_ON() to BUILD_BUG_ON()
    
    Signed-off-by: Dan Smith <danms at us.ibm.com>
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>
    
    1: https://lists.linux-foundation.org/pipermail/containers/2009-February/015821.html (all the way at the bottom)

commit 356ca591c022531ecfda351324561d414b19ca58
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:15 2009 -0400

    c/r: (s390): expose a constant for the number of words (CRs)
    
    We need to use this value in the checkpoint/restart code and would like to
    have a constant instead of a magic '3'.
    
    Changelog:
        Mar 30:
                . Add CHECKPOINT_SUPPORT in Kconfig (Nathan Lynch)
        Mar 03:
                . Picked up additional use of magic '3' in ptrace.h
    
    Signed-off-by: Dan Smith <danms at us.ibm.com>

commit 39fa16d77c63ea065fb7bf71e7e7251453d35cdf
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:15 2009 -0400

    c/r: support semaphore sysv-ipc
    
    Checkpoint of sysvipc semaphores is performed by iterating through all
    sem objects and dumping the contents of each one. The semaphore array
    of each sem is dumped with that object.
    
    The semaphore array (sem->sem_base) holds an array of 'struct sem',
    which is a {int, int}. Because this translates into the same format
    on 32- and 64-bit architectures, the checkpoint format is simply the
    dump of this array as is.
    
    TODO: this patch does not handle semaphore-undo -- this data should be
    saved per-task while iterating through the tasks.
    
    Changelog[v18]:
      - Handle kmalloc failure in restore_sem_array()
    Changelog[v17]:
      - Restore objects in the right namespace
      - Forward declare struct msg_msg (instead of include linux/msg.h)
      - Fix typo in comment
      - Don't unlock ipc before calling freeary in error path
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 5dab755c02421f739092cc1f34a1f82202911c73
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:14 2009 -0400

    c/r: support message-queues sysv-ipc
    
    Checkpoint of sysvipc message-queues is performed by iterating through
    all 'msq' objects and dumping the contents of each one. The message
    queued on each 'msq' are dumped with that object.
    
    Message of a specific queue get written one by one. The queue lock
    cannot be held while dumping them, but the loop must be protected from
    someone (who ?) writing or reading. To do that we grab the lock, then
    hijack the entire chain of messages from the queue, drop the lock,
    and then safely dump them in a loop. Finally, with the lock held, we
    re-attach the chain while verifying that there isn't other (new) data
    on that queue.
    
    Writing the message contents themselves is straight forward. The code
    is similar to that in ipc/msgutil.c, the main difference being that
    we deal with kernel memory and not user memory.
    
    Changelog[v17]:
      - Allocate security context for msg_msg
      - Restore objects in the right namespace
      - Don't unlock ipc before freeing
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 98ecf71bbf4e855a37f108b8ed46e90e6ee16377
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:14 2009 -0400

    c/r: support share-memory sysv-ipc
    
    Checkpoint of sysvipc shared memory is performed in two steps: first,
    the entire ipc namespace is dumped as a whole by iterating through all
    shm objects and dumping the contents of each one. The shmem inode is
    registered in the objhash. Second, for each vma that refers to ipc
    shared memory we find the inode in the objhash, and save the objref.
    
    (If we find a new inode, that indicates that the ipc namespace is not
    entirely frozen and someone must have manipulated it since step 1).
    
    Handling of shm objects that have been deleted (via IPC_RMID) is left
    to a later patch in this series.
    
    Changelog[v18]:
      - Collect files used by shm objects
      - Use file instead of inode as shared object during checkpoint
    Changelog[v17]:
      - Restore objects in the right namespace
      - Properly initialize ctx->deferqueue
      - Fix compilation with CONFIG_CHECKPOINT=n
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 2b88e16c88c83067b6a738be1fa92932df3d6c2d
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:14 2009 -0400

    c/r: save and restore sysvipc namespace basics
    
    Add the helpers to checkpoint and restore the contents of 'struct
    kern_ipc_perm'. Add header structures for ipc state. Put place-holders
    to save and restore ipc state.
    
    Save and restores the common state (parameters) of ipc namespace.
    
    Generic code to iterate through the objects of sysvipc shared memory,
    message queues and semaphores. The logic to save and restore the state
    of these objects will be added in the next few patches.
    
    Right now, we return -EPERM if the user calling sys_restart() isn't
    allowed to create an object with the checkpointed uid.  We may prefer
    to simply use the caller's uid in that case - but that could lead to
    subtle userspace bugs?  Unsure, so going for the stricter behavior.
    
    TODO: restore kern_ipc_perms->security.
    
    Changelog[v17]:
      - Fix include: use checkpoint.h not checkpoint_hdr.h
      - Collect nsproxy->ipc_ns
      - Restore objects in the right namespace
      - If !CONFIG_IPC_NS only restore objects, not global settings
      - Don't overwrite global ipc-ns if !CONFIG_IPC_NS
      - Reset the checkpointed uid and gid info on ipc objects
      - Fix compilation with CONFIG_SYSVIPC=n
    Changelog [Dan Smith <danms at us.ibm.com>]
      - Fix compilation with CONFIG_SYSVIPC=n
      - Update to match UTS changes
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 40f30126e65005d4d8388330a3982d68084bd4e1
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:13 2009 -0400

    c/r (ipc): allow allocation of a desired ipc identifier
    
    During restart, we need to allocate ipc objects that with the same
    identifiers as recorded during checkpoint. Modify the allocation
    code allow an in-kernel caller to request a specific ipc identifier.
    The system call interface remains unchanged.
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 99cb683792abbbe82123702d6947381bf945c622
Author: Dan Smith <danms at us.ibm.com>
Date:   Wed Sep 16 12:09:13 2009 -0400

    c/r: support for UTS namespace
    
    This patch adds a "phase" of checkpoint that saves out information about any
    namespaces the task(s) may have.  Do this by tracking the namespace objects
    of the tasks and making sure that tasks with the same namespace that follow
    get properly referenced in the checkpoint stream.
    
    Changes[v17]:
      - Collect nsproxy->uts_ns
      - Save uts string lengths once in ckpt_hdr_const
      - Save and restore all fields of uts-ns
      - Don't overwrite global uts-ns if !CONFIG_UTS_NS
      - Replace sys_unshare() with create_uts_ns()
      - Take uts_sem around access to uts data
    Changes:
      - Remove the kernel restore path
      - Punt on nested namespaces
      - Use __NEW_UTS_LEN in nodename and domainname buffers
      - Add a note to Documentation/checkpoint/internals.txt to indicate where
        in the save/restore process the UTS information is kept
      - Store (and track) the objref of the namespace itself instead of the
        nsproxy (based on comments from Dave on IRC)
      - Remove explicit check for non-root nsproxy
      - Store the nodename and domainname lengths and use ckpt_write_string()
        to store the actual name strings
      - Catch failure of ckpt_obj_add_ptr() in ckpt_write_namespaces()
      - Remove "types" bitfield and use the "is this new" flag to determine
        whether or not we should write out a new ns descriptor
      - Replace kernel restore path
      - Move the namespace information to be directly after the task
        information record
      - Update Documentation to reflect new location of namespace info
      - Support checkpoint and restart of nested UTS namespaces
    
    Signed-off-by: Dan Smith <danms at us.ibm.com>
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 3d75b8a6f5a6cf6b468924838094c178dd3aaddb
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:12 2009 -0400

    c/r: make ckpt_may_checkpoint_task() check each namespace individually
    
    For a given namespace type, say XXX, if a checkpoint was taken on a
    CONFIG_XXX_NS system, is restarted on a !CONFIG_XXX_NS, then ensure
    that:
    
    1) The global settings of the global (init) namespace do not get
    overwritten. Creating new objects in that namespace is ok, as long as
    the request identifier is available.
    
    2) All restarting tasks use a single namespace - because it is
    impossible to create additional namespaces to accommodate for what had
    been checkpointed.
    
    Original patch introducing nsproxy c/r by Dan Smith <danms at us.ibm.com>
    
    Chagnelog[v18]:
      - Add a few more ckpt_write_err()s
    Chagnelog[v17]:
      - Only collect sub-objects of struct_nsproxy once.
      - Restore namespace pieces directly instead of using sys_unshare()
      - Proper handling of restart from namespace(s) without namespace(s)
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 6ceec3b3f292e154c5f709c4207db5ee24966834
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:11 2009 -0400

    c/r: checkpoint and restore FIFOs
    
    FIFOs are almost like pipes.
    
    Checkpoints adds the FIFO pathname. The first time the FIFO is found
    it also assigns an @objref and dumps the contents in the buffers.
    
    To restore, use the @objref only to determine whether a particular
    FIFO has already been restored earlier. Note that it ignores the file
    pointer that matches that @objref (unlike with pipes, where that file
    corresponds to the other end of the pipe). Instead, it creates a new
    FIFO using the saved pathname.
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit f282a267cf33f2a8e33d785eab6168eba1e70c75
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:11 2009 -0400

    c/r: support for open pipes
    
    A pipe is a double-headed inode with a buffer attached to it. We
    checkpoint the pipe buffer only once, as soon as we hit one side of
    the pipe, regardless whether it is read- or write- end.
    
    To checkpoint a file descriptor that refers to a pipe (either end), we
    first lookup the inode in the hash table: If not found, it is the
    first encounter of this pipe. Besides the file descriptor, we also (a)
    save the pipe data, and (b) register the pipe inode in the hash. If
    found, it is the second encounter of this pipe, namely, as we hit the
    other end of the same pipe. In both cases we write the pipe-objref of
    the inode.
    
    To restore, create a new pipe and thus have two file pointers (read-
    and write- ends). We only use one of them, depending on which side was
    checkpointed first. We register the file pointer of the other end in
    the hash table, with the pipe_objref given for this pipe from the
    checkpoint, to be used later when the other arrives. At this point we
    also restore the contents of the pipe buffers.
    
    To save the pipe buffer, given a source pipe, use do_tee() to clone
    its contents into a temporary 'struct pipe_inode_info', and then use
    do_splice_from() to transfer it directly to the checkpoint image file.
    
    To restore the pipe buffer, with a fresh newly allocated target pipe,
    use do_splice_to() to splice the data directly between the checkpoint
    image file and the pipe.
    
    Changelog[v18]:
      - Adjust format of pipe buffer to include the mandatory pre-header
    Changelog[v17]:
      - Forward-declare 'ckpt_ctx' et-al, don't use checkpoint_types.h
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit a46d2b502555ba9c8625bbe1cddf34cb641d27e9
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:10 2009 -0400

    splice: export pipe/file-to-pipe/file functionality
    
    During pipes c/r pipes we need to save and restore pipe buffers. But
    do_splice() requires two file descriptors, therefore we can't use it,
    as we always have one file descriptor (checkpoint image) and one
    pipe_inode_info.
    
    This patch exports interfaces that work at the pipe_inode_info level,
    namely link_pipe(), do_splice_to() and do_splice_from(). They are used
    in the following patch to to save and restore pipe buffers without
    unnecessary data copy.
    
    It slightly modifies both do_splice_to() and do_splice_from() to
    detect the case of pipe-to-pipe transfer, in which case they invoke
    splice_pipe_to_pipe() directly.
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit cc3ec47a7d8e8d36fd16d6c7276fbca6bc4b3e93
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:10 2009 -0400

    c/r: restore anonymous- and file-mapped- shared memory
    
    The bulk of the work is in ckpt_read_vma(), which has been refactored:
    the part that create the suitable 'struct file *' for the mapping is
    now larger and moved to a separate function. What's left is to read
    the VMA description, get the file pointer, create the mapping, and
    proceed to read the contents in.
    
    Both anonymous shared VMAs that have been read earlier (as indicated
    by a look up to objhash) and file-mapped shared VMAs are skipped.
    Anonymous shared VMAs seen for the first time have their contents
    read in directly to the backing inode, as indexed by the page numbers
    (as opposed to virtual addresses).
    
    Changelog[v14]:
      - Introduce patch
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit e7b30af5cad2e6ade07c7138a51772730ba8bee3
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:10 2009 -0400

    c/r: dump anonymous- and file-mapped- shared memory
    
    We now handle anonymous and file-mapped shared memory. Support for IPC
    shared memory requires support for IPC first. We extend ckpt_write_vma()
    to detect shared memory VMAs and handle it separately than private
    memory.
    
    There is not much to do for file-mapped shared memory, except to force
    msync() on the region to ensure that the file system is consistent
    with the checkpoint image. Use our internal type CKPT_VMA_SHM_FILE.
    
    Anonymous shared memory is always backed by inode in shmem filesystem.
    We use that inode to look up the VMA in the objhash and register it if
    not found (on first encounter). In this case, the type of the VMA is
    CKPT_VMA_SHM_ANON, and we dump the contents. On the other hand, if it is
    found there, we must have already saved it before, so we change the
    type to CKPT_VMA_SHM_ANON_SKIP and skip it.
    
    To dump the contents of a shmem VMA, we loop through the pages of the
    inode in the shmem filesystem, and dump the contents of each dirty
    (allocated) page - unallocated pages must be clean.
    
    Note that we save the original size of a shmem VMA because it may have
    been re-mapped partially. The format itself remains like with private
    VMAs, except that instead of addresses we record _indices_ (page nr)
    into the backing inode.
    
    Changelog[v18]:
      - Mark the backing file as visited at chekcpoint
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 74149aabdc0bd8b8d774b4cb6feb9a5bc5a476c5
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:09 2009 -0400

    c/r: export shmem_getpage() to support shared memory
    
    Export functionality to retrieve specific pages from shared memory
    given an inode in shmem-fs; this will be used in the next two patches
    to provide support for c/r of shared memory.
    
    mm/shmem.c:
    - shmem_getpage() and 'enum sgp_type' moved to linux/mm.h
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 497a784800cc2cce67d4749e7dcd758bfcb605ad
Author: Matt Helsley <matthltc at us.ibm.com>
Date:   Wed Sep 16 12:09:09 2009 -0400

    Add the checkpoint operation for opened files of generic filesystems
    
    These patches extend the use of the generic file checkpoint operation to
    non-extX filesystems which have lseek operations that ensure we can save
    and restore the files for later use. Note that this does not include
    things like FUSE, network filesystems, or pseudo-filesystem kernel
    interfaces.
    
    Only compile and boot tested (on x86-32).
    
    [Oren Laadan] Folded patch series into a single patch; original post
    included 36 separate patches for individual filesystems:
    
      [PATCH 01/36] Add the checkpoint operation for affs files and directories.
      [PATCH 02/36] Add the checkpoint operation for befs directories.
      [PATCH 03/36] Add the checkpoint operation for bfs files and directories.
      [PATCH 04/36] Add the checkpoint operation for btrfs files and directories.
      [PATCH 05/36] Add the checkpoint operation for cramfs directories.
      [PATCH 06/36] Add the checkpoint operation for ecryptfs files and directories.
      [PATCH 07/36] Add the checkpoint operation for fat files and directories.
      [PATCH 08/36] Add the checkpoint operation for freevxfs directories.
      [PATCH 09/36] Add the checkpoint operation for hfs files and directories.
      [PATCH 10/36] Add the checkpoint operation for hfsplus files and directories.
      [PATCH 11/36] Add the checkpoint operation for hpfs files and directories.
      [PATCH 12/36] Add the checkpoint operation for hppfs files and directories.
      [PATCH 13/36] Add the checkpoint operation for iso directories.
      [PATCH 14/36] Add the checkpoint operation for jffs2 files and directories.
      [PATCH 15/36] Add the checkpoint operation for jfs files and directories.
      [PATCH 16/36] Add the checkpoint operation for regular nfs files and directories. Skip the various /proc files for now.
      [PATCH 17/36] Add the checkpoint operation for ntfs directories.
      [PATCH 18/36] Add the checkpoint operation for openromfs directories. Explicitly skip the properties for now.
      [PATCH 19/36] Add the checkpoint operation for qnx4 files and directories.
      [PATCH 20/36] Add the checkpoint operation for reiserfs files and directories.
      [PATCH 21/36] Add the checkpoint operation for romfs directories.
      [PATCH 22/36] Add the checkpoint operation for squashfs directories.
      [PATCH 23/36] Add the checkpoint operation for sysv filesystem files and directories.
      [PATCH 24/36] Add the checkpoint operation for ubifs files and directories.
      [PATCH 25/36] Add the checkpoint operation for udf filesystem files and directories.
      [PATCH 26/36] Add the checkpoint operation for xfs files and directories.
      [PATCH 27/36] Add checkpoint operation for efs directories.
      [PATCH 28/36] Add the checkpoint operation for generic, read-only files. At present, some/all files of the following filesystems use this generic definition:
      [PATCH 29/36] Add checkpoint operation for minix filesystem files and directories.
      [PATCH 30/36] Add checkpoint operations for omfs files and directories.
      [PATCH 31/36] Add checkpoint operations for ufs files and directories.
      [PATCH 32/36] Add checkpoint operations for ramfs files. NOTE: since simple_dir_operations are shared between multiple filesystems including ramfs, it's not currently possible to checkpoint open ramfs directories.
      [PATCH 33/36] Add the checkpoint operation for adfs files and directories.
      [PATCH 34/36] Add the checkpoint operation to exofs files and directories.
      [PATCH 35/36] Add the checkpoint operation to nilfs2 files and directories.
      [PATCH 36/36] Add checkpoint operations for UML host filesystem files and directories.
    
    Signed-off-by: Matt Helsley <matthltc at us.ibm.com>
    Acked-by: Oren Laadan <orenl at cs.columbia.edu>
    Cc: linux-fsdevel at vger.kernel.org

commit 10594a13eaa5ac6bf10d0e8a8da5657d15767d81
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:08 2009 -0400

    c/r: add generic '->checkpoint()' f_op to simple devices
    
    * /dev/null
    * /dev/zero
    * /dev/random
    * /dev/urandom
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit bc0085a4828718336665a52ed7333622d5f7a269
Author: Dave Hansen <dave at linux.vnet.ibm.com>
Date:   Wed Sep 16 12:09:08 2009 -0400

    c/r: add generic '->checkpoint' f_op to ext fses
    
    This marks ext[234] as being checkpointable.  There will be many
    more to do this to, but this is a start.
    
    Changelog[v1]:
      - [Serge Hallyn] Use filemap_checkpoint() in ext4_file_vm_ops
    
    Signed-off-by: Dave Hansen <dave at linux.vnet.ibm.com>
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 28edbf8bb9211750cf5a8575d89fec6b721431ed
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:08 2009 -0400

    c/r: restore memory address space (private memory)
    
    Restoring the memory address space begins with nuking the existing one
    of the current process, and then reading the vma state and contents.
    Call do_mmap_pgoffset() for each vma and then read in the data.
    
    Changelog[v17]:
      - Restore mm->{flags,def_flags,saved_auxv}
      - Fix bogus warning in do_restore_mm()
    Changelog[v16]:
      - Restore mm->exe_file
    Changelog[v14]:
      - Introduce per vma-type restore() function
      - Merge restart code into same file as checkpoint (memory.c)
      - Compare saved 'vdso' field of mm_context with current value
      - Check whether calls to ckpt_hbuf_get() fail
      - Discard field 'h->parent'
      - Revert change to pr_debug(), back to ckpt_debug()
    Changelog[v13]:
      - Avoid access to hh->vma_type after the header is freed
      - Test for no vma's in exit_mmap() before calling unmap_vma() (or it
        may crash if restart fails after having removed all vma's)
    Changelog[v12]:
      - Replace obsolete ckpt_debug() with pr_debug()
    Changelog[v9]:
      - Introduce ckpt_ctx_checkpoint() for checkpoint-specific ctx setup
    Changelog[v7]:
      - Fix argument given to kunmap_atomic() in memory dump/restore
    Changelog[v6]:
      - Balance all calls to ckpt_hbuf_get() with matching ckpt_hbuf_put()
        (even though it's not really needed)
    Changelog[v5]:
      - Improve memory restore code (following Dave Hansen's comments)
      - Change dump format (and code) to allow chunks of <vaddrs, pages>
        instead of one long list of each
      - Memory restore now maps user pages explicitly to copy data into them,
        instead of reading directly to user space; got rid of mprotect_fixup()
    Changelog[v4]:
      - Use standard list_... for ckpt_pgarr
    
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 3f6813fb0d5ccdc1998e45e824194c0ceef99680
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:07 2009 -0400

    c/r: dump memory address space (private memory)
    
    For each vma, there is a 'struct ckpt_vma'; Then comes the actual
    contents, in one or more chunk: each chunk begins with a header that
    specifies how many pages it holds, then the virtual addresses of all
    the dumped pages in that chunk, followed by the actual contents of all
    dumped pages. A header with zero number of pages marks the end of the
    contents.  Then comes the next vma and so on.
    
    To checkpoint a vma, call the ops->checkpoint() method of that vma.
    Normally the per-vma function will invoke generic_vma_checkpoint()
    which first writes the vma description, followed by the specific
    logic to dump the contents of the pages.
    
    Currently for private mapped memory we save the pathname of the file
    that is mapped (restart will use it to re-open it and then map it).
    Later we change that to reference a file object.
    
    Changelog[v18]:
      - Add a few more ckpt_write_err()s
      - [Serge Hallyn] Export filemap_checkpoint() (used later for ext4)
      - Use ckpt_collect_file() instead of ckpt_obj_collect() for files
      - In collect_mm() use retval from ckpt_obj_collect() to test for
        first-time-object
    Changelog[v17]:
      - Only collect sub-objects of mm_struct once
      - Save mm->{flags,def_flags,saved_auxv}
    Changelog[v16]:
      - Precede vaddrs/pages with a buffer header
      - Checkpoint mm->exe_file
      - Handle shared task->mm
    Changelog[v14]:
      - Modify the ops->checkpoint method to be much more powerful
      - Improve support for VDSO (with special_mapping checkpoint callback)
      - Save new field 'vdso' in mm_context
      - Revert change to pr_debug(), back to ckpt_debug()
      - Check whether calls to ckpt_hbuf_get() fail
      - Discard field 'h->parent'
    Changelog[v13]:
      - pgprot_t is an abstract type; use the proper accessor (fix for
        64-bit powerpc (Nathan Lynch <ntl at pobox.com>)
    Changelog[v12]:
      - Hide pgarr management inside ckpt_private_vma_fill_pgarr()
      - Fix management of pgarr chain reset and alloc/expand: keep empty
        pgarr in a pool chain
      - Replace obsolete ckpt_debug() with pr_debug()
    Changelog[v11]:
      - Copy contents of 'init->fs->root' instead of pointing to them.
      - Add missing test for VM_MAYSHARE when dumping memory
    Changelog[v10]:
      - Acquire dcache_lock around call to __d_path() in ckpt_fill_name()
    Changelog[v9]:
      - Introduce ckpt_ctx_checkpoint() for checkpoint-specific ctx setup
      - Test if __d_path() changes mnt/dentry (when crossing filesystem
        namespace boundary). for now ckpt_fill_fname() fails the checkpoint.
    Changelog[v7]:
      - Fix argument given to kunmap_atomic() in memory dump/restore
    Changelog[v6]:
      - Balance all calls to ckpt_hbuf_get() with matching ckpt_hbuf_put()
        (even though it's not really needed)
    Changelog[v5]:
      - Improve memory dump code (following Dave Hansen's comments)
      - Change dump format (and code) to allow chunks of <vaddrs, pages>
        instead of one long list of each
      - Fix use of follow_page() to avoid faulting in non-present pages
    Changelog[v4]:
      - Use standard list_... for ckpt_pgarr
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 7bc7e50aca9cd3d3460634f94b3e1d3be56c8883
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:07 2009 -0400

    c/r: introduce method '->checkpoint()' in struct vm_operations_struct
    
    Changelog[v17]
      - Forward-declare 'ckpt_ctx et-al, don't use checkpoint_types.h
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit a1b772aa9629dc91dfd350f2cf22a05df7554627
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:06 2009 -0400

    c/r: restore open file descriptors
    
    For each fd read 'struct ckpt_hdr_file_desc' and lookup objref in the
    hash table; If not found in the hash table, (first occurence), read in
    'struct ckpt_hdr_file', create a new file and register in the hash.
    Otherwise attach the file pointer from the hash as an FD.
    
    Changelog[v18]:
      - Invoke set_close_on_exec() unconditionally on restart
    Changelog[v17]:
      - Validate f_mode after restore against saved f_mode
      - Fail if f_flags have O_CREAT|O_EXCL|O_NOCTTY|O_TRUN
      - Reorder patch (move earlier in series)
      - Handle shared files_struct objects
    Changelog[v14]:
      - Introduce a per file-type restore() callback
      - Revert change to pr_debug(), back to ckpt_debug()
      - Rename:  restore_files() => restore_fd_table()
      - Rename:  ckpt_read_fd_data() => restore_file()
      - Check whether calls to ckpt_hbuf_get() fail
      - Discard field 'hh->parent'
    Changelog[v12]:
      - Replace obsolete ckpt_debug() with pr_debug()
    Changelog[v6]:
      - Balance all calls to ckpt_hbuf_get() with matching ckpt_hbuf_put()
        (even though it's not really needed)
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit a553a51c0291d1be52abd1af3ca4427d2b09922e
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:06 2009 -0400

    c/r: dump open file descriptors
    
    Dump the file table with 'struct ckpt_hdr_file_table, followed by all
    open file descriptors. Because the 'struct file' corresponding to an
    fd can be shared, they are assigned an objref and registered in the
    object hash. A reference to the 'file *' is kept for as long as it
    lives in the hash (the hash is only cleaned up at the end of the
    checkpoint).
    
    Also provide generic_checkpoint_file() and generic_restore_file()
    which is good for normal files and directories. It does not support
    yet unlinked files or directories.
    
    Changelog[v18]:
      - Add a few more ckpt_write_err()s
      - [Dan Smith] Export fill_fname() as ckpt_fill_fname()
      - Introduce ckpt_collect_file() that also uses file->collect method
      - In collect_file_stabl() use retval from ckpt_obj_collect() to
        test for first-time-object
    Changelog[v17]:
      - Only collect sub-objects of files_struct once
      - Better file error debugging
      - Use (new) d_unlinked()
    Changelog[v16]:
      - Fix compile warning in checkpoint_bad()
    Changelog[v16]:
      - Reorder patch (move earlier in series)
      - Handle shared files_struct objects
    Changelog[v14]:
      - File objects are dumped/restored prior to the first reference
      - Introduce a per file-type restore() callback
      - Use struct file_operations->checkpoint()
      - Put code for generic file descriptors in a separate function
      - Use one CKPT_FILE_GENERIC for both regular files and dirs
      - Revert change to pr_debug(), back to ckpt_debug()
      - Use only unsigned fields in checkpoint headers
      - Rename:  ckpt_write_files() => checkpoint_fd_table()
      - Rename:  ckpt_write_fd_data() => checkpoint_file()
      - Discard field 'h->parent'
    Changelog[v12]:
      - Replace obsolete ckpt_debug() with pr_debug()
    Changelog[v11]:
      - Discard handling of opened symlinks (there is no such thing)
      - ckpt_scan_fds() retries from scratch if hits size limits
    Changelog[v9]:
      - Fix a couple of leaks in ckpt_write_files()
      - Drop useless kfree from ckpt_scan_fds()
    Changelog[v8]:
      - initialize 'coe' to workaround gcc false warning
    Changelog[v6]:
      - Balance all calls to ckpt_hbuf_get() with matching ckpt_hbuf_put()
        (even though it's not really needed)
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 5c07b60c1fada8323cf8acfbf8374f0f41d251dc
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:05 2009 -0400

    c/r: introduce new 'file_operations': ->checkpoint, ->collect()
    
    While we assume all normal files and directories can be checkpointed,
    there are, as usual in the VFS, specialized places that will always
    need an ability to override these defaults. Although we could do this
    completely in the checkpoint code, that would bitrot quickly.
    
    This adds a new 'file_operations' function for checkpointing a file.
    It is assumed that there should be a dirt-simple way to make something
    (un)checkpointable that fits in with current code.
    
    As you can see in the ext[234] patches down the road, all that we have
    to do to make something simple be supported is add a single "generic"
    f_op entry.
    
    Also adds a new 'file_operations' function for 'collecting' a file for
    leak-detection during full-container checkpoint. This is useful for
    those files that hold references to other "collectable" objects. Two
    examples are pty files that point to corresponding tty objects, and
    eventpoll files that refer to the files they are monitoring.
    
    Finally, this patch introduces vfs_fcntl() so that it can be called
    from restart (see patch adding restart of files).
    
    Changelog[v17]
      - Introduce 'collect' method
    Changelog[v17]
      - Forward-declare 'ckpt_ctx' et-al, don't use checkpoint_types.h
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 364a123242728d59b2de29de6d3dfb0404293676
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:05 2009 -0400

    deferqueue: generic queue to defer work
    
    Add a interface to postpone an action until the end of the entire
    checkpoint or restart operation. This is useful when during the
    scan of tasks an operation cannot be performed in place, to avoid
    the need for a second scan.
    
    One use case is when restoring an ipc shared memory region that has
    been deleted (but is still attached), during restart it needs to be
    create, attached and then deleted. However, creation and attachment
    are performed in distinct locations, so deletion can not be performed
    on the spot. Instead, this work (delete) is deferred until later.
    (This example is in one of the following patches).
    
    This interface allows chronic procrastination in the kernel:
    
    deferqueue_create(void):
        Allocates and returns a new deferqueue.
    
    deferqueue_run(deferqueue):
        Executes all the pending works in the queue. Returns the number
        of works executed, or an error upon the first error reported by
        a deferred work.
    
    deferqueue_add(deferqueue, data, size, func, dtor):
        Enqueue a deferred work. @function is the callback function to
        do the work, which will be called with @data as an argument.
        @size tells the size of data. @dtor is a destructor callback
        that is invoked for deferred works remaining in the queue when
        the queue is destroyed. NOTE: for a given deferred work, @dtor
        is _not_ called if @func was already called (regardless of the
        return value of the latter).
    
    deferqueue_destroy(deferqueue):
        Free the deferqueue and any queued items while invoking the
        @dtor callback for each queued item.
    
    Why aren't we using the existing kernel workqueue mechanism?  We need
    to defer to work until the end of the operation: not earlier, since we
    need other things to be in place; not later, to not block waiting for
    it. However, the workqueue schedules the work for 'some time later'.
    Also, the kernel workqueue may run in any task context, but we require
    many times that an operation be run in the context of some specific
    restarting task (e.g., restoring IPC state of a certain ipc_ns).
    
    Instead, this mechanism is a simple way for the c/r operation as a
    whole, and later a task in particular, to defer some action until
    later (but not arbitrarily later) _in the restore_ operation.
    
    Changelog[v18]
      - Interface to pass simple pointers as data with deferqueue
    Changelog[v17]
      - Fix deferqueue_add() function
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 206d0107cbd5b59978b59edf7aed7cb372d4024d
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:05 2009 -0400

    c/r: detect resource leaks for whole-container checkpoint
    
    Add a 'users' count to objhash items, and, for a !CHECKPOINT_SUBTREE
    checkpoint, return an error code if the actual objects' counts are
    higher, indicating leaks (references to the objects from a task not
    being checkpointed).
    
    The comparison of the objhash user counts to object refcounts as a
    basis for checking for leaks comes from Alexey's OpenVZ-based c/r
    patchset.
    
    "Leak detection" occurs _before_ any real state is saved, as a
    pre-step. This prevents races due to sharing with outside world where
    the sharing ceases before the leak test takes place, thus protecting
    the checkpoint image from inconsistencies.
    
    Once leak testing concludes, checkpoint will proceed. Because objects
    are already in the objhash, checkpoint_obj() cannot distinguish
    between the first and subsequent encounters. This is solved with a
    flag (CKPT_OBJ_CHECKPOINTED) per object.
    
    Two additional checks take place during checkpoint: for objects that
    were created during, and objects destroyed, while the leak-detection
    pre-step took place. (By the time this occurs part of the checkpoint
    image has been written out to disk, so this is purely advisory).
    
    Changelog[v18]:
      - Replace some EAGAIN with EBUSY
      - Add a few more ckpt_write_err()s
      - Introduce CKPT_OBJ_VISITED
      - ckpt_obj_collect() returns objref for new objects, 0 otherwise
      - Rename ckpt_obj_checkpointed() to ckpt_obj_visited()
      - Introduce ckpt_obj_visit() to mark objects as visited
      - Set the CHECKPOINTED flag on objects before calling checkpoint
    Changelog[v17]:
      - Leak detection is performed in two-steps
      - Detect reverse-leaks (objects disappearing unexpectedly)
      - Skip reverse-leak detection if ops->ref_users isn't defined
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 0097fa081d3325b50dc65bb6c524b7cb86990dea
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 12:09:04 2009 -0400

    c/r: infrastructure for shared objects
    
    The state of shared objects is saved once. On the first encounter, the
    state is dumped and the object is assigned a unique identifier (objref)
    and also stored in a hash table (indexed by its physical kernel address).
    From then on the object will be found in the hash and only its identifier
    is saved.
    
    On restart the identifier is looked up in the hash table; if not found
    then the state is read, the object is created, and added to the hash
    table (this time indexed by its identifier). Otherwise, the object in
    the hash table is used.
    
    The hash is "one-way": objects added to it are never deleted until the
    hash it discarded. The hash is discarded at the end of checkpoint or
    restart, whether successful or not.
    
    The hash keeps a reference to every object that is added to it, matching
    the object's type, and maintains this reference during its lifetime.
    Therefore, it is always safe to use an object that is stored in the hash.
    
    Changelog[v18]:
      - Add ckpt_obj_reserve()
      - Change ref_drop() to accept a @lastref argument (useful for cleanup)
      - Disallow multiple objects with same objref in restart
      - Allow _ckpt_read_obj_type() to read object header only (w/o payload)
    Changelog[v17]:
      - Add ckpt_obj->flags with CKPT_OBJ_CHECKPOINTED flag
      - Add prototype of ckpt_obj_lookup
      - Complain on attempt to add NULL ptr to objhash
      - Prepare for 'leaks detection'
    Changelog[v16]:
      - Introduce ckpt_obj_lookup() to find an object by its ptr
    Changelog[v14]:
      - Introduce 'struct ckpt_obj_ops' to better modularize shared objs.
      - Replace long 'switch' statements with table lookups and callbacks.
      - Introduce checkpoint_obj() and restart_obj() helpers
      - Shared objects now dumped/saved right before they are referenced
      - Cleanup interface of shared objects
    Changelog[v13]:
      - Use hash_long() with 'unsigned long' cast to support 64bit archs
        (Nathan Lynch <ntl at pobox.com>)
    Changelog[v11]:
      - Doc: be explicit about grabbing a reference and object lifetime
    Changelog[v4]:
      - Fix calculation of hash table size
    Changelog[v3]:
      - Use standard hlist_... for hash table
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 9894f6524904b22395e8d252bd525c1b27780a46
Author: Matt Helsley <matthltc at us.ibm.com>
Date:   Wed Sep 16 11:37:00 2009 -0400

    c/r: Save and restore the [compat_]robust_list member of the task struct
    
    These lists record which futexes the task holds. To keep the overhead of
    robust futexes low the list is kept in userspace. When the task exits the
    kernel carefully walks these lists to recover held futexes that
    other tasks may be attempting to acquire with FUTEX_WAIT.
    
    Because they point to userspace memory that is saved/restored by
    checkpoint/restart saving the list pointers themselves is safe.
    
    While saving the pointers is safe during checkpoint, restart is tricky
    because the robust futex ABI contains provisions for changes based on
    checking the size of the list head. So we need to save the length of
    the list head too in order to make sure that the kernel used during
    restart is capable of handling that ABI. Since there is only one ABI
    supported at the moment taking the list head's size is simple. Should
    the ABI change we will need to use the same size as specified during
    sys_set_robust_list() and hence some new means of determining the length
    of this userspace structure in sys_checkpoint would be required.
    
    Rather than rewrite the logic that checks and handles the ABI we reuse
    sys_set_robust_list() by factoring out the body of the function and
    calling it during restart.
    
    Signed-off-by: Matt Helsley <matthltc at us.ibm.com>
    [orenl at cs.columbia.edu: move save/restore code to checkpoint/process.c]

commit c0da31a92919fd6fda52eb9132ab9ee7734e259f
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 11:30:11 2009 -0400

    c/r: support for zombie processes
    
    During checkpoint, a zombie processes need only save p->comm,
    p->state, p->exit_state, and p->exit_code.
    
    During restart, zombie processes are created like all other
    processes. They validate the saved exit_code restore p->comm
    and p->exit_code. Then they call do_exit() instead of waking
    up the next task in line.
    
    But before, they place the @ctx in p->checkpoint_ctx, so that
    only at exit time they will wake up the next task in line,
    and drop the reference to the @ctx.
    
    This provides the guarantee that when the coordinator's wait
    completes, all normal tasks completed their restart, and all
    zombie tasks are already zombified (as opposed to perhap only
    becoming a zombie).
    
    Changelog[v18]:
      - Add a few more ckpt_write_err()s
    Changelog[v17]:
      - Validate t->exit_signal for both threads and leader
      - Skip zombies in most of may_checkpoint_task()
      - Save/restore t->pdeath_signal
      - Validate ->exit_signal and ->pdeath_signal
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 28f101689d2e3aa56aab860988e75b05608cb889
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 11:30:11 2009 -0400

    c/r: introduce PF_RESTARTING, and skip notification on exit
    
    To restore zombie's we will create the a task, that, on its turn to
    run, calls do_exit(). Unlike normal tasks that exit, we need to
    prevent notification side effects that send signals to other
    processes, e.g. parent (SIGCHLD) or child tasks (per child's request).
    
    There are three main cases for such notifications:
    
    1) do_notify_parent(): parent of a process is notified about a change
     in status (e.g. become zombie, reparent, etc). If parent ignores,
     then mark child for immediate release (skip zombie).
    
    2) kill_orphan_pgrp(): a process group that becomes orphaned will
     signal stopped jobs (HUP then CONT).
    
    3) reparent_thread(): children of a process are signaled (per request)
     with p->pdeath_signal
    
    Remember that restoring signal state (for any restarting task) must
    complete _before_ it is allowed to resume execution, and not during
    the resume. Otherwise, a running task may send a signal to another
    task that hasn't restored yet, so the new signal will be lost
    soon-after.
    
    I considered two possible way to address this:
    
    1. Add another sync point to restart: all tasks will first restore
    their state without signals (all signals blocked), and zombies call
    do_exit(). A sync point then will ensure that all zombies are gone and
    their effects done. Then all tasks restore their signal state (and
    mask), and sync (new point) again. Only then they may resume
    execution.
    The main disadvantage is the added complexity and inefficiency,
    for no good reason.
    
    2. Introduce PF_RESTARTING: mark all restarting tasks with a new flag,
    and teach the above three notifications to skip sending the signal if
    theis flag is set.
    The main advantage is simplicity and completeness. Also, such a flag
    may to be useful later on. This the method implemented.
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit e1a78d71b9ee217b897cd3fafe4f6471ff0d65f9
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 11:30:10 2009 -0400

    c/r: restart multiple processes
    
    Restarting of multiple processes expects all restarting tasks to call
    sys_restart(). Once inside the system call, each task will restart
    itself at the same order that they were saved. The internals of the
    syscall will take care of in-kernel synchronization bewteen tasks.
    
    This patch does _not_ create the task tree in the kernel. Instead it
    assumes that all tasks are created in some way and then invoke the
    restart syscall. You can use the userspace mktree.c program to do
    that.
    
    There is one special task - the coordinator - that is not part of the
    restarted hierarchy. The coordinator task allocates the restart
    context (ctx) and orchestrates the restart. Thus even if a restart
    fails after, or during the restore of the root task, the user
    perceives a clean exit and an error message.
    
    The coordinator task will:
     1) read header and tree, create @ctx (wake up restarting tasks)
     2) set the ->checkpoint_ctx field of itself and all descendants
     3) wait for all restarting tasks to reach sync point #1
     4) activate first restarting task (root task)
     5) wait for all other tasks to complete and reach sync point #3
     6) wake up everybody
    
    (Note that in step #2 the coordinator assumes that the entire task
    hierarchy exists by the time it enters sys_restart; this is arranged
    in user space by 'mktree')
    
    Task that are restarting has three sync points:
     1) wait for its ->checkpoint_ctx to be set (by the coordinator)
     2) wait for the task's turn to restore (be active)
     [...now the task restores its state...]
     3) wait for all other tasks to complete
    
    The third sync point ensures that a task may only resume execution
    after all tasks have successfully restored their state (or fail if an
    error has occured). This prevents tasks from returning to user space
    prematurely, before the entire restart completes.
    
    If a single task wishes to restart, it can set the "RESTART_TASKSELF"
    flag to restart(2) to skip the logic of the coordinator.
    
    The root-task is a child of the coordinator, identified by the @pid
    given to sys_restart() in the pid-ns of the coordinator. Restarting
    tasks that aren't the coordinator, should set the @pid argument of
    restart(2) syscall to zero.
    
    All tasks explicitly test for an error flag on the checkpoint context
    when they wakeup from sync points.  If an error occurs during the
    restart of some task, it will mark the @ctx with an error flag, and
    wakeup the other tasks.
    
    An array of pids (the one saved during the checkpoint) is used to
    synchronize the operation. The first task in the array is the init
    task (*). The restart context (@ctx) maintains a "current position" in
    the array, which indicates which task is currently active. Once the
    currently active task completes its own restart, it increments that
    position and wakes up the next task.
    
    Restart assumes that userspace provides meaningful data, otherwise
    it's garbage-in-garbage-out. In this case, the syscall may block
    indefinitely, but in TASK_INTERRUPTIBLE, so the user can ctrl-c or
    otherwise kill the stray restarting tasks.
    
    In terms of security, restart runs as the user the invokes it, so it
    will not allow a user to do more than is otherwise permitted by the
    usual system semantics and policy.
    
    Currently we ignore threads and zombies, as well as session ids.
    Add support for multiple processes
    
    (*) For containers, restart should be called inside a fresh container
    by the init task of that container. However, it is also possible to
    restart applications not necessarily inside a container, and without
    restoring the original pids of the processes (that is, provided that
    the application can tolerate such behavior). This is useful to allow
    multi-process restart of tasks not isolated inside a container, and
    also for debugging.
    
    Changelog[v18]:
      - Track and report the first error if restart fails
      - Tighten logic to protect against bogus pids in input
      - [Matt Helsley] Improve debug output from ckpt_notify_error()
    Changelog[v17]:
      - Add uflag RESTART_FROZEN to freeze tasks after restart
      - Fix restore_retval() and use only for restarting tasks
      - Coordinator converts -ERSTART... to -EINTR
      - Coordinator marks and sets descendants' ->checkpoint_ctx
      - Coordinator properly detects errors when woken up from wait
      - Fix race where root_task could kick start too early
      - Add a sync point for restarting tasks
      - Multiple fixes to restart logic
    Changelog[v14]:
      - Revert change to pr_debug(), back to ckpt_debug()
      - Discard field 'h.parent'
      - Check whether calls to ckpt_hbuf_get() fail
    Changelog[v13]:
      - Clear root_task->checkpoint_ctx regardless of error condition
      - Remove unused argument 'ctx' from do_restore_task() prototype
      - Remove unused member 'pids_err' from 'struct ckpt_ctx'
    Changelog[v12]:
      - Replace obsolete ckpt_debug() with pr_debug()
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit dbcded5f6cc002aba2c55b8f9934e9a7835f42aa
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 11:30:10 2009 -0400

    c/r: checkpoint multiple processes
    
    Checkpointing of multiple processes works by recording the tasks tree
    structure below a given "root" task. The root task is expected to be a
    container init, and then an entire container is checkpointed. However,
    passing CHECKPOINT_SUBTREE to checkpoint(2) relaxes this requirement
    and allows to checkpoint a subtree of processes from the root task.
    
    For a given root task, do a DFS scan of the tasks tree and collect them
    into an array (keeping a reference to each task). Using DFS simplifies
    the recreation of tasks either in user space or kernel space. For each
    task collected, test if it can be checkpointed, and save its pid, tgid,
    and ppid.
    
    The actual work is divided into two passes: a first scan counts the
    tasks, then memory is allocated and a second scan fills the array.
    
    Whether checkpoints and restarts require CAP_SYS_ADMIN is determined
    by sysctl 'ckpt_unpriv_allowed': if 1, then regular permission checks
    are intended to prevent privilege escalation, however if 0 it prevents
    unprivileged users from exploiting any privilege escalation bugs.
    
    The logic is suitable for creation of processes during restart either
    in userspace or by the kernel.
    
    Currently we ignore threads and zombies.
    
    Changelog[v18]:
      - Replace some EAGAIN with EBUSY
      - Add a few more ckpt_write_err()s
      - Rename headerless struct ckpt_hdr_* to struct ckpt_*
    Changelog[v16]:
      - CHECKPOINT_SUBTREE flags allows subtree (not whole container)
      - sysctl variable 'ckpt_unpriv_allowed' controls needed privileges
    Changelog[v14]:
      - Refuse non-self checkpoint if target task isn't frozen
      - Refuse checkpoint (for now) if task is ptraced
      - Revert change to pr_debug(), back to ckpt_debug()
      - Use only unsigned fields in checkpoint headers
      - Check retval of ckpt_tree_count_tasks() in ckpt_build_tree()
      - Discard 'h.parent' field
      - Check whether calls to ckpt_hbuf_get() fail
      - Disallow threads or siblings to container init
    Changelog[v13]:
      - Release tasklist_lock in error path in ckpt_tree_count_tasks()
      - Use separate index for 'tasks_arr' and 'hh' in ckpt_write_pids()
    Changelog[v12]:
      - Replace obsolete ckpt_debug() with pr_debug()
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit bf26affa6d06f107bb23a2f7ce91628f7e05ee8f
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Wed Sep 16 11:29:46 2009 -0400

    c/r: restart-blocks
    
    (Paraphrasing what's said this message:
    http://lists.openwall.net/linux-kernel/2007/12/05/64)
    
    Restart blocks are callbacks used cause a system call to be restarted
    with the arguments specified in the system call restart block. It is
    useful for system call that are not idempotent, i.e. the argument(s)
    might be a relative timeout, where some adjustments are required when
    restarting the system call. It relies on the system call itself to set
    up its restart point and the argument save area.  They are rare: an
    actual signal would turn that it an EINTR. The only case that should
    ever trigger this is some kernel action that interrupts the system
    call, but does not actually result in any user-visible state changes -
    like freeze and thaw.
    
    So restart blocks are about time remaining for the system call to
    sleep/wait. Generally in c/r, there are two possible time models that
    we can follow: absolute, relative. Here, I chose to save the relative
    timeout, measured from the beginning of the checkpoint. The time when
    the checkpoint (and restart) begin is also saved. This information is
    sufficient to restart in either model (absolute or negative).
    
    Which model to use should eventually be a per application choice (and
    possible configurable via cradvise() or some sort). For now, we adopt
    the relative model, namely, at restart the timeout is set relative to
    the beginning of the restart.
    
    To checkpoint, we check if a task has a valid restart block, and if so
    we save the *remaining* time that is has to wait/sleep, and the type
    of the restart block.
    
    To restart, we fill in the data required at the proper place in the
    thread information. If the system call return an error (which is
    possibly an -ERESTARTSYS eg), we not only use that error as our own
    return value, but also arrange for the task to execute the signal
    handler (by faking a signal). The handler, in turn, already has the
    code to handle these restart request gracefully.
    
    Changelog[v1]:
      - [Nathan Lynch] fix compilation errors with CONFIG_COMPAT=y
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit cfeaf174627dfa1a13dc1bb49a85bebe1db689d5
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Tue Sep 15 19:56:03 2009 -0400

    c/r: export functionality used in next patch for restart-blocks
    
    To support c/r of restart-blocks (system call that need to be
    restarted because they were interrupted but there was no userspace
    visible side-effect), export restart-block callbacks for poll()
    and futex() syscalls.
    
    More details on c/r of restart-blocks and how it works in the
    following patch.
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>
    Acked-by: Serge Hallyn <serue at us.ibm.com>

commit 6275ea063c1870894e9830d4305f3fa484f232f9
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Tue Sep 15 19:56:03 2009 -0400

    c/r: external checkpoint of a task other than ourself
    
    Now we can do "external" checkpoint, i.e. act on another task.
    
    sys_checkpoint() now looks up the target pid (in our namespace) and
    checkpoints that corresponding task. That task should be the root of
    a container, unless CHECKPOINT_SUBTREE flag is given.
    
    Set state of freezer cgroup of checkpointed task hierarchy to
    "CHECKPOINTING" during a checkpoint, to ensure that task(s) cannot be
    thawed while at it.
    
    Ensure that all tasks belong to root task's freezer cgroup (the root
    task is also tested, to detect it if changes its freezer cgroups
    before it moves to "CHECKPOINTING").
    
    sys_restart() remains nearly the same, as the restart is always done
    in the context of the restarting task. However, the original task may
    have been frozen from user space, or interrupted from a syscall for
    the checkpoint. This is accounted for by restoring a suitable retval
    for the restarting task, according to how it was checkpointed.
    
    Changelog[v17]:
      - Move restore_retval() to this patch
      - Tighten ptrace ceckpoint for checkpoint to PTRACE_MODE_ATTACH
      - Use CHECKPOINTING state for hierarchy's freezer for checkpoint
    Changelog[v16]:
      - Use CHECKPOINT_SUBTREE to allow subtree (partial container)
    Changelog[v14]:
      - Refuse non-self checkpoint if target task isn't frozen
    Changelog[v12]:
      - Replace obsolete ckpt_debug() with pr_debug()
    Changelog[v11]:
      - Copy contents of 'init->fs->root' instead of pointing to them
    Changelog[v10]:
      - Grab vfs root of container init, rather than current process
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 27beb348bae4044c75dc196a59037fbae37f5860
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Tue Sep 15 19:56:03 2009 -0400

    c/r: x86_32 support for checkpoint/restart
    
    Add logic to save and restore architecture specific state, including
    thread-specific state, CPU registers and FPU state.
    
    In addition, architecture capabilities are saved in an architecure
    specific extension of the header (ckpt_hdr_head_arch); Currently this
    includes only FPU capabilities.
    
    Currently only x86-32 is supported.
    
    Changelog[v17]:
      - Fix compilation for architectures that don't support checkpoint
      - Validate cpu registers and TLS descriptors on restart
      - Validate debug registers on restart
      - Export asm/checkpoint_hdr.h to userspace
    Changelog[v16]:
      - All objects are preceded by ckpt_hdr (TLS and xstate_buf)
      - Add architecture identifier to main header
    Changelog[v14]:
      - Use new interface ckpt_hdr_get/put()
      - Embed struct ckpt_hdr in struct ckpt_hdr...
      - Remove preempt_disable/enable() around init_fpu() and fix leak
      - Revert change to pr_debug(), back to ckpt_debug()
      - Move code related to task_struct to checkpoint/process.c
    Changelog[v12]:
      - A couple of missed calls to ckpt_hbuf_put()
      - Replace obsolete ckpt_debug() with pr_debug()
    Changelog[v9]:
      - Add arch-specific header that details architecture capabilities;
        split FPU restore to send capabilities only once.
      - Test for zero TLS entries in ckpt_write_thread()
      - Fix asm/checkpoint_hdr.h so it can be included from user-space
    Changelog[v7]:
      - Fix save/restore state of FPU
    Changelog[v5]:
      - Remove preempt_disable() when restoring debug registers
    Changelog[v4]:
      - Fix header structure alignment
    Changelog[v2]:
      - Pad header structures to 64 bits to ensure compatibility
      - Follow Dave Hansen's refactoring of the original post
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit e0c37d443dedd80bf33b036c9f84a78d9a599f76
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Tue Sep 15 19:55:58 2009 -0400

    c/r: basic infrastructure for checkpoint/restart
    
    Add those interfaces, as well as helpers needed to easily manage the
    file format. The code is roughly broken out as follows:
    
    checkpoint/sys.c - user/kernel data transfer, as well as setup of the
      c/r context (a per-checkpoint data structure for housekeeping)
    
    checkpoint/checkpoint.c - output wrappers and basic checkpoint handling
    
    checkpoint/restart.c - input wrappers and basic restart handling
    
    checkpoint/process.c - c/r of task data
    
    For now, we can only checkpoint the 'current' task ("self" checkpoint),
    and the 'pid' argument to the syscall is ignored.
    
    Patches to add the per-architecture support as well as the actual
    work to do the memory checkpoint follow in subsequent patches.
    
    
    Changelog[v18]:
      - Detect error-headers in input data on restart, and abort.
      - Standard format for checkpoint error strings
      - [Matt Helsley] Rename headerless struct ckpt_hdr_* to struct ckpt_*
      - [Dan Smith] Add an errno validation function
      - Add ckpt_read_payload(): read a variable-length object (no header)
      - Add ckpt_read_string(): same for strings (ensures null-terminated)
      - Add ckpt_read_consume(): consumes next object without processing
    Changelog[v17]:
      - Fix compilation for architectures that don't support checkpoint
      - Save/restore t->{set,clear}_child_tid
      - Restart(2) isn't idempotent: must return -EINTR if interrupted
      - ckpt_debug does not depend on DYNAMIC_DEBUG, on by default
      - Export generic checkpoint headers to userespace
      - Fix comment for prototype of sys_restart
      - Have ckpt_debug() print global-pid and __LINE__
      - Only save and test kernel constants once (in header)
    Changelog[v16]:
      - Split ctx->flags to ->uflags (user flags) and ->kflags (kernel flags)
      - Introduce __ckpt_write_err() and ckpt_write_err() to report errors
      - Allow @ptr == NULL to write (or read) header only without payload
      - Introduce _ckpt_read_obj_type()
    Changelog[v15]:
      - Replace header buffer in ckpt_ctx (hbuf,hpos) with kmalloc/kfree()
    Changelog[v14]:
      - Cleanup interface to get/put hdr buffers
      - Merge checkpoint and restart code into a single file (per subsystem)
      - Take uts_sem around access to uts->{release,version,machine}
      - Embed ckpt_hdr in all ckpt_hdr_...., cleanup read/write helpers
      - Define sys_checkpoint(0,...) as asking for a self-checkpoint (Serge)
      - Revert use of 'pr_fmt' to avoid tainting whom includes us (Nathan Lynch)
      - Explicitly indicate length of UTS fields in header
      - Discard field 'h->parent' from ckpt_hdr
    Changelog[v12]:
      - ckpt_kwrite/ckpt_kread() again use vfs_read(), vfs_write() (safer)
      - Split ckpt_write/ckpt_read() to two parts: _ckpt_write/read() helper
      - Befriend with sparse : explicit conversion to 'void __user *'
      - Redfine 'pr_fmt' instead of using special ckpt_debug()
    Changelog[v10]:
      - add ckpt_write_buffer(), ckpt_read_buffer() and ckpt_read_buf_type()
      - force end-of-string in ckpt_read_string() (fix possible DoS)
    Changelog[v9]:
      - ckpt_kwrite/ckpt_kread() use file->f_op->write() directly
      - Drop ckpt_uwrite/ckpt_uread() since they aren't used anywhere
    Changelog[v6]:
      - Balance all calls to ckpt_hbuf_get() with matching ckpt_hbuf_put()
        (although it's not really needed)
    Changelog[v5]:
      - Rename headers files s/ckpt/checkpoint/
    Changelog[v2]:
      - Added utsname->{release,version,machine} to checkpoint header
      - Pad header structures to 64 bits to ensure compatibility
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit c1cb146ee36f5a40cefccca31b25479366f00951
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Mon Sep 14 19:14:51 2009 -0400

    c/r: documentation
    
    Covers application checkpoint/restart, overall design, interfaces,
    usage, shared objects, and and checkpoint image format.
    
    Changelog[v16]:
      - Update documentation
      - Unify into readme.txt and usage.txt
    Changelog[v14]:
      - Discard the 'h.parent' field
      - New image format (shared objects appear before they are referenced
        unless they are compound)
    Changelog[v8]:
      - Split into multiple files in Documentation/checkpoint/...
      - Extend documentation, fix typos and comments from feedback
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>
    Acked-by: Serge Hallyn <serue at us.ibm.com>
    Signed-off-by: Dave Hansen <dave at linux.vnet.ibm.com>

commit c645f92635786538b3b825cf7481bb514048d2e6
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Mon Sep 14 17:29:03 2009 -0400

    c/r: create syscalls: sys_checkpoint, sys_restart
    
    Create trivial sys_checkpoint and sys_restore system calls. They will
    enable to checkpoint and restart an entire container, to and from a
    checkpoint image file descriptor.
    
    The syscalls take a pid, a file descriptor (for the image file) and
    flags as arguments. The pid identifies the top-most (root) task in the
    process tree, e.g. the container init: for sys_checkpoint the first
    argument identifies the pid of the target container/subtree; for
    sys_restart it will identify the pid of restarting root task.
    
    A checkpoint, much like a process coredump, dumps the state of multiple
    processes at once, including the state of the container. The checkpoint
    image is written to (and read from) the file descriptor directly from
    the kernel. This way the data is generated and then pushed out naturally
    as resources and tasks are scanned to save their state. This is the
    approach taken by, e.g., Zap and OpenVZ.
    
    By using a return value and not a file descriptor, we can distinguish
    between a return from checkpoint, a return from restart (in case of a
    checkpoint that includes self, i.e. a task checkpointing its own
    container, or itself), and an error condition, in a manner analogous
    to a fork() call.
    
    We don't use copy_from_user()/copy_to_user() because it requires
    holding the entire image in user space, and does not make sense for
    restart.  Also, we don't use a pipe, pseudo-fs file and the like,
    because they work by generating data on demand as the user pulls it
    (unless the entire image is buffered in the kernel) and would require
    more complex logic.  They also would significantly complicate
    checkpoint that includes self.
    
    Changelog[v18]:
      - [John Dykstra] Fix no-dot-config-targets pattern in linux/Makefile
    Changelog[v17]:
      - Move checkpoint closer to namespaces (kconfig)
      - Kill "Enable" in c/r config option
    Changelog[v16]:
      - Change sys_restart() first argument to be 'pid_t pid'
    Changelog[v14]:
      - Change CONFIG_CHEKCPOINT_RESTART to CONFIG_CHECKPOINT (Ingo)
      - Remove line 'def_bool n' (default is already 'n')
      - Add CHECKPOINT_SUPPORT in Kconfig (Nathan Lynch)
    Changelog[v5]:
      - Config is 'def_bool n' by default
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>
    Acked-by: Serge Hallyn <serue at us.ibm.com>
    Signed-off-by: Dave Hansen <dave at linux.vnet.ibm.com>

commit b8dc9d1334b7b21b80e69472d81670673cd72ee9
Author: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
Date:   Mon Sep 14 17:29:02 2009 -0400

    pids 7/7: Define clone_with_pids syscall
    
    Container restart requires that a task have the same pid it had when it was
    checkpointed. When containers are nested the tasks within the containers
    exist in multiple pid namespaces and hence have multiple pids to specify
    during restart.
    
    clone_with_pids(), intended for use during restart, is the same as clone(),
    except that it takes a 'target_pid_set' paramter. This parameter lets caller
    choose specific pid numbers for the child process, in the process's active
    and ancestor pid namespaces. (Descendant pid namespaces in general don't
    matter since processes don't have pids in them anyway, but see comments
    in copy_target_pids() regarding CLONE_NEWPID).
    
    Unlike clone(), clone_with_pids() needs CAP_SYS_ADMIN, at least for now, to
    prevent unprivileged processes from misusing this interface.
    
    Call clone_with_pids as follows:
    
    	pid_t pids[] = { 0, 77, 99 };
    	struct target_pid_set pid_set;
    
    	pid_set.num_pids = sizeof(pids) / sizeof(int);
    	pid_set.target_pids = &pids;
    
    	syscall(__NR_clone_with_pids, flags, stack, NULL, NULL, NULL, &pid_set);
    
    If a target-pid is 0, the kernel continues to assign a pid for the process in
    that namespace. In the above example, pids[0] is 0, meaning the kernel will
    assign next available pid to the process in init_pid_ns. But kernel will assign
    pid 77 in the child pid namespace 1 and pid 99 in pid namespace 2. If either
    77 or 99 are taken, the system call fails with -EBUSY.
    
    If 'pid_set.num_pids' exceeds the current nesting level of pid namespaces,
    the system call fails with -EINVAL.
    
    Its mostly an exploratory patch seeking feedback on the interface.
    
    NOTE:
    	Compared to clone(), clone_with_pids() needs to pass in two more
    	pieces of information:
    
    		- number of pids in the set
    		- user buffer containing the list of pids.
    
    	But since clone() already takes 5 parameters, use a 'struct
    	target_pid_set'.
    
    TODO:
    	- Gently tested.
    	- May need additional sanity checks in do_fork_with_pids().
    
    Changelog[v3]:
    	- (Oren Laadan) Allow CLONE_NEWPID flag (by allocating an extra pid
    	  in the target_pids[] list and setting it 0. See copy_target_pids()).
    	- (Oren Laadan) Specified target pids should apply only to youngest
    	  pid-namespaces (see copy_target_pids())
    	- (Matt Helsley) Update patch description.
    
    Changelog[v2]:
    	- Remove unnecessary printk and add a note to callers of
    	  copy_target_pids() to free target_pids.
    	- (Serge Hallyn) Mention CAP_SYS_ADMIN restriction in patch description.
    	- (Oren Laadan) Add checks for 'num_pids < 0' (return -EINVAL) and
    	  'num_pids == 0' (fall back to normal clone()).
    	- Move arch-independent code (sanity checks and copy-in of target-pids)
    	  into kernel/fork.c and simplify sys_clone_with_pids()
    
    Changelog[v1]:
    	- Fixed some compile errors (had fixed these errors earlier in my
    	  git tree but had not refreshed patches before emailing them)
    
    Signed-off-by: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>

commit 4be244a31beba36e53713cfbd82cd7725ec8de9a
Author: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
Date:   Mon Sep 14 17:29:00 2009 -0400

    pids 6/7: Define do_fork_with_pids()
    
    do_fork_with_pids() is same as do_fork(), except that it takes an
    additional, 'pid_set', parameter. This parameter, currently unused,
    specifies the set of target pids of the process in each of its pid
    namespaces.
    
    Changelog[v3]:
    	- Fix "long-line" warning from checkpatch.pl
    
    Changelog[v2]:
    	- To facilitate moving architecture-inpdendent code to kernel/fork.c
    	  pass in 'struct target_pid_set __user *' to do_fork_with_pids()
    	  rather than 'pid_t *' (next patch moves the arch-independent
    	  code to kernel/fork.c)
    
    Signed-off-by: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
    Acked-by: Serge Hallyn <serue at us.ibm.com>
    Reviewed-by: Oren Laadan <orenl at cs.columbia.edu>

commit 725b4cf984d06207389d927679603a71f881fd3b
Author: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
Date:   Mon Sep 14 17:29:00 2009 -0400

    pids 5/7: Add target_pids parameter to copy_process()
    
    The new parameter will be used in a follow-on patch when clone_with_pids()
    is implemented.
    
    Signed-off-by: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
    Acked-by: Serge Hallyn <serue at us.ibm.com>
    Reviewed-by: Oren Laadan <orenl at cs.columbia.edu>

commit 317e328bf8fa216bba4b3bee72886a1caec2299e
Author: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
Date:   Mon Sep 14 17:28:59 2009 -0400

    pids 4/7: Add target_pids parameter to alloc_pid()
    
    This parameter is currently NULL, but will be used in a follow-on patch.
    
    Signed-off-by: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
    Acked-by: Serge Hallyn <serue at us.ibm.com>
    Reviewed-by: Oren Laadan <orenl at cs.columbia.edu>

commit c63b46bada2a14ff19844733e66c9278c6376273
Author: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
Date:   Mon Sep 14 17:28:58 2009 -0400

    pids 3/7: Add target_pid parameter to alloc_pidmap()
    
    With support for setting a specific pid number for a process,
    alloc_pidmap() will need a paramter a 'target_pid' parameter.
    
    Changelog[v2]:
    	- (Serge Hallyn) Check for 'pid < 0' in set_pidmap().(Code
    	  actually checks for 'pid <= 0' for completeness).
    
    Signed-off-by: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
    Acked-by: Serge Hallyn <serue at us.ibm.com>
    Reviewed-by: Oren Laadan <orenl at cs.columbia.edu>

commit 9c63fcc9ecfe200c4fb096ceecff6784186f2326
Author: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
Date:   Mon Sep 14 17:28:58 2009 -0400

    pids 2/7: Have alloc_pidmap() return actual error code
    
    alloc_pidmap() can fail either because all pid numbers are in use or
    because memory allocation failed.  With support for setting a specific
    pid number, alloc_pidmap() would also fail if either the given pid
    number is invalid or in use.
    
    Rather than have callers assume -ENOMEM, have alloc_pidmap() return
    the actual error.
    
    Signed-off-by: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
    Acked-by: Serge Hallyn <serue at us.ibm.com>
    Reviewed-by: Oren Laadan <orenl at cs.columbia.edu>

commit 16b725ec4607221078a7658e54b6c3a85722c0ff
Author: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
Date:   Mon Sep 14 17:28:57 2009 -0400

    pids 1/7: Factor out code to allocate pidmap page
    
    To implement support for clone_with_pids() system call we would
    need to allocate pidmap page in more than one place. Move this
    code to a new function alloc_pidmap_page().
    
    Changelog[v2]:
    	- (Matt Helsley, Dave Hansen) Have alloc_pidmap_page() return
    	  -ENOMEM on error instead of -1.
    
    Signed-off-by: Sukadev Bhattiprolu <sukadev at linux.vnet.ibm.com>
    Acked-by: Serge Hallyn <serue at us.ibm.com>
    Reviewed-by: Oren Laadan <orenl at cs.columbia.edu>

commit 7a6645eaee7ee31c02d3aee2b97099662b606b64
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Mon Sep 14 17:28:57 2009 -0400

    c/r: make file_pos_read/write() public
    
    These two are used in the next patch when calling vfs_read/write()
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 94123827184443ef8013577b3a3d024ec4adc698
Author: Dave Hansen <dave at linux.vnet.ibm.com>
Date:   Mon Sep 14 17:28:56 2009 -0400

    Namespaces submenu
    
    Let's not steal too much space in the 'General Setup' menu.
    Take a cue from the cgroups code and create a submenu.
    
    This can go upstream now.
    
    Signed-off-by: Dave Hansen <dave at linux.vnet.ibm.com>
    Acked-by: Oren Laadan <orenl at cs.columbia.edu>

commit cedaac037bb182dd4007637a0edbeaa253be1ba0
Author: Oren Laadan <orenl at cs.columbia.edu>
Date:   Mon Sep 14 17:28:55 2009 -0400

    cgroup freezer: interface to freeze a cgroup from within the kernel
    
    Add public interface to freeze a cgroup freezer given a task that
    belongs to that cgroup:  cgroup_freezer_make_frozen(task)
    
    Freezing the root cgroup is not permitted. Freezing the cgroup to
    which current process belong is also not permitted.
    
    This will be used for restart(2) to be able to leave the restarted
    processes in a frozen state, instead of resuming execution.
    
    This is useful for debugging, if the user would like to attach a
    debugger to the restarted task(s).
    
    It is also useful if the restart procedure would like to perform
    additional setup once the tasks are restored but before they are
    allowed to proceed execution.
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>
    CC: Matt Helsley <matthltc at us.ibm.com>
    Cc: Paul Menage <menage at google.com>
    Cc: Li Zefan <lizf at cn.fujitsu.com>
    Cc: Cedric Le Goater <legoater at free.fr>

commit 8813defd5080f71cfe29ec5cb99288fbbe350dac
Author: Matt Helsley <matthltc at us.ibm.com>
Date:   Mon Sep 14 17:28:54 2009 -0400

    cgroup freezer: Add CHECKPOINTING state to safeguard container checkpoint
    
    The CHECKPOINTING state prevents userspace from unfreezing tasks until
    sys_checkpoint() is finished. When doing container checkpoint userspace
    will do:
    
    	echo FROZEN > /cgroups/my_container/freezer.state
    	...
    	rc = sys_checkpoint( <pid of container root> );
    
    To ensure a consistent checkpoint image userspace should not be allowed
    to thaw the cgroup (echo THAWED > /cgroups/my_container/freezer.state)
    during checkpoint.
    
    "CHECKPOINTING" can only be set on a "FROZEN" cgroup using the checkpoint
    system call. Once in the "CHECKPOINTING" state, the cgroup may not leave until
    the checkpoint system call is finished and ready to return. Then the
    freezer state returns to "FROZEN". Writing any new state to freezer.state while
    checkpointing will return EBUSY. These semantics ensure that userspace cannot
    unfreeze the cgroup midway through the checkpoint system call.
    
    The cgroup_freezer_begin_checkpoint() and cgroup_freezer_end_checkpoint()
    make relatively few assumptions about the task that is passed in. However the
    way they are called in do_checkpoint() assumes that the root of the container
    is in the same freezer cgroup as all the other tasks that will be
    checkpointed.
    
    Notes:
            As a side-effect this prevents the multiple tasks from entering the
            CHECKPOINTING state simultaneously. All but one will get -EBUSY.
    
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>
    Signed-off-by: Matt Helsley <matthltc at us.ibm.com>
    Cc: Paul Menage <menage at google.com>
    Cc: Li Zefan <lizf at cn.fujitsu.com>
    Cc: Cedric Le Goater <legoater at free.fr>

commit b23b7e151314f0b144b97bdeac47e0b3cfa2ffce
Author: Matt Helsley <matthltc at us.ibm.com>
Date:   Mon Sep 14 17:28:54 2009 -0400

    cgroup freezer: Update stale locking comments
    
    Update stale comments regarding locking order and add a little more detail
    so it's easier to follow the locking between the cgroup freezer and the
    power management freezer code.
    
    Signed-off-by: Matt Helsley <matthltc at us.ibm.com>
    Cc: Oren Laadan <orenl at cs.columbia.edu>
    Cc: Cedric Le Goater <legoater at free.fr>
    Cc: Paul Menage <menage at google.com>
    Cc: Li Zefan <lizf at cn.fujitsu.com>

commit 3d14abebf11d1743aa646a8955e94829b90ee7ba
Author: Matt Helsley <matthltc at us.ibm.com>
Date:   Mon Sep 14 17:28:53 2009 -0400

    cgroup freezer: Fix buggy resume test for tasks frozen with cgroup freezer
    
    When the cgroup freezer is used to freeze tasks we do not want to thaw
    those tasks during resume. Currently we test the cgroup freezer
    state of the resuming tasks to see if the cgroup is FROZEN.  If so
    then we don't thaw the task. However, the FREEZING state also indicates
    that the task should remain frozen.
    
    This also avoids a problem pointed out by Oren Ladaan: the freezer state
    transition from FREEZING to FROZEN is updated lazily when userspace reads
    or writes the freezer.state file in the cgroup filesystem. This means that
    resume will thaw tasks in cgroups which should be in the FROZEN state if
    there is no read/write of the freezer.state file to trigger this
    transition before suspend.
    
    NOTE: Another "simple" solution would be to always update the cgroup
    freezer state during resume. However it's a bad choice for several reasons:
    Updating the cgroup freezer state is somewhat expensive because it requires
    walking all the tasks in the cgroup and checking if they are each frozen.
    Worse, this could easily make resume run in N^2 time where N is the number
    of tasks in the cgroup. Finally, updating the freezer state from this code
    path requires trickier locking because of the way locks must be ordered.
    
    Instead of updating the freezer state we rely on the fact that lazy
    updates only manage the transition from FREEZING to FROZEN. We know that
    a cgroup with the FREEZING state may actually be FROZEN so test for that
    state too. This makes sense in the resume path even for partially-frozen
    cgroups -- those that really are FREEZING but not FROZEN.
    
    Reported-by: Oren Ladaan <orenl at cs.columbia.edu>
    Signed-off-by: Matt Helsley <matthltc at us.ibm.com>
    Cc: Cedric Le Goater <legoater at free.fr>
    Cc: Paul Menage <menage at google.com>
    Cc: Li Zefan <lizf at cn.fujitsu.com>
    Cc: Rafael J. Wysocki <rjw at sisk.pl>
    Cc: Pavel Machek <pavel at suse.cz>
    Cc: linux-pm at lists.linux-foundation.org
    
    Seems like a candidate for -stable.

commit ba1cbaf6e7bf36a04a9b9863e8a3c93c176293ca
Author: Serge E. Hallyn <serue at us.ibm.com>
Date:   Mon Sep 14 17:28:53 2009 -0400

    c/r: split core function out of some set*{u,g}id functions
    
    When restarting tasks, we want to be able to change xuid and
    xgid in a struct cred, and do so with security checks.  Break
    the core functionality of set{fs,res}{u,g}id into cred_setX
    which performs the access checks based on current_cred(),
    but performs the requested change on a passed-in cred.
    
    This will allow us to securely construct struct creds based
    on a checkpoint image, constrained by the caller's permissions,
    and apply them to the caller at the end of sys_restart().
    
    Signed-off-by: Serge E. Hallyn <serue at us.ibm.com>

commit a2d220c27be745067f2666bc56d0544aa07626e6
Author: Serge E. Hallyn <serue at us.ibm.com>
Date:   Mon Sep 14 17:28:52 2009 -0400

    c/r: break out new_user_ns()
    
    Break out the core function which checks privilege and (if
    allowed) creates a new user namespace, with the passed-in
    creating user_struct.  Note that a user_namespace, unlike
    other namespace pointers, is not stored in the nsproxy.
    Rather it is purely a property of user_structs.
    
    This will let us keep the task restore code simpler.
    
    Signed-off-by: Serge E. Hallyn <serue at us.ibm.com>

commit c075dcac8530aa040030a3c53a3fd5edf4fb7f12
Author: Alexey Dobriyan <adobriyan at gmail.com>
Date:   Mon Sep 14 17:28:50 2009 -0400

    x86: ptrace debugreg checks rewrite
    
    This is a mess.
    
    Pre unified-x86 code did check for breakpoint addr
    to be "< TASK_SIZE - 3 (or 7)". This was fine from security POV,
    but banned valid breakpoint usage when address is close to TASK_SIZE.
    E. g. 1-byte breakpoint at TASK_SIZE - 1 should be allowed, but it wasn't.
    
    Then came commit 84929801e14d968caeb84795bfbb88f04283fbd9
    ("[PATCH] x86_64: TASK_SIZE fixes for compatibility mode processes")
    which for some reason touched ptrace as well and made effective
    TASK_SIZE of 32-bit process depending on IA32_PAGE_OFFSET
    which is not a constant!:
    
    	#define IA32_PAGE_OFFSET ((current->personality & ADDR_LIMIT_3GB) ? 0xc0000000 : 0xFFFFe000)
    				   ^^^^^^^
    Maximum addr for breakpoint became dependent on personality of ptracer.
    
    Commit also relaxed danger zone for 32-bit processes from 8 bytes to 4
    not taking into account that 8-byte wide breakpoints are possible even
    for 32-bit processes. This was fine, however, because 64-bit kernel
    addresses are too far from 32-bit ones.
    
    Then came utrace with commit 2047b08be67b70875d8765fc81d34ce28041bec3
    ("x86: x86 ptrace getreg/putreg merge") which copy-pasted and ifdeffed 32-bit
    part of TASK_SIZE_OF() leaving 8-byte issue as-is.
    
    So, what patch fixes?
    1) Too strict logic near TASK_SIZE boundary -- as long as we don't cross
       TASK_SIZE_MAX, we're fine.
    2) Too smart logic of using breakpoints over non-existent kernel
       boundary -- we should only protect against setting up after
       TASK_SIZE_MAX, the rest is none of kernel business. This fixes
       IA32_PAGE_OFFSET beartrap as well.
    
    As a bonus, remove uberhack and big comment determining DR7 validness,
    rewrite with clear algorithm when it's obvious what's going on.
    
    Make DR validness checker suitable for C/R. On restart DR registers
    must be checked the same way they are checked on PTRACE_POKEUSR.
    
    Question 1: TIF_DEBUG can set even if none of breakpoints is turned on,
    should this be optimized?
    
    Question 2: Breakpoints are allowed to be globally enabled, is this a
    security risk?
    
    Signed-off-by: Alexey Dobriyan <adobriyan at gmail.com>

commit 7cbf5c83bdc6dce018ad5f2de74ab05e9d24af3b
Author: Alexey Dobriyan <adobriyan at gmail.com>
Date:   Mon Sep 14 17:28:49 2009 -0400

    c/r: extend arch_setup_additional_pages()
    
    Add "start" argument, to request to map vDSO to a specific place,
    and fail the operation if not.
    
    This is useful for restart(2) to ensure that memory layout is restore
    exactly as needed.
    
    Changelog[v2]:
      - [ntl] powerpc: vdso build fix (ckpt-v17)
    
    Signed-off-by: Alexey Dobriyan <adobriyan at gmail.com>
    Signed-off-by: Oren Laadan <orenl at cs.columbia.edu>

commit 74fca6a42863ffacaf7ba6f1936a9f228950f657
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Sep 9 15:13:59 2009 -0700

    Linux 2.6.31

commit 7135a71b19be1faf48b7148d77844d03bc0717d6
Author: Ed Cashin <ecashin at coraid.com>
Date:   Wed Sep 9 14:10:18 2009 +0200

    aoe: allocate unused request_queue for sysfs
    
    Andy Whitcroft reported an oops in aoe triggered by use of an
    incorrectly initialised request_queue object:
    
      [ 2645.959090] kobject '<NULL>' (ffff880059ca22c0): tried to add
    		an uninitialized object, something is seriously wrong.
      [ 2645.959104] Pid: 6, comm: events/0 Not tainted 2.6.31-5-generic #24-Ubuntu
      [ 2645.959107] Call Trace:
      [ 2645.959139] [<ffffffff8126ca2f>] kobject_add+0x5f/0x70
      [ 2645.959151] [<ffffffff8125b4ab>] blk_register_queue+0x8b/0xf0
      [ 2645.959155] [<ffffffff8126043f>] add_disk+0x8f/0x160
      [ 2645.959161] [<ffffffffa01673c4>] aoeblk_gdalloc+0x164/0x1c0 [aoe]
    
    The request queue of an aoe device is not used but can be allocated in
    code that does not sleep.
    
    Bruno bisected this regression down to
    
      cd43e26f071524647e660706b784ebcbefbd2e44
    
      block: Expose stacked device queues in sysfs
    
    "This seems to generate /sys/block/$device/queue and its contents for
     everyone who is using queues, not just for those queues that have a
     non-NULL queue->request_fn."
    
    Addresses http://bugs.launchpad.net/bugs/410198
    Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13942
    
    Note that embedding a queue inside another object has always been
    an illegal construct, since the queues are reference counted and
    must persist until the last reference is dropped. So aoe was
    always buggy in this respect (Jens).
    
    Signed-off-by: Ed Cashin <ecashin at coraid.com>
    Cc: Andy Whitcroft <apw at canonical.com>
    Cc: "Rafael J. Wysocki" <rjw at sisk.pl>
    Cc: Bruno Premont <bonbons at linux-vserver.org>
    Cc: Martin K. Petersen <martin.petersen at oracle.com>
    Cc: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Jens Axboe <jens.axboe at oracle.com>

commit e6890f6f3dc2d9024a08b1a149d9bd5208eea350
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Sep 8 17:09:24 2009 -0700

    i915: disable interrupts before tearing down GEM state
    
    Reinette Chatre reports a frozen system (with blinking keyboard LEDs)
    when switching from graphics mode to the text console, or when
    suspending (which does the same thing). With netconsole, the oops
    turned out to be
    
    	BUG: unable to handle kernel NULL pointer dereference at 0000000000000084
    	IP: [<ffffffffa03ecaab>] i915_driver_irq_handler+0x26b/0xd20 [i915]
    
    and it's due to the i915_gem.c code doing drm_irq_uninstall() after
    having done i915_gem_idle(). And the i915_gem_idle() path will do
    
      i915_gem_idle() ->
        i915_gem_cleanup_ringbuffer() ->
          i915_gem_cleanup_hws() ->
            dev_priv->hw_status_page = NULL;
    
    but if an i915 interrupt comes in after this stage, it may want to
    access that hw_status_page, and gets the above NULL pointer dereference.
    
    And since the NULL pointer dereference happens from within an interrupt,
    and with the screen still in graphics mode, the common end result is
    simply a silently hung machine.
    
    Fix it by simply uninstalling the irq handler before idling rather than
    after. Fixes
    
        http://bugzilla.kernel.org/show_bug.cgi?id=13819
    
    Reported-and-tested-by: Reinette Chatre <reinette.chatre at intel.com>
    Acked-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 7c8460db30dfd085ef3837c8fb02ecf2e718b983
Author: Zhenyu Wang <zhenyuw at linux.intel.com>
Date:   Tue Sep 8 14:52:25 2009 +0800

    drm/i915: fix mask bits setting
    
    eDP is exclusive connector too, and add missing crtc_mask
    setting for TV.
    
    This fixes
    
    	http://bugzilla.kernel.org/show_bug.cgi?id=14139
    
    Signed-off-by: Zhenyu Wang <zhenyuw at linux.intel.com>
    Reported-and-tested-by: Carlos R. Mafra <crmafra2 at gmail.com>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 3ff323f89075624b6891e7c428edb8e8a35be13c
Merge: 755ae761c5519929a97567d61a379b87352c337c a54775c8758a754186bc6adbfc518b1e9f8f1e4e
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Sep 7 11:42:25 2009 -0700

    Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6
    
    * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
      drm/radeon/kms: add LTE/GTE discard + rv515 two sided stencil register.

commit 755ae761c5519929a97567d61a379b87352c337c
Merge: 4886b5b485ec78fe4a16fedaccfab39bdf55410f acd0c935178649f72c44ec49ca83bee35ce1f79e
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Sep 7 11:41:15 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
      IMA: update ima_counts_put

commit 4886b5b485ec78fe4a16fedaccfab39bdf55410f
Merge: cbeb2864b162f4298111196c8ce8ce492577cdee d9d8e0418ffd3d189345c435861e254c17ae06e5
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Sep 7 11:40:24 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      gianfar: Fix build.

commit cbeb2864b162f4298111196c8ce8ce492577cdee
Merge: f69fb9c39868463f6b0b8306824341bd5610250b c9a2bfd1f08973115c2fc3da9372e0e81ac42a19
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Sep 7 11:40:15 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide-2.6:
      pcmcia: add CNF-CDROM-ID for ide

commit f69fb9c39868463f6b0b8306824341bd5610250b
Merge: e07cccf4046978df10f2e13fe2b99b2f9b3a65db 07fb6111e7af5fac6b6076e2658d0e32b67f713b
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Sep 7 11:38:30 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel:
      agp/intel: support for new chip variant of IGDNG mobile
      drm/i915: Unref old_obj on get_fence_reg() error path
      drm/i915: increase default latency constant (v2 w/comment)

commit a54775c8758a754186bc6adbfc518b1e9f8f1e4e
Author: Dave Airlie <airlied at redhat.com>
Date:   Mon Sep 7 15:26:19 2009 +1000

    drm/radeon/kms: add LTE/GTE discard + rv515 two sided stencil register.
    
    This adds some rv350+ register for LTE/GTE discard,
    and enables the rv515 two sided stencil register.
    It also disables the DEPTHXY_OFFSET register which
    can be used to workaround the CS checker.
    Moves rs690 to proper place in rs600 and uses correct
    table on rs600.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit acd0c935178649f72c44ec49ca83bee35ce1f79e
Author: Mimi Zohar <zohar at linux.vnet.ibm.com>
Date:   Fri Sep 4 13:08:46 2009 -0400

    IMA: update ima_counts_put
    
    - As ima_counts_put() may be called after the inode has been freed,
    verify that the inode is not NULL, before dereferencing it.
    
    - Maintain the IMA file counters in may_open() properly, decrementing
    any counter increments on subsequent errors.
    
    Reported-by: Ciprian Docan <docan at eden.rutgers.edu>
    Reported-by: J.R. Okajima <hooanon05 at yahoo.co.jp>
    Signed-off-by: Mimi Zohar <zohar at us.ibm.com>
    Acked-by: Eric Paris <eparis at redhat.com
    Signed-off-by: James Morris <jmorris at namei.org>

commit d9d8e0418ffd3d189345c435861e254c17ae06e5
Author: David S. Miller <davem at davemloft.net>
Date:   Sun Sep 6 01:41:02 2009 -0700

    gianfar: Fix build.
    
    Reported by Michael Guntsche <mike at it-loops.com>
    
    --------------------
    Commit
    38bddf04bcfe661fbdab94888c3b72c32f6873b3 gianfar: gfar_remove needs to call unregister_netdev()
    
    breaks the build of the gianfar driver because "dev" is undefined in
    this function. To quickly test rc9 I changed this to priv->ndev but I do
    not know if this is the correct one.
    --------------------
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit e07cccf4046978df10f2e13fe2b99b2f9b3a65db
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 16:38:12 2009 -0700

    Linux 2.6.31-rc9

commit f815c335d21f9965f8dbe142fd168aaba1baf98e
Merge: 74a01180db4bbfd61304ae0ba1f60af55ffc803d baed6b82d9f160184c1c14cdb4accb08f3eb6b87
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 14:59:00 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394-2.6:
      firewire: sbp2: fix freeing of unallocated memory
      firewire: ohci: fix Ricoh R5C832, video reception
      firewire: ohci: fix Agere FW643 and multiple cameras
      firewire: core: fix crash in iso resource management

commit 74a01180db4bbfd61304ae0ba1f60af55ffc803d
Author: Roderick Colenbrander <thunderbird2k at gmail.com>
Date:   Thu Sep 3 09:57:23 2009 -0600

    powerpc: Fix i8259 interrupt driver kernel crash on ML510
    
    This patch fixes a null pointer exception caused by removal of
    'ack()' for level interrupts in the Xilinx interrupt driver.  A recent
    change to the xilinx interrupt controller removed the ack hook for
    level irqs.
    
    Signed-off-by: Roderick Colenbrander <thunderbird2k at gmail.com>
    Signed-off-by: Grant Likely <grant.likely at secretlab.ca>
    Acked-by: Benjamin Herrenschmidt <benh at kernel.crashing.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 5136a6c0fd5b26bbf39ad761cf7a4fc563ad83a3
Merge: e505a8d5f96a84f3043ce0c4eaee8f045996896c bc8cec0dff072f1a45ce7f6b2c5234bb3411ac51
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 14:57:04 2009 -0700

    Merge git://git.infradead.org/~dwmw2/mtd-2.6.31
    
    * git://git.infradead.org/~dwmw2/mtd-2.6.31:
      JFFS2: add missing verify buffer allocation/deallocation
      mtd: nftl: fix offset alignments
      mtd: nftl: write support is broken
      mtd: m25p80: fix null pointer dereference bug

commit e505a8d5f96a84f3043ce0c4eaee8f045996896c
Merge: b71b7dc09abaeb4417c37b96a898096286b65e3c c295fc05789653ef24f296299df7c5f92fe74dce
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 14:56:13 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block
    
    * 'for-linus' of git://git.kernel.dk/linux-2.6-block:
      block: Allow changing max_sectors_kb above the default 512

commit b71b7dc09abaeb4417c37b96a898096286b65e3c
Merge: 59430c2f437767094298f30dd02ca038da0df755 92653453c3015c083b9fe0ad48261c6b2267d482
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 14:55:30 2009 -0700

    Merge branch 'fix/oxygen' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6
    
    * 'fix/oxygen' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
      sound: oxygen: handle cards with missing EEPROM
      sound: oxygen: fix MCLK rate for 192 kHz playback

commit 59430c2f437767094298f30dd02ca038da0df755
Merge: e9ee3a54a164c249a0a576c403eba367a6d97be5 16ebb5e0b36ceadc8186f71d68b0c4fa4b6e781b
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 14:52:41 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      tc: Fix unitialized kernel memory leak
      pkt_sched: Revert tasklet_hrtimer changes.
      net: sk_free() should be allowed right after sk_alloc()
      gianfar: gfar_remove needs to call unregister_netdev()
      ipw2200: firmware DMA loading rework

commit e9ee3a54a164c249a0a576c403eba367a6d97be5
Merge: 3bb314f01c189f0c48c0946424955c6d8ddce3d8 0c7d400fafaeab6014504a6a6249f01bac7f7db4
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 14:51:45 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
      crypto: skcipher - Fix skcipher_dequeue_givcrypt NULL test

commit 3bb314f01c189f0c48c0946424955c6d8ddce3d8
Merge: 535e0c1726bec699a8f0f5b86fe7d399546b2555 ce6c3997c2fce74d12e6d8887a1d8cdf024fa850
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 14:51:24 2009 -0700

    Merge branch 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq
    
    * 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq:
      [CPUFREQ] Re-enable cpufreq suspend and resume code

commit 535e0c1726bec699a8f0f5b86fe7d399546b2555
Merge: 0edfa2b1b5a5e1475e76dd3c792447687d966de4 5afe18d2f58812f3924edbd215464e5e3e8545e7
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 14:50:53 2009 -0700

    Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6
    
    * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
      [IA64] fix csum_ipv6_magic()
      [IA64] Fix warning in dma-mapping.c

commit 0edfa2b1b5a5e1475e76dd3c792447687d966de4
Merge: 5a09adf13067609d8ab9fcae11dc99fd0084e35c 3725867dccfb83e4b0cff64e916a04258f300591
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 14:25:14 2009 -0700

    Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
    
    * 'for-linus' of git://oss.sgi.com/xfs/xfs:
      xfs: actually enable the swapext compat handler

commit 5a09adf13067609d8ab9fcae11dc99fd0084e35c
Merge: 931f70350e9c298887c78e852d179ef7efcce304 b1f1b8ce0a1d71cbc72f7540134d52b79bd8f5ac
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 14:24:33 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2:
      nilfs2: fix preempt count underflow in nilfs_btnode_prepare_change_key

commit 931f70350e9c298887c78e852d179ef7efcce304
Merge: e305fc5ecd6420fadec5a8108852081fa2b89a17 04a13c7c632e1fe04a5f6e6c83565d2559e37598
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 14:22:00 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu:
      percpu: don't assume existence of cpu0

commit e305fc5ecd6420fadec5a8108852081fa2b89a17
Merge: 154f807e55977de75b1c12197c13ae14c28397b3 d76b1590e06a63a3d8697168cd0aabf1c4b3cb3a
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 13:57:53 2009 -0700

    Merge branch 'slab/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6
    
    * 'slab/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/penberg/slab-2.6:
      slub: Fix kmem_cache_destroy() with SLAB_DESTROY_BY_RCU

commit 154f807e55977de75b1c12197c13ae14c28397b3
Merge: 9b6a3df372f0318bb0ffe37ac5f4610fb9bdb44d ae0b7448e91353ea5f821601a055aca6b58042cd
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 13:51:07 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-2.6-dm
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-2.6-dm:
      dm snapshot: fix on disk chunk size validation
      dm exception store: split set_chunk_size
      dm snapshot: fix header corruption race on invalidation
      dm snapshot: refactor zero_disk_area to use chunk_io
      dm log: userspace add luid to distinguish between concurrent log instances
      dm raid1: do not allow log_failure variable to unset after being set
      dm log: remove incorrect field from userspace table output
      dm log: fix userspace status output
      dm stripe: expose correct io hints
      dm table: add more context to terse warning messages
      dm table: fix queue_limit checking device iterator
      dm snapshot: implement iterate devices
      dm multipath: fix oops when request based io fails when no paths

commit 9b6a3df372f0318bb0ffe37ac5f4610fb9bdb44d
Merge: d3acd16cda3a1cbaff7c579c0e054f0ece613d14 6faf17f6f1ffc586d16efc2f9fa2083a7785ee74
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 13:50:46 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
      PCI SR-IOV: correct broken resource alignment calculations

commit d3acd16cda3a1cbaff7c579c0e054f0ece613d14
Merge: 93697a3cabd3605c434a9b915c0272ad800b3f97 bd4352cadfacb9084c97c853b025fac010266c26
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 13:49:06 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
      sparc64: Fix bootup with mcount in some configs.
      sparc64: Kill spurious NMI watchdog triggers by increasing limit to 30 seconds.

commit 93697a3cabd3605c434a9b915c0272ad800b3f97
Merge: 63995344721be45b3fb3b76488b1b0a8c95def26 a3df6f7d3090e611bcc774cd2cba45ae016d37e1
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 13:48:37 2009 -0700

    Merge branch 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      perf_counter/powerpc: Fix cache event codes for POWER7
      perf_counter: Fix /0 bug in swcounters
      perf_counters: Increase paranoia level

commit 63995344721be45b3fb3b76488b1b0a8c95def26
Merge: 9de6886ec6e37f45807266a702bb7621498395ad 2bcaa6a4238094c5695d5b1943078388d82d3004
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 13:41:29 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
      Input: atkbd - add Compaq Presario R4000-series repeat quirk
      Input: i8042 - add Acer Aspire 5536 to the nomux list

commit 9de6886ec6e37f45807266a702bb7621498395ad
Author: Nicolas Pitre <nico at cam.org>
Date:   Sat Sep 5 00:25:37 2009 -0400

    ext2: fix unbalanced kmap()/kunmap()
    
    In ext2_rename(), dir_page is acquired through ext2_dotdot().  It is
    then released through ext2_set_link() but only if old_dir != new_dir.
    Failing that, the pkmap reference count is never decremented and the
    page remains pinned forever.  Repeat that a couple times with highmem
    pages and all pkmap slots get exhausted, and every further kmap() calls
    end up stalling on the pkmap_map_wait queue at which point the whole
    system comes to a halt.
    
    Signed-off-by: Nicolas Pitre <nico at marvell.com>
    Acked-by: Theodore Ts'o <tytso at mit.edu>
    Cc: stable at kernel.org
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit ac7ac9f2b9bfd9b68a1571d27e4c8bebb4788914
Merge: ac89a9174decf343de049a06fad75681f71890eb 8379e7c46cc48f51197dd663fc6676f47f2a1e71
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 13:38:37 2009 -0700

    Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2
    
    * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2:
      ocfs2: ocfs2_write_begin_nolock() should handle len=0
      ocfs2: invalidate dentry if its dentry_lock isn't initialized.

commit ac89a9174decf343de049a06fad75681f71890eb
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 13:27:10 2009 -0700

    pty: don't limit the writes to 'pty_space()' inside 'pty_write()'
    
    The whole write-room thing is something that is up to the _caller_ to
    worry about, not the pty layer itself.  The total buffer space will
    still be limited by the buffering routines themselves, so there is no
    advantage or need in having pty_write() artificially limit the size
    somehow.
    
    And what happened was that the caller (the n_tty line discipline, in
    this case) may have verified that there is room for 2 bytes to be
    written (for NL -> CRNL expansion), and it used to then do those writes
    as two single-byte writes.  And if the first byte written (CR) then
    caused a new tty buffer to be allocated, pty_space() may have returned
    zero when trying to write the second byte (LF), and then incorrectly
    failed the write - leading to a lost newline character.
    
    This should finally fix
    
    	http://bugzilla.kernel.org/show_bug.cgi?id=14015
    
    Reported-by: Mikael Pettersson <mikpe at it.uu.se>
    Acked-by: Alan Cox <alan at lxorguk.ukuu.org.uk>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 37f81fa1f63ad38e16125526bb2769ae0ea8d332
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Sep 5 12:46:07 2009 -0700

    n_tty: do O_ONLCR translation as a single write
    
    When translating CR to CRNL in the n_tty line discipline, we did it as
    two tty_put_char() calls.  Which works, but is stupid, and has caused
    problems before too with bad interactions with the write_room() logic.
    The generic USB serial driver had that problem, for example.
    
    Now the pty layer had similar issues after being moved to the generic
    tty buffering code (in commit d945cb9cce20ac7143c2de8d88b187f62db99bdc:
    "pty: Rework the pty layer to use the normal buffering logic").
    
    So stop doing the silly separate two writes, and do it as a single write
    instead.  That's what the n_tty layer already does for the space
    expansion of tabs (XTABS), and it means that we'll now always have just
    a single write for the CRNL to match the single 'tty_write_room()' test,
    which hopefully means that the next time somebody screws up buffering,
    it won't cause weeks of debugging.
    
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit a2a8474c3fff88d8dd52d05cb450563fb26fd26c
Author: Oleg Nesterov <oleg at redhat.com>
Date:   Sat Sep 5 11:17:13 2009 -0700

    exec: do not sleep in TASK_TRACED under ->cred_guard_mutex
    
    Tom Horsley reports that his debugger hangs when it tries to read
    /proc/pid_of_tracee/maps, this happens since
    
    	"mm_for_maps: take ->cred_guard_mutex to fix the race with exec"
    	04b836cbf19e885f8366bccb2e4b0474346c02d
    
    commit in 2.6.31.
    
    But the root of the problem lies in the fact that do_execve() path calls
    tracehook_report_exec() which can stop if the tracer sets PT_TRACE_EXEC.
    
    The tracee must not sleep in TASK_TRACED holding this mutex.  Even if we
    remove ->cred_guard_mutex from mm_for_maps() and proc_pid_attr_write(),
    another task doing PTRACE_ATTACH should not hang until it is killed or the
    tracee resumes.
    
    With this patch do_execve() does not use ->cred_guard_mutex directly and
    we do not hold it throughout, instead:
    
    	- introduce prepare_bprm_creds() helper, it locks the mutex
    	  and calls prepare_exec_creds() to initialize bprm->cred.
    
    	- install_exec_creds() drops the mutex after commit_creds(),
    	  and thus before tracehook_report_exec()->ptrace_stop().
    
    	  or, if exec fails,
    
    	  free_bprm() drops this mutex when bprm->cred != NULL which
    	  indicates install_exec_creds() was not called.
    
    Reported-by: Tom Horsley <tom.horsley at att.net>
    Signed-off-by: Oleg Nesterov <oleg at redhat.com>
    Acked-by: David Howells <dhowells at redhat.com>
    Cc: Roland McGrath <roland at redhat.com>
    Cc: James Morris <jmorris at namei.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit dd5d241ea955006122d76af88af87de73fec25b4
Author: Mel Gorman <mel at csn.ul.ie>
Date:   Sat Sep 5 11:17:11 2009 -0700

    page-allocator: always change pageblock ownership when anti-fragmentation is disabled
    
    On low-memory systems, anti-fragmentation gets disabled as fragmentation
    cannot be avoided on a sufficiently large boundary to be worthwhile.  Once
    disabled, there is a period of time when all the pageblocks are marked
    MOVABLE and the expectation is that they get marked UNMOVABLE at each call
    to __rmqueue_fallback().
    
    However, when MAX_ORDER is large the pageblocks do not change ownership
    because the normal criteria are not met.  This has the effect of
    prematurely breaking up too many large contiguous blocks.  This is most
    serious on NOMMU systems which depend on high-order allocations to boot.
    This patch causes pageblocks to change ownership on every fallback when
    anti-fragmentation is disabled.  This prevents the large blocks being
    prematurely broken up.
    
    This is a fix to commit 49255c619fbd482d704289b5eb2795f8e3b7ff2e [page
    allocator: move check for disabled anti-fragmentation out of fastpath] and
    the problem affects 2.6.31-rc8.
    
    Signed-off-by: Mel Gorman <mel at csn.ul.ie>
    Tested-by: Paul Mundt <lethal at linux-sh.org>
    Cc: David Howells <dhowells at redhat.com>
    Cc: Pekka Enberg <penberg at cs.helsinki.fi>
    Acked-by: Greg Ungerer <gerg at snapgear.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit a190887b58c32d19c2eee007c5eb8faa970a69ba
Author: David Howells <dhowells at redhat.com>
Date:   Sat Sep 5 11:17:07 2009 -0700

    nommu: fix error handling in do_mmap_pgoff()
    
    Fix the error handling in do_mmap_pgoff().  If do_mmap_shared_file() or
    do_mmap_private() fail, we jump to the error_put_region label at which
    point we cann __put_nommu_region() on the region - but we haven't yet
    added the region to the tree, and so __put_nommu_region() may BUG
    because the region tree is empty or it may corrupt the region tree.
    
    To get around this, we can afford to add the region to the region tree
    before calling do_mmap_shared_file() or do_mmap_private() as we keep
    nommu_region_sem write-locked, so no-one can race with us by seeing a
    transient region.
    
    Signed-off-by: David Howells <dhowells at redhat.com>
    Acked-by: Pekka Enberg <penberg at cs.helsinki.fi>
    Acked-by: Paul Mundt <lethal at linux-sh.org>
    Cc: Mel Gorman <mel at csn.ul.ie>
    Acked-by: Greg Ungerer <gerg at snapgear.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 4e49627b9bc29a14b393c480e8c979e3bc922ef7
Author: Oleg Nesterov <oleg at redhat.com>
Date:   Sat Sep 5 11:17:06 2009 -0700

    workqueues: introduce __cancel_delayed_work()
    
    cancel_delayed_work() has to use del_timer_sync() to guarantee the timer
    function is not running after return.  But most users doesn't actually
    need this, and del_timer_sync() has problems: it is not useable from
    interrupt, and it depends on every lock which could be taken from irq.
    
    Introduce __cancel_delayed_work() which calls del_timer() instead.
    
    The immediate reason for this patch is
    http://bugzilla.kernel.org/show_bug.cgi?id=13757
    but hopefully this helper makes sense anyway.
    
    As for 13757 bug, actually we need requeue_delayed_work(), but its
    semantics are not yet clear.
    
    Merge this patch early to resolves cross-tree interdependencies between
    input and infiniband.
    
    Signed-off-by: Oleg Nesterov <oleg at redhat.com>
    Cc: Dmitry Torokhov <dmitry.torokhov at gmail.com>
    Cc: Roland Dreier <rdreier at cisco.com>
    Cc: Stefan Richter <stefanr at s5r6.in-berlin.de>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit baed6b82d9f160184c1c14cdb4accb08f3eb6b87
Author: Stefan Richter <stefanr at s5r6.in-berlin.de>
Date:   Thu Sep 3 23:07:35 2009 +0200

    firewire: sbp2: fix freeing of unallocated memory
    
    If a target writes invalid status (typically status of a command that
    already timed out), firewire-sbp2 attempts to put away an ORB that
    doesn't exist.  https://bugzilla.redhat.com/show_bug.cgi?id=519772
    
    Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>

commit 4fe0badd5882c64dc2dcd8893f9b85db63339736
Author: Stefan Richter <stefanr at s5r6.in-berlin.de>
Date:   Fri Aug 28 13:26:03 2009 +0200

    firewire: ohci: fix Ricoh R5C832, video reception
    
    In dual-buffer DMA mode, no video frames are ever received from R5C832
    by libdc1394.  Fallback to packet-per-buffer DMA works reliably.
    http://thread.gmane.org/gmane.linux.kernel.firewire.devel/13393/focus=13476
    
    Reported-by: Jonathan Cameron <jic23 at cam.ac.uk>
    Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>

commit fc383796a8cc5df0a0c8633a16dd2e9528a16a63
Author: Stefan Richter <stefanr at s5r6.in-berlin.de>
Date:   Fri Aug 28 13:25:15 2009 +0200

    firewire: ohci: fix Agere FW643 and multiple cameras
    
    An Agere FW643 OHCI 1.1 card works fine for video reception from one
    camera but fails early if receiving from two cameras.  After a short
    while, no IR IRQ events occur and the context control register does not
    react anymore.  This happens regardless whether both IR DMA contexts are
    dual-buffer or one is dual-buffer and the other packet-per-buffer.
    
    This can be worked around by disabling dual buffer DMA mode entirely.
    http://sourceforge.net/mailarchive/message.php?msg_name=4A7C0594.2020208%40gmail.com
    (Reported by Samuel Audet.)
    
    In another report (by Jonathan Cameron), an FW643 works OK with two
    cameras in dual buffer mode.  Whether this is due to different chip
    revisions or different usage patterns (different video formats) is not
    yet clear.  However, as far as the current capabilities of
    firewire-core's isochronous I/O interface are concerned, simply
    switching off dual-buffer on non-working and working FW643s alike is not
    a problem in practice.  We only need to revisit this issue if we are
    going to enhance the interface, e.g. so that applications can explicitly
    choose modes.
    
    Reported-by: Samuel Audet <samuel.audet at gmail.com>
    Reported-by: Jonathan Cameron <jic23 at cam.ac.uk>
    Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>

commit 1821bc19d54009b6f5e6462dd79074d728080839
Author: Stefan Richter <stefanr at s5r6.in-berlin.de>
Date:   Sat Sep 5 13:23:49 2009 +0200

    firewire: core: fix crash in iso resource management
    
    This fixes a regression due to post 2.6.30 commit "firewire: core: do
    not DMA-map stack addresses" 6fdc03709433ccc2005f0f593ae9d9dd04f7b485.
    
    As David Moore noted, a previously correct sizeof() expression became
    wrong since the commit changed its argument from an array to a pointer.
    This resulted in an oops in ohci_cancel_packet in the shared workqueue
    thread's context when an isochronous resource was to be freed.
    
    Reported-by: Jonathan Cameron <jic23 at cam.ac.uk>
    Signed-off-by: Stefan Richter <stefanr at s5r6.in-berlin.de>

commit 8379e7c46cc48f51197dd663fc6676f47f2a1e71
Author: Sunil Mushran <sunil.mushran at oracle.com>
Date:   Fri Sep 4 11:12:01 2009 -0700

    ocfs2: ocfs2_write_begin_nolock() should handle len=0
    
    Bug introduced by mainline commit e7432675f8ca868a4af365759a8d4c3779a3d922
    The bug causes ocfs2_write_begin_nolock() to oops when len=0.
    
    Signed-off-by: Sunil Mushran <sunil.mushran at oracle.com>
    Cc: stable at kernel.org
    Signed-off-by: Joel Becker <joel.becker at oracle.com>

commit ae0b7448e91353ea5f821601a055aca6b58042cd
Author: Mikulas Patocka <mpatocka at redhat.com>
Date:   Fri Sep 4 20:40:43 2009 +0100

    dm snapshot: fix on disk chunk size validation
    
    Fix some problems seen in the chunk size processing when activating a
    pre-existing snapshot.
    
    For a new snapshot, the chunk size can either be supplied by the creator
    or a default value can be used.  For an existing snapshot, the
    chunk size in the snapshot header on disk should always be used.
    
    If someone attempts to load an existing snapshot and has the 'default
    chunk size' option set, the kernel uses its default value even when it
    is incorrect for the snapshot being loaded.  This patch ensures the
    correct on-disk value is always used.
    
    Secondly, when the code does use the chunk size stored on the disk it is
    prudent to revalidate it, so the code can exit cleanly if it got
    corrupted as happened in
    https://bugzilla.redhat.com/show_bug.cgi?id=461506 .
    
    Cc: stable at kernel.org
    Signed-off-by: Mikulas Patocka <mpatocka at redhat.com>
    Signed-off-by: Alasdair G Kergon <agk at redhat.com>

commit 2defcc3fb4661e7351cb2ac48d843efc4c64db13
Author: Mikulas Patocka <mpatocka at redhat.com>
Date:   Fri Sep 4 20:40:41 2009 +0100

    dm exception store: split set_chunk_size
    
    Break the function set_chunk_size to two functions in preparation for
    the fix in the following patch.
    
    Cc: stable at kernel.org
    Signed-off-by: Mikulas Patocka <mpatocka at redhat.com>
    Signed-off-by: Alasdair G Kergon <agk at redhat.com>

commit 61578dcd3fafe6babd72e8db32110cc0b630a432
Author: Mikulas Patocka <mpatocka at redhat.com>
Date:   Fri Sep 4 20:40:39 2009 +0100

    dm snapshot: fix header corruption race on invalidation
    
    If a persistent snapshot fills up, a race can corrupt the on-disk header
    which causes a crash on any future attempt to activate the snapshot
    (typically while booting).  This patch fixes the race.
    
    When the snapshot overflows, __invalidate_snapshot is called, which calls
    snapshot store method drop_snapshot. It goes to persistent_drop_snapshot that
    calls write_header. write_header constructs the new header in the "area"
    location.
    
    Concurrently, an existing kcopyd job may finish, call copy_callback
    and commit_exception method, that goes to persistent_commit_exception.
    persistent_commit_exception doesn't do locking, relying on the fact that
    callbacks are single-threaded, but it can race with snapshot invalidation and
    overwrite the header that is just being written while the snapshot is being
    invalidated.
    
    The result of this race is a corrupted header being written that can
    lead to a crash on further reactivation (if chunk_size is zero in the
    corrupted header).
    
    The fix is to use separate memory areas for each.
    
    See the bug: https://bugzilla.redhat.com/show_bug.cgi?id=461506
    
    Cc: stable at kernel.org
    Signed-off-by: Mikulas Patocka <mpatocka at redhat.com>
    Signed-off-by: Alasdair G Kergon <agk at redhat.com>

commit 02d2fd31defce6ff77146ad0fef4f19006055d86
Author: Mikulas Patocka <mpatocka at redhat.com>
Date:   Fri Sep 4 20:40:37 2009 +0100

    dm snapshot: refactor zero_disk_area to use chunk_io
    
    Refactor chunk_io to prepare for the fix in the following patch.
    
    Pass an area pointer to chunk_io and simplify zero_disk_area to use
    chunk_io.  No functional change.
    
    Cc: stable at kernel.org
    Signed-off-by: Mikulas Patocka <mpatocka at redhat.com>
    Signed-off-by: Alasdair G Kergon <agk at redhat.com>

commit 7ec23d50949d5062b5b749638dd9380ed75e58e5
Author: Jonathan Brassow <jbrassow at redhat.com>
Date:   Fri Sep 4 20:40:34 2009 +0100

    dm log: userspace add luid to distinguish between concurrent log instances
    
    Device-mapper userspace logs (like the clustered log) are
    identified by a universally unique identifier (UUID).  This
    identifier is used to associate requests from the kernel to
    a specific log in userspace.  The UUID must be unique everywhere,
    since multiple machines may use this identifier when communicating
    about a particular log, as is the case for cluster logs.
    
    Sometimes, device-mapper/LVM may re-use a UUID.  This is the
    case during pvmoves, when moving from one segment of an LV
    to another, or when resizing a mirror, etc.  In these cases,
    a new log is created with the same UUID and loaded in the
    "inactive" slot.  When a device-mapper "resume" is issued,
    the "live" table is deactivated and the new "inactive" table
    becomes "live".  (The "inactive" table can also be removed
    via a device-mapper 'clear' command.)
    
    The above two issues were colliding.  More than one log was being
    created with the same UUID, and there was no way to distinguish
    between them.  So, sometimes the wrong log would be swapped
    out during the exchange.
    
    The solution is to create a locally unique identifier,
    'luid', to go along with the UUID.  This new identifier is used
    to determine exactly which log is being referenced by the kernel
    when the log exchange is made.  The identifier is not
    universally safe, but it does not need to be, since
    create/destroy/suspend/resume operations are bound to a specific
    machine; and these are the operations that make up the exchange.
    
    Signed-off-by: Jonathan Brassow <jbrassow at redhat.com>
    Signed-off-by: Alasdair G Kergon <agk at redhat.com>

commit d2b698644c97cb033261536a4f2010924a00eac9
Author: Jonathan Brassow <jbrassow at redhat.com>
Date:   Fri Sep 4 20:40:32 2009 +0100

    dm raid1: do not allow log_failure variable to unset after being set
    
    This patch fixes a bug which was triggering a case where the primary leg
    could not be changed on failure even when the mirror was in-sync.
    
    The case involves the failure of the primary device along with
    the transient failure of the log device.  The problem is that
    bios can be put on the 'failures' list (due to log failure)
    before 'fail_mirror' is called due to the primary device failure.
    Normally, this is fine, but if the log device failure is transient,
    a subsequent iteration of the work thread, 'do_mirror', will
    reset 'log_failure'.  The 'do_failures' function then resets
    the 'in_sync' variable when processing bios on the failures list.
    The 'in_sync' variable is what is used to determine if the
    primary device can be switched in the event of a failure.  Since
    this has been reset, the primary device is incorrectly assumed
    to be not switchable.
    
    The case has been seen in the cluster mirror context, where one
    machine realizes the log device is dead before the other machines.
    As the responsibilities of the server migrate from one node to
    another (because the mirror is being reconfigured due to the failure),
    the new server may think for a moment that the log device is fine -
    thus resetting the 'log_failure' variable.
    
    In any case, it is inappropiate for us to reset the 'log_failure'
    variable.  The above bug simply illustrates that it can actually
    hurt us.
    
    Cc: stable at kernel.org
    Signed-off-by: Jonathan Brassow <jbrassow at redhat.com>
    Signed-off-by: Alasdair G Kergon <agk at redhat.com>

commit b8313b6da7e2e7c7f47d93d8561969a3ff9ba0ea
Author: Jonathan Brassow <jbrassow at redhat.com>
Date:   Fri Sep 4 20:40:30 2009 +0100

    dm log: remove incorrect field from userspace table output
    
    The output of 'dmsetup table' includes an internal field that should not
    be there.  This patch removes it.  To make the fix simpler, we first
    reorder a constructor argument
    
    The 'device size' argument is generated internally.  Currently it is
    placed as the last space-separated word of the constructor string.
    However, we need to use a version of the string without this word, so we
    move it to the beginning instead so it is trivial to skip past it.
    
    We keep a copy of the arguments passed to userspace for creating a log,
    just in case we need to resend them.  These are the same arguments that
    are desired in the STATUSTYPE_TABLE request, except for one.  When
    creating the userspace log, the userspace daemon must know the size of
    the mirror, so that is added to the arguments given in the constructor
    table.  We were printing this extra argument out as well, which is a
    mistake.
    
    Signed-off-by: Jonathan Brassow <jbrassow at redhat.com>
    Signed-off-by: Alasdair G Kergon <agk at redhat.com>

commit 4142a969175302bc843d1505133488bfdbfa4732
Author: Jonathan Brassow <jbrassow at redhat.com>
Date:   Fri Sep 4 20:40:28 2009 +0100

    dm log: fix userspace status output
    
    Fix 'dmsetup table' output.
    
    There is a missing ' ' at the end of the string causing two
    words to run together.
    
    Signed-off-by: Jonathan Brassow <jbrassow at redhat.com>
    Signed-off-by: Alasdair G Kergon <agk at redhat.com>

commit 40bea431274c247425e7f5970d796ff7b37a2b22
Author: Mike Snitzer <snitzer at redhat.com>
Date:   Fri Sep 4 20:40:25 2009 +0100

    dm stripe: expose correct io hints
    
    Set sensible I/O hints for striped DM devices in the topology
    infrastructure added for 2.6.31 for userspace tools to
    obtain via sysfs.
    
    Add .io_hints to 'struct target_type' to allow the I/O hints portion
    (io_min and io_opt) of the 'struct queue_limits' to be set by each
    target and implement this for dm-stripe.
    
    Signed-off-by: Mike Snitzer <snitzer at redhat.com>
    Signed-off-by: Alasdair G Kergon <agk at redhat.com>

commit a963a956225eb0f8c4d3537f428153c30adf54b8
Author: Mike Snitzer <snitzer at redhat.com>
Date:   Fri Sep 4 20:40:24 2009 +0100

    dm table: add more context to terse warning messages
    
    A couple of recent warning messages make it difficult for the reader to
    determine exactly what is wrong.  This patch adds more information to
    those messages.
    
    The messages were added by these commits:
      5dea271b6d87bd1d79a59c1d5baac2596a841c37 ("dm table: pass correct dev area size
    to device_area_is_valid")
      ea9df47cc92573b159ef3b4fda516c32cba9c4fd ("dm table: fix blk_stack_limits arg
    to use bytes not sectors")
    
    The patch also corrects references to logical_block_size in printk format
    strings from %hu to %u.
    
    Signed-off-by: Mike Snitzer <snitzer at redhat.com>
    Signed-off-by: Alasdair G Kergon <agk at redhat.com>

commit f6a1ed10864b7540fa758bbccf3433fe17070329
Author: Mikulas Patocka <mpatocka at redhat.com>
Date:   Fri Sep 4 20:40:22 2009 +0100

    dm table: fix queue_limit checking device iterator
    
    The logic to check for valid device areas is inverted relative to proper
    use with iterate_devices.
    
    The iterate_devices method calls its callback for every underlying
    device in the target.  If any callback returns non-zero, iterate_devices
    exits immediately.  But the callback device_area_is_valid() returns 0 on
    error and 1 on success.  The overall effect without is that an error is
    issued only if every device is invalid.
    
    This patch renames device_area_is_valid to device_area_is_invalid and
    inverts the logic so that one invalid device is sufficient to raise
    an error.
    
    Signed-off-by: Mikulas Patocka <mpatocka at redhat.com>
    Signed-off-by: Mike Snitzer <snitzer at redhat.com>
    Signed-off-by: Alasdair G Kergon <agk at redhat.com>

commit 8811f46c1f9386fc7017150de9d52359e5b1826e
Author: Mike Snitzer <snitzer at redhat.com>
Date:   Fri Sep 4 20:40:19 2009 +0100

    dm snapshot: implement iterate devices
    
    Implement the .iterate_devices for the origin and snapshot targets.
    dm-snapshot's lack of .iterate_devices resulted in the inability to
    properly establish queue_limits for both targets.
    
    With 4K sector drives: an unfortunate side-effect of not establishing
    proper limits in either targets' DM device was that IO to the devices
    would fail even though both had been created without error.
    
    Commit af4874e03ed82f050d5872d8c39ce64bf16b5c38 ("dm target:s introduce
    iterate devices fn") in 2.6.31-rc1 should have implemented .iterate_devices
    for dm-snap.c's origin and snapshot targets.
    
    Signed-off-by: Mike Snitzer <snitzer at redhat.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Alasdair G Kergon <agk at redhat.com>

commit a77e28c7e1dc1a6a035c7627d4a88ecf3ea09aea
Author: Kiyoshi Ueda <k-ueda at ct.jp.nec.com>
Date:   Fri Sep 4 20:40:16 2009 +0100

    dm multipath: fix oops when request based io fails when no paths
    
    The patch posted at http://marc.info/?l=dm-devel&m=124539787228784&w=2
    which was merged into cec47e3d4a861e1d942b3a580d0bbef2700d2bb2 ("dm:
    prepare for request based option") introduced a regression in
    request-based dm.
    
    If map_request() calls dm_kill_unmapped_request() to complete a cloned
    bio without dispatching it, clone->bio is still set when
    dm_end_request() is called and the BUG_ON(clone->bio) is incorrect.
    
    The patch fixes this bug by freeing bio in dm_end_request() if the clone
    has bio.  I've redone my tests to cover all I/O paths and confirmed
    there's no other regression.
    
    Here is the oops I hit in request-based dm when I do I/O to a multipath
    device which doesn't have any active path nor queue_if_no_path setting:
    
    ------------[ cut here ]------------
    kernel BUG at /root/2.6.31-rc4.rqdm/drivers/md/dm.c:828!
    invalid opcode: 0000 [#1] SMP
    last sysfs file: /sys/devices/system/cpu/cpu3/cache/index2/shared_cpu_map
    CPU 1
    Modules linked in: autofs4 sunrpc cpufreq_ondemand acpi_cpufreq dm_mirror dm_region_hash dm_log dm_service_time dm_multipath scsi_dh dm_mod video output sbs sbshc battery ac sg sr_mod e1000e button cdrom serio_raw rtc_cmos rtc_core rtc_lib piix lpfc scsi_transport_fc ata_piix libata megaraid_sas sd_mod scsi_mod crc_t10dif ext3 jbd uhci_hcd ohci_hcd ehci_hcd [last unloaded: microcode]
    Pid: 7, comm: ksoftirqd/1 Not tainted 2.6.31-rc4.rqdm #1 Express5800/120Lj [N8100-1417]
    RIP: 0010:[<ffffffffa023629d>]  [<ffffffffa023629d>] dm_softirq_done+0xbd/0x100 [dm_mod]
    RSP: 0018:ffff8800280a1f08  EFLAGS: 00010282
    RAX: ffffffffa02544e0 RBX: ffff8802aa1111d0 RCX: ffff8802aa1111e0
    RDX: ffff8802ab913e70 RSI: 0000000000000000 RDI: ffff8802ab913e70
    RBP: ffff8800280a1f28 R08: ffffc90005457040 R09: 0000000000000000
    R10: 0000000000000001 R11: 0000000000000000 R12: 00000000fffffffb
    R13: ffff8802ab913e88 R14: ffff8802ab9c1438 R15: 0000000000000100
    FS:  0000000000000000(0000) GS:ffff88002809e000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0018 ES: 0018 CR0: 000000008005003b
    CR2: 0000003d54a98640 CR3: 000000029f0a1000 CR4: 00000000000006e0
    DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    Process ksoftirqd/1 (pid: 7, threadinfo ffff8802ae50e000, task ffff8802ae4f8040)
    Stack:
     ffff8800280a1f38 0000000000000020 ffffffff814f30a0 0000000000000004
    <0> ffff8800280a1f58 ffffffff8116b245 ffff8800280a1f38 ffff8800280a1f38
    <0> ffff8800280a1f58 0000000000000001 ffff8800280a1fa8 ffffffff810477bc
    Call Trace:
     <IRQ>
     [<ffffffff8116b245>] blk_done_softirq+0x75/0x90
     [<ffffffff810477bc>] __do_softirq+0xcc/0x210
     [<ffffffff81047170>] ? ksoftirqd+0x0/0x110
     [<ffffffff8100ce7c>] call_softirq+0x1c/0x50
     <EOI>
     [<ffffffff8100e785>] do_softirq+0x65/0xa0
     [<ffffffff81047170>] ? ksoftirqd+0x0/0x110
     [<ffffffff810471e0>] ksoftirqd+0x70/0x110
     [<ffffffff81059559>] kthread+0x99/0xb0
     [<ffffffff8100cd7a>] child_rip+0xa/0x20
     [<ffffffff8100c73c>] ? restore_args+0x0/0x30
     [<ffffffff810594c0>] ? kthread+0x0/0xb0
     [<ffffffff8100cd70>] ? child_rip+0x0/0x20
    Code: 44 89 e6 48 89 df e8 23 fb f2 e0 be 01 00 00 00 4c 89 f7 e8 f6 fd ff ff 5b 41 5c 41 5d 41 5e c9 c3 4c 89 ef e8 85 fe ff ff eb ed <0f> 0b eb fe 41 8b 85 dc 00 00 00 48 83 bb 10 01 00 00 00 89 83
    RIP  [<ffffffffa023629d>] dm_softirq_done+0xbd/0x100 [dm_mod]
     RSP <ffff8800280a1f08>
    ---[ end trace 16af0a1d8542da55 ]---
    
    Signed-off-by: Kiyoshi Ueda <k-ueda at ct.jp.nec.com>
    Signed-off-by: Jun'ichi Nomura <j-nomura at ce.jp.nec.com>
    Signed-off-by: Alasdair G Kergon <agk at redhat.com>

commit bd4352cadfacb9084c97c853b025fac010266c26
Author: David S. Miller <davem at davemloft.net>
Date:   Fri Sep 4 03:38:54 2009 -0700

    sparc64: Fix bootup with mcount in some configs.
    
    Functions invoked early when booting up a cpu can't use
    tracing because mcount requires a valid 'current_thread_info()'
    and TLB mappings to be setup.
    
    The code path of sun4v_register_mondo_queues --> register_one_mondo
    is one such case.  sun4v_register_mondo_queues already has the
    necessary 'notrace' annotation, but register_one_mondo does not.
    
    Normally register_one_mondo is inlined so the bug doesn't trigger,
    but with some config/compiler combinations, it won't be so we
    must properly mark it notrace.
    
    While we're here, add 'notrace' annoations to prom_printf and
    prom_halt so that early error handling won't have the same problem.
    
    Reported-by: Alexander Beregalov <a.beregalov at gmail.com>
    Reported-by: Leif Sawyer <lsawyer at gci.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 2bcaa6a4238094c5695d5b1943078388d82d3004
Author: Dave Andrews <jetdog330 at hotmail.com>
Date:   Thu Sep 3 17:21:27 2009 -0700

    Input: atkbd - add Compaq Presario R4000-series repeat quirk
    
    Compaq Presario R4000-series laptops are not sending a "volume up button
    release" and "volume down button release" signal in the PS/2 protocol for
    atkbd. The URL below has some of confirmed reports:
    
    https://bugs.launchpad.net/ubuntu/+source/linux/+bug/385477
    
    Signed-off-by: Dave Andrews <jetdog330 at hotmail.com>
    Signed-off-by: Dmitry Torokhov <dtor at mail.ru>

commit d76b1590e06a63a3d8697168cd0aabf1c4b3cb3a
Author: Eric Dumazet <eric.dumazet at gmail.com>
Date:   Thu Sep 3 22:38:59 2009 +0300

    slub: Fix kmem_cache_destroy() with SLAB_DESTROY_BY_RCU
    
    kmem_cache_destroy() should call rcu_barrier() *after* kmem_cache_close() and
    *before* sysfs_slab_remove() or risk rcu_free_slab() being called after
    kmem_cache is deleted (kfreed).
    
    rmmod nf_conntrack can crash the machine because it has to kmem_cache_destroy()
    a SLAB_DESTROY_BY_RCU enabled cache.
    
    Cc: <stable at kernel.org>
    Reported-by: Zdenek Kabelac <zdenek.kabelac at gmail.com>
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    Acked-by: Paul E. McKenney <paulmck at linux.vnet.ibm.com>
    Signed-off-by: Pekka Enberg <penberg at cs.helsinki.fi>

commit bc8cec0dff072f1a45ce7f6b2c5234bb3411ac51
Author: Massimo Cirillo <maxcir at gmail.com>
Date:   Thu Aug 27 10:44:09 2009 +0200

    JFFS2: add missing verify buffer allocation/deallocation
    
    The function jffs2_nor_wbuf_flash_setup() doesn't allocate the verify buffer
    if CONFIG_JFFS2_FS_WBUF_VERIFY is defined, so causing a kernel panic when
    that macro is enabled and the verify function is called. Similarly the
    jffs2_nor_wbuf_flash_cleanup() must free the buffer if
    CONFIG_JFFS2_FS_WBUF_VERIFY is enabled.
    The following patch fixes the problem.
    The following patch applies to 2.6.30 kernel.
    
    Signed-off-by: Massimo Cirillo <maxcir at gmail.com>
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy at nokia.com>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
    Cc: stable at kernel.org

commit 16f05c2b68520f94e365f9d347a7076f4ff00ad5
Author: Dimitri Gorokhovik <dimitri.gorokhovik at free.fr>
Date:   Thu Sep 3 14:04:22 2009 +0100

    mtd: nftl: fix offset alignments
    
    Arithmetic conversion in the mask computation makes the upper word
    of the second argument passed down to mtd->read_oob(), be always 0
    (assuming 'offs' being a 64-bit signed long long type, and
    'mtd->writesize' being a 32-bit unsigned int type).
    
    This patch applies over the other one adding masking in nftl_write,
    "nftl: write support is broken".
    
    Signed-off-by: Dimitri Gorokhovik <dimitri.gorokhovik at free.fr>
    Cc: Tim Gardner <tim.gardner at canonical.com>
    Cc: Scott James Remnant <scott at canonical.com>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>

commit 4149ed1aa944ab864024982a2e568d17eccff504
Author: Dimitri Gorokhovik <dimitri.gorokhovik at free.fr>
Date:   Thu Sep 3 14:59:13 2009 +0100

    mtd: nftl: write support is broken
    
    Write support is broken in NFTL. Fix it.
    
    Signed-off-by: <dimitri.gorokhovik at free.fr>
    Cc: Tim Gardner <tim.gardner at canonical.com>
    Cc: Scott James Remnant <scott at canonical.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>

commit edcb3b14863e1a6aa1923eeaa81125a00cf51a80
Author: Anton Vorontsov <avorontsov at ru.mvista.com>
Date:   Thu Aug 6 15:18:37 2009 -0700

    mtd: m25p80: fix null pointer dereference bug
    
    This patch fixes the following oops, observed with MTD_PARTITIONS=n:
    
    m25p80 spi32766.0: m25p80 (1024 Kbytes)
    Unable to handle kernel paging request for data at address 0x00000008
    Faulting instruction address: 0xc03a54b0
    Oops: Kernel access of bad area, sig: 11 [#1]
    Modules linked in:
    NIP: c03a54b0 LR: c03a5494 CTR: c01e98b8
    REGS: ef82bb60 TRAP: 0300   Not tainted  (2.6.31-rc4-00167-g4733fd3)
    MSR: 00029000 <EE,ME,CE>  CR: 24022022  XER: 20000000
    DEAR: 00000008, ESR: 00000000
    TASK = ef82c000[1] 'swapper' THREAD: ef82a000
    GPR00: 00000000 ef82bc10 ef82c000 0000002e 00001eb8 ffffffff c01e9824 00000036
    GPR08: c054ed40 c0542a08 00001eb8 00004000 22022022 1001a1a0 3ff8fd00 00000000
    GPR16: 00000000 00000001 00000000 00000000 ef82bddc c0530000 efbef500 ef8356d0
    GPR24: 00000000 ef8356d0 00000000 efbf7a00 c0530ec4 ffffffed efbf5300 c0541f98
    NIP [c03a54b0] m25p_probe+0x22c/0x354
    LR [c03a5494] m25p_probe+0x210/0x354
    Call Trace:
    [ef82bc10] [c03a5494] m25p_probe+0x210/0x354 (unreliable)
    [ef82bca0] [c024e37c] spi_drv_probe+0x2c/0x3c
    [ef82bcb0] [c01f1afc] driver_probe_device+0xa4/0x178
    [ef82bcd0] [c01f06e8] bus_for_each_drv+0x6c/0xa8
    [ef82bd00] [c01f1a34] device_attach+0x84/0xa8
    ...
    
    Signed-off-by: Anton Vorontsov <avorontsov at ru.mvista.com>
    Cc: David Brownell <david-b at pacbell.net>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy at nokia.com>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>

commit e6617c6ec28a17cf2f90262b835ec05b9b861400
Author: David S. Miller <davem at davemloft.net>
Date:   Thu Sep 3 02:35:20 2009 -0700

    sparc64: Kill spurious NMI watchdog triggers by increasing limit to 30 seconds.
    
    This is a compromise and a temporary workaround for bootup NMI
    watchdog triggers some people see with qla2xxx devices present.
    
    This happens when, for example:
    
    CPU 0 is in the driver init and looping submitting mailbox commands to
    load the firmware, then waiting for completion.
    
    CPU 1 is receiving the device interrupts.  CPU 1 is where the NMI
    watchdog triggers.
    
    CPU 0 is submitting mailbox commands fast enough that by the time CPU
    1 returns from the device interrupt handler, a new one is pending.
    This sequence runs for more than 5 seconds.
    
    The problematic case is CPU 1's timer interrupt running when the
    barrage of device interrupts begin.  Then we have:
    
    	timer interrupt
    	return for softirq checking
    	pending, thus enable interrupts
    
    		 qla2xxx interrupt
    		 return
    		 qla2xxx interrupt
    		 return
    		 ... 5+ seconds pass
    		 final qla2xxx interrupt for fw load
    		 return
    
    	run timer softirq
    	return
    
    At some point in the multi-second qla2xxx interrupt storm we trigger
    the NMI watchdog on CPU 1 from the NMI interrupt handler.
    
    The timer softirq, once we get back to running it, is smart enough to
    run the timer work enough times to make up for the missed timer
    interrupts.
    
    However, the NMI watchdogs (both x86 and sparc) use the timer
    interrupt count to notice the cpu is wedged.  But in the above
    scenerio we'll receive only one such timer interrupt even if we last
    all the way back to running the timer softirq.
    
    The default watchdog trigger point is only 5 seconds, which is pretty
    low (the softwatchdog triggers at 60 seconds).  So increase it to 30
    seconds for now.
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit a3df6f7d3090e611bcc774cd2cba45ae016d37e1
Author: Paul Mackerras <paulus at samba.org>
Date:   Thu Sep 3 11:52:02 2009 +1000

    perf_counter/powerpc: Fix cache event codes for POWER7
    
    I had the codes for L1 D-cache load accesses and misses swapped
    around, and the wrong codes for LL-cache accesses and misses.
    This corrects them.
    
    Reported-by: Corey Ashford <cjashfor at linux.vnet.ibm.com>
    Signed-off-by: Paul Mackerras <paulus at samba.org>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: <stable at kernel.org>
    LKML-Reference: <19103.8514.709300.585484 at cargo.ozlabs.ibm.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 16ebb5e0b36ceadc8186f71d68b0c4fa4b6e781b
Author: Eric Dumazet <eric.dumazet at gmail.com>
Date:   Wed Sep 2 02:40:09 2009 +0000

    tc: Fix unitialized kernel memory leak
    
    Three bytes of uninitialized kernel memory are currently leaked to user
    
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    Reviewed-by: Jiri Pirko <jpirko at redhat.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 92653453c3015c083b9fe0ad48261c6b2267d482
Author: Clemens Ladisch <clemens at ladisch.de>
Date:   Wed Sep 2 18:25:39 2009 +0200

    sound: oxygen: handle cards with missing EEPROM
    
    The card model detection code introduced in 2.6.30 that tries to work
    around partially broken EEPROM contents by reading the EEPROM directly
    does not handle cards where the EEPROM has been omitted.  In this case,
    we have to use the default ID to allow the driver to load.
    
    Signed-off-by: Clemens Ladisch <clemens at ladisch.de>
    Reported-and-tested-by: Ozan Çağlayan <ozan at pardus.org.tr>
    Cc: <stable at kernel.org>
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

commit 07fb6111e7af5fac6b6076e2658d0e32b67f713b
Author: Zhenyu Wang <zhenyuw at linux.intel.com>
Date:   Thu Aug 13 18:57:29 2009 +0800

    agp/intel: support for new chip variant of IGDNG mobile
    
    New variant of IGDNG mobile chip has new host bridge id.
    
    [anholt: Note that this new PCI ID doesn't impact the DRM, which doesn't
    care about the PCI ID of the bridge]
    
    Signed-off-by: Zhenyu Wang <zhenyuw at linux.intel.com>
    Signed-off-by: Eric Anholt <eric at anholt.net>

commit 58c2fb647a3cf70a90d7b33a3f2a8396a20a0bc4
Author: Chris Wilson <chris at chris-wilson.co.uk>
Date:   Tue Sep 1 12:02:39 2009 +0100

    drm/i915: Unref old_obj on get_fence_reg() error path
    
    Remember to release the local reference if we fail to wait on
    the rendering.
    
    (Also whilst in the vicinity add some whitespace so that the phasing of
    the operations is clearer.)
    
    Signed-off-by: Chris Wilson <chris at chris-wilson.co.uk>
    Signed-off-by: Eric Anholt <eric at anholt.net>

commit bcc24fb42585dc9f490cf7789a917358414bdab5
Author: Jesse Barnes <jbarnes at virtuousgeek.org>
Date:   Mon Aug 31 10:24:31 2009 -0700

    drm/i915: increase default latency constant (v2 w/comment)
    
    Some i915/i945 platforms have a fairly high memory latency in certain
    situations, so increase our constant a bit to avoid FIFO underruns.
    The effect should be positive on other platforms as well; we'll have a
    bit more insurance against a busy memory subsystem due to the extra
    FIFO entries.
    
    Fixes fdo bug #23368.  Needed for 2.6.31.
    
    Tested-by: Sven Arvidsson <sa at whiz.se>
    Tested-by: Chris Wilson <chris at chris-wilson.co.uk>
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    Signed-off-by: Eric Anholt <eric at anholt.net>

commit 5afe18d2f58812f3924edbd215464e5e3e8545e7
Author: Jiri Bohac <jbohac at suse.cz>
Date:   Wed Sep 2 11:00:46 2009 +0200

    [IA64] fix csum_ipv6_magic()
    
    The 32-bit parameters (len and csum) of csum_ipv6_magic() are passed in 64-bit
    registers in2 and in4. The high order 32 bits of the registers were never
    cleared, and garbage was sometimes calculated into the checksum.
    
    Fix this by clearing the high order 32 bits of these registers.
    
    Signed-off-by: Jiri Bohac <jbohac at suse.cz>
    Signed-off-by: Tony Luck <tony.luck at intel.com>

commit f2486f26692433ba27cc10991a085b503b0422a3
Author: Luck, Tony <tony.luck at intel.com>
Date:   Mon Aug 31 16:54:03 2009 -0700

    [IA64] Fix warning in dma-mapping.c
    
    arch/ia64/kernel/dma-mapping.c:14: warning: control reaches end of non-void function
    arch/ia64/kernel/dma-mapping.c:14: warning: no return statement in function returning non-void
    
    This warning was introduced by commit: 390bd132b2831a2ad0268e84bffbfc0680debfe5
    	Add dma_debug_init() for ia64
    
    Signed-off-by: Tony Luck <tony.luck at intel.com>

commit 2fbd3da3877ad8d923b055e5996f80b4d4a6daf4
Author: David S. Miller <davem at davemloft.net>
Date:   Tue Sep 1 17:59:25 2009 -0700

    pkt_sched: Revert tasklet_hrtimer changes.
    
    These are full of unresolved problems, mainly that conversions don't
    work 1-1 from hrtimers to tasklet_hrtimers because unlike hrtimers
    tasklets can't be killed from softirq context.
    
    And when a qdisc gets reset, that's exactly what we need to do here.
    
    We'll work this out in the net-next-2.6 tree and if warranted we'll
    backport that work to -stable.
    
    This reverts the following 3 changesets:
    
    a2cb6a4dd470d7a64255a10b843b0d188416b78f
    ("pkt_sched: Fix bogon in tasklet_hrtimer changes.")
    
    38acce2d7983632100a9ff3fd20295f6e34074a8
    ("pkt_sched: Convert CBQ to tasklet_hrtimer.")
    
    ee5f9757ea17759e1ce5503bdae2b07e48e32af9
    ("pkt_sched: Convert qdisc_watchdog to tasklet_hrtimer")
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit d66ee0587c3927aea5178a822976c7c853d815fe
Author: Jarek Poplawski <jarkao2 at gmail.com>
Date:   Sun Aug 30 23:15:36 2009 +0000

    net: sk_free() should be allowed right after sk_alloc()
    
    After commit 2b85a34e911bf483c27cfdd124aeb1605145dc80
    (net: No more expensive sock_hold()/sock_put() on each tx)
    sk_free() frees socks conditionally and depends
    on sk_wmem_alloc being set e.g. in sock_init_data(). But in some
    cases sk_free() is called earlier, usually after other alloc errors.
    
    Fix is to move sk_wmem_alloc initialization from sock_init_data()
    to sk_alloc() itself.
    
    Signed-off-by: Jarek Poplawski <jarkao2 at gmail.com>
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 3725867dccfb83e4b0cff64e916a04258f300591
Author: Christoph Hellwig <hch at infradead.org>
Date:   Tue Sep 1 14:03:08 2009 -0400

    xfs: actually enable the swapext compat handler
    
    Fix a small typo in the compat ioctl handler that cause the swapext
    compat handler to never be called.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Torsten Kaiser <just.for.lkml at googlemail.com>
    Tested-by: Torsten Kaiser <just.for.lkml at googlemail.com>
    Reviewed-by: Eric Sandeen <sandeen at sandeen.net>
    Reviewed-by: Felix Blyakher <felixb at sgi.com>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit c295fc05789653ef24f296299df7c5f92fe74dce
Author: Nikanth Karthikesan <knikanth at suse.de>
Date:   Tue Sep 1 22:40:15 2009 +0200

    block: Allow changing max_sectors_kb above the default 512
    
    The patch "block: Use accessor functions for queue limits"
    (ae03bf639a5027d27270123f5f6e3ee6a412781d) changed queue_max_sectors_store()
    to use blk_queue_max_sectors() instead of directly assigning the value.
    
    But blk_queue_max_sectors() differs a bit
    1. It sets both max_sectors_kb, and max_hw_sectors_kb
    2. Never allows one to change max_sectors_kb above BLK_DEF_MAX_SECTORS. If one
    specifies a value greater then max_hw_sectors is set to that value but
    max_sectors is set to BLK_DEF_MAX_SECTORS
    
    I am not sure whether blk_queue_max_sectors() should be changed, as it seems
    to be that way for a long time. And there may be callers dependent on that
    behaviour.
    
    This patch simply reverts to the older way of directly assigning the value to
    max_sectors as it was before.
    
    Signed-off-by: Nikanth Karthikesan <knikanth at suse.de>
    Signed-off-by: Jens Axboe <jens.axboe at oracle.com>

commit ce6c3997c2fce74d12e6d8887a1d8cdf024fa850
Author: Dominik Brodowski <linux at dominikbrodowski.net>
Date:   Fri Aug 7 22:58:51 2009 +0200

    [CPUFREQ] Re-enable cpufreq suspend and resume code
    
    Commit 4bc5d3413503 is broken and causes regressions:
    
    (1) cpufreq_driver->resume() and ->suspend() were only called on
    __powerpc__, but you could set them on all architectures. In fact,
    ->resume() was defined and used before the PPC-related commit
    42d4dc3f4e1e complained about in 4bc5d3413503.
    
    (2) Therfore, the resume functions in acpi_cpufreq and speedstep-smi
    would never be called.
    
    (3) This means speedstep-smi would be unusuable after suspend or resume.
    
    The _real_ problem was calling cpufreq_driver->get() with interrupts
    off, but it re-enabling interrupts on some platforms. Why is ->get()
    necessary?
    
    Some systems like to change the CPU frequency behind our
    back, especially during BIOS-intensive operations like suspend or
    resume. If such systems also use a CPU frequency-dependant timing loop,
    delays might be off by large factors. Therefore, we need to ascertain
    as soon as possible that the CPU frequency is indeed at the speed we
    think it is. You can do this two ways: either setting it anew, or trying
    to get it. The latter is what was done, the former also has the same IRQ
    issue.
    
    So, let's try something different: defer the checking to after interrupts
    are re-enabled, by calling cpufreq_update_policy() (via schedule_work()).
    Timings may be off until this later stage, so let's watch out for
    resume regressions caused by the deferred handling of frequency changes
    behind the kernel's back.
    
    Signed-off-by: Dominik Brodowski <linux at dominikbrodowski.net>
    Signed-off-by: Dave Jones <davej at redhat.com>

commit 04a13c7c632e1fe04a5f6e6c83565d2559e37598
Author: Tejun Heo <tj at kernel.org>
Date:   Tue Sep 1 21:12:28 2009 +0900

    percpu: don't assume existence of cpu0
    
    percpu incorrectly assumed that cpu0 was always there which led to the
    following warning and eventual oops on sparc machines w/o cpu0.
    
      WARNING: at mm/percpu.c:651 pcpu_map+0xdc/0x100()
      Modules linked in:
      Call Trace:
        [000000000045eb70] warn_slowpath_common+0x50/0xa0
        [000000000045ebdc] warn_slowpath_null+0x1c/0x40
        [00000000004d493c] pcpu_map+0xdc/0x100
        [00000000004d59a4] pcpu_alloc+0x3e4/0x4e0
        [00000000004d5af8] __alloc_percpu+0x18/0x40
        [00000000005b112c] __percpu_counter_init+0x4c/0xc0
      ...
      Unable to handle kernel NULL pointer dereference
      ...
       I7: <sysfs_new_dirent+0x30/0x120>
       Disabling lock debugging due to kernel taint
       Caller[000000000053c1b0]: sysfs_new_dirent+0x30/0x120
       Caller[000000000053c7a4]: create_dir+0x24/0xc0
       Caller[000000000053c870]: sysfs_create_dir+0x30/0x80
       Caller[00000000005990e8]: kobject_add_internal+0xc8/0x200
      ...
       Kernel panic - not syncing: Attempted to kill the idle task!
    
    This patch fixes the problem by backporting parts from devel branch to
    make percpu core not depend on the existence of cpu0.
    
    Signed-off-by: Tejun Heo <tj at kernel.org>
    Reported-by: Meelis Roos <mroos at linux.ee>
    Cc: David Miller <davem at davemloft.net>

commit b91ab72b830e1494c2c7f8de05ccb2ab2c9cfb26
Author: Clemens Ladisch <clemens at ladisch.de>
Date:   Tue Sep 1 08:23:58 2009 +0200

    sound: oxygen: fix MCLK rate for 192 kHz playback
    
    Do not forget to program the MCLK ratio for the I2S output.
    Otherwise, the master clock frequency can be too high for
    the DACs at sample frequencies above 96 kHz.
    
    Signed-off-by: Clemens Ladisch <clemens at ladisch.de>
    Cc: <stable at kernel.org>
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

commit 37d0892c5a94e208cf863e3b7bac014edee4346d
Author: Ian Kent <raven at themaw.net>
Date:   Tue Sep 1 11:26:22 2009 +0800

    autofs4 - fix missed case when changing to use struct path
    
    In the recent change by Al Viro that changes verious subsystems
    to use "struct path" one case was missed in the autofs4 module
    which causes mounts to no longer expire.
    
    Signed-off-by: Ian Kent <raven at themaw.net>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit cda9856f1ca62484433b9f734cd0fd553a5e4850
Merge: af3998909772f766f27ba432f281d60098354269 a3f730af7e33cea10ea66f05b2565fde1f9512df
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 31 17:36:10 2009 -1000

    Merge branch 'fix/hda' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6
    
    * 'fix/hda' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
      ALSA: hda - Fix MacBookPro 3,1/4,1 quirk with ALC889A
      ALSA: hda - Add missing mux check for VT1708

commit af3998909772f766f27ba432f281d60098354269
Merge: 1a37f184fa7824982a5f434c06981ec46a66cef7 d95c5b0b905aa9b70521eeb83ad4aea85f5e5fd0
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 31 17:31:02 2009 -1000

    Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6
    
    * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6:
      V4L/DVB (12564a): MAINTAINERS: Update gspca sn9c20x name style
      V4L/DVB (12502): gspca - sn9c20x: Fix gscpa sn9c20x build errors.
      V4L/DVB (12495): em28xx: Don't call em28xx_ir_init when disable_ir is true
      V4L/DVB (12457): zr364: wrong indexes
      V4L/DVB (12451): Update KConfig File to enable SDIO and USB interfaces
      V4L/DVB (12450): Siano: Fixed SDIO compilation bugs
      V4L/DVB (12449): adds webcam for Micron device MT9M111 0x143A to em28xx
      V4L/DVB (12446): sms1xxx: restore GPIO functionality for all Hauppauge devices

commit 1a37f184fa7824982a5f434c06981ec46a66cef7
Author: Benjamin Herrenschmidt <benh at kernel.crashing.org>
Date:   Mon Aug 31 13:48:16 2009 +1000

    lmb: Also remove __init from lmb_end_of_RAM() declaration in lmb.h
    
    My previous patch (commit 4f8ee2c9cc: "lmb: Remove __init from
    lmb_end_of_DRAM()") removed __init in lmb.c but missed the fact that it
    was also marked as such in the .h
    
    Signed-off-by: Benjamin Herrenschmidt <benh at kernel.crashing.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 60c3be387bb6cd39707d3ec0ebc324a0c96181f8
Author: Bartlomiej Zolnierkiewicz <bzolnier at gmail.com>
Date:   Sun Aug 30 14:56:30 2009 +0200

    ata_piix: parallel scanning on PATA needs an extra locking
    
    Commit log for commit 517d3cc15b36392e518abab6bacbb72089658313
    ("[libata] ata_piix: Enable parallel scan") says:
    
        This patch turns on parallel scanning for the ata_piix driver.
        This driver is used on most netbooks (no AHCI for cheap storage it seems).
        The scan is the dominating time factor in the kernel boot for these
        devices; with this flag it gets cut in half for the device I used
        for testing (eeepc).
        Alan took a look at the driver source and concluded that it ought to be safe
        to do for this driver.  Alan has also checked with the hardware team.
    
    and it is all true but once we put all things together additional
    constraints for PATA controllers show up (some hardware registers
    have per-host not per-port atomicity) and we risk misprogramming
    the controller.
    
    I used the following test to check whether the issue is real:
    
      @@ -736,8 +736,20 @@ static void piix_set_piomode(struct ata_
       			(timings[pio][1] << 8);
       	}
       	pci_write_config_word(dev, master_port, master_data);
      -	if (is_slave)
      +	if (is_slave) {
      +		if (ap->port_no == 0) {
      +			u8 tmp = slave_data;
      +
      +			while (slave_data == tmp) {
      +				pci_read_config_byte(dev, slave_port, &tmp);
      +				msleep(50);
      +			}
      +
      +			dev_printk(KERN_ERR, &dev->dev, "PATA parallel scan "
      +				   "race detected\n");
      +		}
       		pci_write_config_byte(dev, slave_port, slave_data);
      +	}
    
       	/* Ensure the UDMA bit is off - it will be turned back on if
       	   UDMA is selected */
    
    and it indeed triggered the error message.
    
    Lets fix all such races by adding an extra locking to ->set_piomode
    and ->set_dmamode methods for PATA controllers.
    
    [ Alan: would be better to take the host lock in libata-core for these
      cases so that we fix all the adapters in one swoop.  "Looks fine as a
      temproary quickfix tho" ]
    
    Cc: Arjan van de Ven <arjan at linux.intel.com>
    Acked-by: Alan Cox <alan at linux.intel.com>
    Cc: Jeff Garzik <jgarzik at redhat.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier at gmail.com>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit b5af754405e8cb8b14b3f5958581ebf63c3601e9
Merge: adda766193ea1cf3137484a9521972d080d0b7af db54501900ad3665dd669f5708ecd04fc5aed495
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 31 17:22:10 2009 -1000

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel:
      drm/i915: Improve CRTDDC mapping by using VBT info
      drm/i915: Fix CPU-spinning hangs related to fence usage by using an LRU.
      drm/i915: Set crtc/clone mask in different output devices
      drm/i915: Always use SDVO_B detect bit for SDVO output detection.
      drm/i915: Fix typo that broke SVID1 in intel_sdvo_multifunc_encoder()
      drm/i915: Check if BIOS enabled dual-channel LVDS on 8xx, not only on 9xx
      drm/i915: Set the multiplier for SDVO on G33 platform

commit a3f730af7e33cea10ea66f05b2565fde1f9512df
Author: Takashi Iwai <tiwai at suse.de>
Date:   Mon Aug 31 08:15:26 2009 +0200

    ALSA: hda - Fix MacBookPro 3,1/4,1 quirk with ALC889A
    
    This patch fixes the wrong headphone output routing for MacBookPro 3,1/4,1
    quirk with ALC889A codec, which caused the silent headphone output.
    Also, this gives the individual Headphone and Speaker volume controls.
    
    Reference: kernel bug#14078
    	http://bugzilla.kernel.org/show_bug.cgi?id=14078
    
    Signed-off-by: Takashi Iwai <tiwai at suse.de>
    Cc: <stable at kernel.org>

commit 0f67a611629f84dd0afacd23d422b4b9c2558285
Author: Takashi Iwai <tiwai at suse.de>
Date:   Mon Aug 31 08:12:29 2009 +0200

    ALSA: hda - Add missing mux check for VT1708
    
    In patch_vt1708(), the check of MUX nids is missing and this results in
    the -EINVAL error in accessing Input Source mixer element.  Simpliy
    adding the call of get_mux_nids() fixes the problem.
    
    Reference: Novell bnc#534904
    	https://bugzilla.novell.com/show_bug.cgi?id=534904
    
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

commit d95c5b0b905aa9b70521eeb83ad4aea85f5e5fd0
Author: Joe Perches <joe at perches.com>
Date:   Sun Aug 16 20:03:51 2009 -0300

    V4L/DVB (12564a): MAINTAINERS: Update gspca sn9c20x name style
    
    To unsubscribe from this list: send the line "unsubscribe linux-media" in
    the body of a message to majordomo at vger.kernel.org
    More majordomo info at  http://vger.kernel.org/majordomo-info.html
    
    Signed-off-by: Joe Perches <joe at perches.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit b6b85048c059e3f085095e48e12ed3f7a92c88d4
Author: Randy Dunlap <randy.dunlap at oracle.com>
Date:   Wed Aug 26 03:34:16 2009 -0300

    V4L/DVB (12502): gspca - sn9c20x: Fix gscpa sn9c20x build errors.
    
    Reported-by: Toralf Forster <toralf.foerster at gmx.de>
    Signed-off-by: Randy Dunlap <randy.dunlap at oracle.com>
    Signed-off-by: Jean-Francois Moine <moinejf at free.fr>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit f4c5e80faba8ae420d7dc5d9237cc1e0262d7386
Author: Shine Liu <shinel at foxmail.com>
Date:   Thu Aug 20 23:49:26 2009 -0300

    V4L/DVB (12495): em28xx: Don't call em28xx_ir_init when disable_ir is true
    
    We should call em28xx_ir_init(dev) only when disable_ir is true.
    
    Signed-off-by: Shine Liu <shinel at foxmail.com>
    Reviewed-by: Devin Heitmueller <dheitmueller at kernellabs.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 7b808924d65a4d1a0332d0043e02e9eb5dafe32b
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Tue Aug 11 08:10:25 2009 -0300

    V4L/DVB (12457): zr364: wrong indexes
    
    The order of indexes is reversed
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: Antoine Jacquet <royale at zerezo.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 31e0ad693fb4e1d1be19dbe1c4f5a1ab9978e810
Author: Udi Atar <udia at siano-ms.com>
Date:   Thu Aug 13 16:30:25 2009 -0300

    V4L/DVB (12451): Update KConfig File to enable SDIO and USB interfaces
    
    Update KConfig file to enbale selection of SDIO and USB
    interfaces, and add dependancy on relevant modules.
    
    [mchehab at redhat.com: fix merge conflicts, remove default: m, add missing endmenu]
    
    Signed-off-by: Udi Atar <udia at siano-ms.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit ef2d12ce12117bb97fa35bbcf677c28e14667efa
Author: Udi Atar <udia at siano-ms.com>
Date:   Sun Jun 28 04:22:55 2009 -0300

    V4L/DVB (12450): Siano: Fixed SDIO compilation bugs
    
    Fixed SDIO compilation bugs
    Also fixed a memory overrun issue in buffer management.
    
    Signed-off-by: Udi Atar <udia at siano-ms.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit f2e26ae7c8c077d001c77b330130f98e42ccad70
Author: Mauro Carvalho Chehab <mchehab at redhat.com>
Date:   Wed Aug 12 20:21:44 2009 -0300

    V4L/DVB (12449): adds webcam for Micron device MT9M111 0x143A to em28xx
    
    [mchehab at redhat.com: fix merge conflict and a few CodingStyle issues]
    Signed-off-by: Steve Gotthardt <gotthardt at gmail.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 3746b6178070958279010d112703bca9cdc15e0a
Author: Michael Krufky <mkrufky at kernellabs.com>
Date:   Sun Jul 12 23:30:14 2009 -0300

    V4L/DVB (12446): sms1xxx: restore GPIO functionality for all Hauppauge devices
    
    Previous changesets broke Hauppauge devices and their GPIO configurations.
    
    This changeset restores the LED & LNA functionality.
    
    Signed-off-by: Michael Krufky <mkrufky at kernellabs.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 38bddf04bcfe661fbdab94888c3b72c32f6873b3
Author: Toru UCHIYAMA <uchiyama.toru at jp.fujitsu.com>
Date:   Sun Aug 30 22:04:07 2009 -0700

    gianfar: gfar_remove needs to call unregister_netdev()
    
    This patch solves the problem that the Oops(BUG_ON) occurs by rmmod.
    
    	# rmmod gianfar_driver
    	------------[ cut here ]------------
    	Kernel BUG at c01fec48 [verbose debug info unavailable]
    	Oops: Exception in kernel mode, sig: 5 [#1]
    	MPC837x MDS
    	Modules linked in: gianfar_driver(-) usb_storage scsi_wait_scan
    	NIP: c01fec48 LR: c01febf4 CTR: c01feba8
    	REGS: dec5bd60 TRAP: 0700   Tainted: G        W   (2.6.31-rc2)
    	MSR: 00029032 <EE,ME,CE,IR,DR>  CR: 22000424  XER: 20000000
    	TASK = dec4cac0[1135] 'rmmod' THREAD: dec5a000
    	GPR00: 00000002 dec5be10 dec4cac0 dfba1820 c035d444 c035d478 ffffffff 00000000
    	GPR08: 0000002b 00000001 dfba193c 00000001 22000424 10019b34 1ffcb000 00000000
    	GPR16: 10012008 00000000 bf82ebe0 100017ec bf82ebec bf82ebe8 bf82ebd0 00000880
    	GPR24: 00000000 bf82ebf0 c03532f0 c03532e4 c036b594 dfba183c dfba1800 dfba1820
    	NIP [c01fec48] free_netdev+0xa0/0xb8
    	LR [c01febf4] free_netdev+0x4c/0xb8
    	Call Trace:
    	[dec5be10] [c01febf4] free_netdev+0x4c/0xb8 (unreliable)
    	[dec5be30] [e105f290] gfar_remove+0x50/0x68 [gianfar_driver]
    	[dec5be40] [c01ec534] of_platform_device_remove+0x30/0x44
    	[dec5be50] [c0181760] __device_release_driver+0x68/0xc8
    	[dec5be60] [c0181868] driver_detach+0xa8/0xac
    	[dec5be80] [c0180814] bus_remove_driver+0x9c/0xd8
    	[dec5bea0] [c0181efc] driver_unregister+0x60/0x98
    	[dec5beb0] [c01ec650] of_unregister_driver+0x14/0x24
    	[dec5bec0] [e10631bc] gfar_exit+0x18/0x4bc [gianfar_driver]
    	[dec5bed0] [c0047584] sys_delete_module+0x16c/0x228
    	[dec5bf40] [c00116bc] ret_from_syscall+0x0/0x38
    	--- Exception: c01 at 0xff3669c
    	    LR = 0x10000f34
    	Instruction dump:
    	409e0024 a07e00c0 7c63f050 4be74429 80010024 bba10014 38210020 7c0803a6
    	4e800020 68000003 3160ffff 7d2b0110 <0f090000> 38000004 387e01f0 901e01d4
    	---[ end trace 8c595bcd37230a0f ]---
    	 localhost kernel: ------------[ cut here ]------------
    
    Signed-off-by: Toru UCHIYAMA uchiyama.toru at jp.fujitsu.com
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit b1f1b8ce0a1d71cbc72f7540134d52b79bd8f5ac
Author: Ryusuke Konishi <konishi.ryusuke at lab.ntt.co.jp>
Date:   Sun Aug 30 04:21:41 2009 +0900

    nilfs2: fix preempt count underflow in nilfs_btnode_prepare_change_key
    
    This will fix the following preempt count underflow reported from
    users with the title "[NILFS users] segctord problem" (Message-ID:
    <949415.6494.qm at web58808.mail.re1.yahoo.com> and Message-ID:
    <debc30fc0908270825v747c1734xa59126623cfd5b05 at mail.gmail.com>):
    
     WARNING: at kernel/sched.c:4890 sub_preempt_count+0x95/0xa0()
     Hardware name: HP Compaq 6530b (KR980UT#ABC)
     Modules linked in: bridge stp llc bnep rfcomm l2cap xfs exportfs nilfs2 cowloop loop vboxnetadp vboxnetflt vboxdrv btusb bluetooth uvcvideo videodev v4l1_compat v4l2_compat_ioctl32 arc4 snd_hda_codec_analog ecb iwlagn iwlcore rfkill lib80211 mac80211 snd_hda_intel snd_hda_codec ehci_hcd uhci_hcd usbcore snd_hwdep snd_pcm tg3 cfg80211 psmouse snd_timer joydev libphy ohci1394 snd_page_alloc hp_accel lis3lv02d ieee1394 led_class i915 drm i2c_algo_bit video backlight output i2c_core dm_crypt dm_mod
     Pid: 4197, comm: segctord Not tainted 2.6.30-gentoo-r4-64 #7
     Call Trace:
      [<ffffffff8023fa05>] ? sub_preempt_count+0x95/0xa0
      [<ffffffff802470f8>] warn_slowpath_common+0x78/0xd0
      [<ffffffff8024715f>] warn_slowpath_null+0xf/0x20
      [<ffffffff8023fa05>] sub_preempt_count+0x95/0xa0
      [<ffffffffa04ce4db>] nilfs_btnode_prepare_change_key+0x11b/0x190 [nilfs2]
      [<ffffffffa04d01ad>] nilfs_btree_assign_p+0x19d/0x1e0 [nilfs2]
      [<ffffffffa04d10ad>] nilfs_btree_assign+0xbd/0x130 [nilfs2]
      [<ffffffffa04cead7>] nilfs_bmap_assign+0x47/0x70 [nilfs2]
      [<ffffffffa04d9bc6>] nilfs_segctor_do_construct+0x956/0x20f0 [nilfs2]
      [<ffffffff805ac8e2>] ? _spin_unlock_irqrestore+0x12/0x40
      [<ffffffff803c06e0>] ? __up_write+0xe0/0x150
      [<ffffffff80262959>] ? up_write+0x9/0x10
      [<ffffffffa04ce9f3>] ? nilfs_bmap_test_and_clear_dirty+0x43/0x60 [nilfs2]
      [<ffffffffa04cd627>] ? nilfs_mdt_fetch_dirty+0x27/0x60 [nilfs2]
      [<ffffffffa04db5fc>] nilfs_segctor_construct+0x8c/0xd0 [nilfs2]
      [<ffffffffa04dc3dc>] nilfs_segctor_thread+0x15c/0x3a0 [nilfs2]
      [<ffffffffa04dbe20>] ? nilfs_construction_timeout+0x0/0x10 [nilfs2]
      [<ffffffff80252633>] ? add_timer+0x13/0x20
      [<ffffffff802370da>] ? __wake_up_common+0x5a/0x90
      [<ffffffff8025e960>] ? autoremove_wake_function+0x0/0x40
      [<ffffffffa04dc280>] ? nilfs_segctor_thread+0x0/0x3a0 [nilfs2]
      [<ffffffffa04dc280>] ? nilfs_segctor_thread+0x0/0x3a0 [nilfs2]
      [<ffffffff8025e556>] kthread+0x56/0x90
      [<ffffffff8020cdea>] child_rip+0xa/0x20
      [<ffffffff8025e500>] ? kthread+0x0/0x90
      [<ffffffff8020cde0>] ? child_rip+0x0/0x20
    
    This problem was caused due to a missing radix_tree_preload() call in
    the retry path of nilfs_btnode_prepare_change_key() function.
    
    Reported-by: Eric A <eric225125 at yahoo.com>
    Reported-by: Jerome Poulin <jeromepoulin at gmail.com>
    Signed-off-by: Ryusuke Konishi <konishi.ryusuke at lab.ntt.co.jp>
    Tested-by: Jerome Poulin <jeromepoulin at gmail.com>
    Cc: stable at kernel.org

commit 6faf17f6f1ffc586d16efc2f9fa2083a7785ee74
Author: Chris Wright <chrisw at sous-sol.org>
Date:   Fri Aug 28 13:00:06 2009 -0700

    PCI SR-IOV: correct broken resource alignment calculations
    
    An SR-IOV capable device includes an SR-IOV PCIe capability which
    describes the Virtual Function (VF) BAR requirements.  A typical SR-IOV
    device can support multiple VFs whose BARs must be in a contiguous region,
    effectively an array of VF BARs.  The BAR reports the size requirement
    for a single VF.  We calculate the full range needed by simply multiplying
    the VF BAR size with the number of possible VFs and create a resource
    spanning the full range.
    
    This all seems sane enough except it artificially inflates the alignment
    requirement for the VF BAR.  The VF BAR need only be aligned to the size
    of a single BAR not the contiguous range of VF BARs.  This can cause us
    to fail to allocate resources for the BAR despite the fact that we
    actually have enough space.
    
    This patch adds a thin PCI specific layer over the generic
    resource_alignment() function which is aware of the special nature of
    VF BARs and does sorting and allocation based on the smaller alignment
    requirement.
    
    I recognize that while resource_alignment is generic, it's basically a
    PCI helper.  An alternative to this patch is to add PCI VF BAR specific
    information to struct resource.  I opted for the extra layer rather than
    adding such PCI specific information to struct resource.  This does
    have the slight downside that we don't cache the BAR size and re-read
    for each alignment query (happens a small handful of times during boot
    for each VF BAR).
    
    Signed-off-by: Chris Wright <chrisw at sous-sol.org>
    Cc: Ivan Kokshaysky <ink at jurassic.park.msu.ru>
    Cc: Linus Torvalds <torvalds at linux-foundation.org>
    Cc: Matthew Wilcox <matthew at wil.cx>
    Cc: Yu Zhao <yu.zhao at intel.com>
    Cc: stable at kernel.org
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>

commit db54501900ad3665dd669f5708ecd04fc5aed495
Author: David Müller (ELSOFT AG) <d.mueller at elsoft.ch>
Date:   Sat Aug 29 08:54:45 2009 +0200

    drm/i915: Improve CRTDDC mapping by using VBT info
    
    Use VBT information to determine which DDC bus to use for CRTDCC.
    Fall back to GPIOA if VBT info is not available.
    
    Signed-off-by: David Müller <d.mueller at elsoft.ch>
    Reviewed-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    Signed-off-by: Eric Anholt <eric at anholt.net>
    Tested on: 855 (David), and 945GM, 965GM, GM45, and G45 (anholt)

commit a09ba7faf75fa4b21980d81de8e5f3d5c0785ccf
Author: Eric Anholt <eric at anholt.net>
Date:   Sat Aug 29 12:49:51 2009 -0700

    drm/i915: Fix CPU-spinning hangs related to fence usage by using an LRU.
    
    The lack of a proper LRU was partially worked around by taking the fence
    from the object containing the oldest seqno.  But if there are multiple
    objects inactive, then they don't have seqnos and the first fence reg
    among them would be chosen.  If you were trying to copy data between two
    mappings, this could result in each page fault stealing the fence from
    the other argument, and your application hanging.
    
    https://bugs.freedesktop.org/show_bug.cgi?id=23566
    https://bugs.freedesktop.org/show_bug.cgi?id=23220
    https://bugs.freedesktop.org/show_bug.cgi?id=23253
    https://bugs.freedesktop.org/show_bug.cgi?id=23366
    
    Cc: Stable Team <stable at kernel.org>
    Signed-off-by: Eric Anholt <eric at anholt.net>
    Reviewed-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    Reviewed-by: Chris Wilson <chris at chris-wilson.co.uk>

commit eced1dfcfcf6b0a35e925d73916a9d8e36ab5457
Author: Peter Zijlstra <peterz at infradead.org>
Date:   Fri Aug 28 17:10:47 2009 +0200

    perf_counter: Fix /0 bug in swcounters
    
    We have a race in the swcounter stuff where we can start
    counting a counter that has never been enabled, this leads to a
    /0 situation.
    
    The below avoids the /0 but doesn't close the race, this would
    need a new counter state.
    
    The race is due to perf_swcounter_is_counting() which cannot
    discern between disabled due to scheduled out, and disabled for
    any other reason.
    
    Such a crash has been seen by Ingo:
    
    [  967.092372] divide error: 0000 [#1] SMP
    [  967.096499] last sysfs file: /sys/devices/system/cpu/cpu15/cache/index2/shared_cpu_map
    [  967.104846] CPU 5
    [  967.106965] Modules linked in:
    [  967.110169] Pid: 3351, comm: hackbench Not tainted 2.6.31-rc8-tip-01158-gd940a54-dirty #1568 X8DTN
    [  967.119456] RIP: 0010:[<ffffffff810c0aba>]  [<ffffffff810c0aba>] perf_swcounter_ctx_event+0x127/0x1af
    [  967.129137] RSP: 0018:ffff8801a95abd70  EFLAGS: 00010046
    [  967.134699] RAX: 0000000000000002 RBX: ffff8801bd645c00 RCX: 0000000000000002
    [  967.142162] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8801bd645d40
    [  967.149584] RBP: ffff8801a95abdb0 R08: 0000000000000001 R09: ffff8801a95abe00
    [  967.157042] R10: 0000000000000037 R11: ffff8801aa1245f8 R12: ffff8801a95abe00
    [  967.164481] R13: ffff8801a95abe00 R14: ffff8801aa1c0e78 R15: 0000000000000001
    [  967.171953] FS:  0000000000000000(0000) GS:ffffc90000a00000(0063) knlGS:00000000f7f486c0
    [  967.180406] CS:  0010 DS: 002b ES: 002b CR0: 000000008005003b
    [  967.186374] CR2: 000000004822c0ac CR3: 00000001b19a2000 CR4: 00000000000006e0
    [  967.193770] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
    [  967.201224] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
    [  967.208692] Process hackbench (pid: 3351, threadinfo ffff8801a95aa000, task ffff8801a96b0000)
    [  967.217607] Stack:
    [  967.219711]  0000000000000000 0000000000000037 0000000200000001 ffffc90000a1107c
    [  967.227296] <0> ffff8801a95abe00 0000000000000001 0000000000000001 0000000000000037
    [  967.235333] <0> ffff8801a95abdf0 ffffffff810c0c20 0000000200a14f30 ffff8801a95abe40
    [  967.243532] Call Trace:
    [  967.246103]  [<ffffffff810c0c20>] do_perf_swcounter_event+0xde/0xec
    [  967.252635]  [<ffffffff810c0ca7>] perf_tpcounter_event+0x79/0x7b
    [  967.258957]  [<ffffffff81037f73>] ftrace_profile_sched_switch+0xc0/0xcb
    [  967.265791]  [<ffffffff8155f22d>] schedule+0x429/0x4c4
    [  967.271156]  [<ffffffff8100c01e>] int_careful+0xd/0x14
    
    Reported-by: Ingo Molnar <mingo at elte.hu>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Paul Mackerras <paulus at samba.org>
    LKML-Reference: <1251472247.17617.74.camel at laptop>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 0c7d400fafaeab6014504a6a6249f01bac7f7db4
Author: Herbert Xu <herbert at gondor.apana.org.au>
Date:   Sat Aug 29 20:44:04 2009 +1000

    crypto: skcipher - Fix skcipher_dequeue_givcrypt NULL test
    
    As struct skcipher_givcrypt_request includes struct crypto_request
    at a non-zero offset, testing for NULL after converting the pointer
    returned by crypto_dequeue_request does not work.  This can result
    in IPsec crashes when the queue is depleted.
    
    This patch fixes it by doing the pointer conversion only when the
    return value is non-NULL.  In particular, we create a new function
    __crypto_dequeue_request that does the pointer conversion.
    
    Reported-by: Brad Bosch <bradbosch at comcast.net>
    Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>

commit ab1f5e49f84e7072a0aade47cfeecef70be46c0f
Merge: 3161e453e496eb5643faad30fff5a5ab183da0fe 11ebd1bf07fafde8d16562966c96b05b0d4ced9e
Author: David S. Miller <davem at davemloft.net>
Date:   Fri Aug 28 23:04:57 2009 -0700

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

commit adda766193ea1cf3137484a9521972d080d0b7af
Merge: 8442edc18843491978f7820f87dbdf293461290e e29b3ee3b005897fbdcfdd4b3190776e38739d70
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 28 19:41:05 2009 -1000

    Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6
    
    * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6:
      ACPI: don't free non-existent backlight in acpi video module
      toshiba_acpi: return on a fail path
      ACPICA: Windows compatibility fix: same buffer/string store

commit 8442edc18843491978f7820f87dbdf293461290e
Merge: 825e1e23914b9c3dbc49ee8c5a1d1cb421c1270a 750a8870fe4016ef3091fc97e084d58c613c2cc7
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 28 19:39:44 2009 -1000

    Merge branch 'for-linus' of git://git.infradead.org/users/eparis/notify
    
    * 'for-linus' of git://git.infradead.org/users/eparis/notify:
      inotify: update the group mask on mark addition
      inotify: fix length reporting and size checking
      inotify: do not send a block of zeros when no pathname is available

commit 825e1e23914b9c3dbc49ee8c5a1d1cb421c1270a
Author: Grant Grundler <grundler at parisc-linux.org>
Date:   Fri Aug 28 15:00:36 2009 -0400

    parisc: fix warning in traps.c
    
    On Tue, Aug 18, 2009 at 01:45:17PM -0400, John David Anglin wrote:
    >  CC      arch/parisc/kernel/traps.o
    > arch/parisc/kernel/traps.c: In function 'handle_interruption':
    > arch/parisc/kernel/traps.c:535:18: warning: operation on 'regs->iasq[0]'
    > may be undefined
    
    Yes - Line 535 should use both [0] and [1].
    
    Reported-by: John David Anglin <dave at hiauly1.hia.nrc.ca>
    Signed-off-by: Grant Grundler <grundler at parisc-linux.org>
    Signed-off-by: Kyle McMartin <kyle at mcmartin.ca>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 2574cc9f4ffc6c681c9177111357efe5b76f0e36
Author: Trond Myklebust <Trond.Myklebust at netapp.com>
Date:   Fri Aug 28 11:12:12 2009 -0400

    SUNRPC: Fix rpc_task_force_reencode
    
    This patch fixes the bug that was reported in
      http://bugzilla.kernel.org/show_bug.cgi?id=14053
    
    If we're in the case where we need to force a reencode and then resend of
    the RPC request, due to xprt_transmit failing with a networking error, then
    we _must_ retransmit the entire request.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
    Cc: stable at kernel.org
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit ea6bff368548d79529421a9dc0710fc5330eb504
Author: Ingo Molnar <mingo at elte.hu>
Date:   Fri Aug 28 10:44:56 2009 +0200

    modules: Fix build error in the !CONFIG_KALLSYMS case
    
    > James Bottomley (1):
    >       module: workaround duplicate section names
    
    -tip testing found that this patch breaks the build on x86 if
    CONFIG_KALLSYMS is disabled:
    
     kernel/module.c: In function ‘load_module’:
     kernel/module.c:2367: error: ‘struct module’ has no member named ‘sect_attrs’
     distcc[8269] ERROR: compile kernel/module.c on ph/32 failed
     make[1]: *** [kernel/module.o] Error 1
     make: *** [kernel] Error 2
     make: *** Waiting for unfinished jobs....
    
    Commit 1b364bf misses the fact that section attributes are only
    built and dealt with if kallsyms is enabled. The patch below fixes
    this.
    
    ( note, technically speaking this should depend on CONFIG_SYSFS as
      well but this patch is correct too and keeps the #ifdef less
      intrusive - in the KALLSYMS && !SYSFS case the code is a NOP. )
    
    Signed-off-by: Ingo Molnar <mingo at elte.hu>
    [ Replaced patch with a slightly cleaner variation by James Bottomley ]
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 4ed86af67e04cb5eb93faba589d102726207865a
Merge: 326ba5010a5429a5a528b268b36a5900d4ab0eba 295594e9cf6ae2efd73371777aa8feba0f87f42f
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 28 19:32:32 2009 -1000

    Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86: Fix vSMP boot crash
      x86, xen: Initialize cx to suppress warning
      x86, xen: Suppress WP test on Xen

commit e29b3ee3b005897fbdcfdd4b3190776e38739d70
Author: Keith Packard <keithp at keithp.com>
Date:   Thu Aug 6 15:57:54 2009 -0700

    ACPI: don't free non-existent backlight in acpi video module
    
    acpi_video_put_one_device was attempting to remove sysfs entries and
    unregister a backlight device without first checking that said backlight
    device structure had been created.
    
    Signed-off-by: Keith Packard <keithp at keithp.com>
    Acked-by: Zhang Rui <rui.zhang at intel.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Len Brown <len.brown at intel.com>

commit 82e7784f57a81faf673b09bc468e736d582fe754
Author: Jiri Slaby <jirislaby at gmail.com>
Date:   Thu Aug 6 15:57:51 2009 -0700

    toshiba_acpi: return on a fail path
    
    Return from bt_rfkill_poll() when hci_get_radio_state() fails.
    
    value is invalid in that case and should not be assigned to the rfkill
    state.
    
    This also fixes a double unlock bug.
    
    Signed-off-by: Jiri Slaby <jirislaby at gmail.com>
    Cc: John W. Linville <linville at tuxdriver.com>
    Cc: Johannes Berg <johannes at sipsolutions.net>
    Cc: Henrique de Moraes Holschuh <hmh at hmh.eng.br>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Len Brown <len.brown at intel.com>

commit b0de22bdffa2e9a8e280d769c59f866605268484
Author: Lin Ming <ming.m.lin at intel.com>
Date:   Wed Aug 26 09:01:34 2009 +0800

    ACPICA: Windows compatibility fix: same buffer/string store
    
    Fix a compatibility issue when the same buffer or string is
    stored to itself. This has been seen in the field. Previously,
    ACPICA would zero out the buffer/string. Now, the operation is
    treated as a NOP.
    
    http://bugzilla.acpica.org/show_bug.cgi?id=803
    
    Reported-by: Rezwanul Kabir <Rezwanul_Kabir at Dell.com>
    Signed-off-by: Lin Ming <ming.m.lin at intel.com>
    Signed-off-by: Bob Moore <robert.moore at intel.com>
    Signed-off-by: Len Brown <len.brown at intel.com>

commit 11ebd1bf07fafde8d16562966c96b05b0d4ced9e
Author: Zhu Yi <yi.zhu at intel.com>
Date:   Fri Aug 28 11:42:31 2009 +0800

    ipw2200: firmware DMA loading rework
    
    Bartlomiej Zolnierkiewicz reported an atomic order-6 allocation failure
    for ipw2200 firmware loading in kernel 2.6.30. High order allocation is
    likely to fail and should always be avoided.
    
    The patch fixes this problem by replacing the original order-6
    pci_alloc_consistent() with an array of order-1 pages from a pci pool.
    This utilized the ipw2200 DMA command blocks (up to 64 slots). The
    maximum firmware size support remains the same (64*8K).
    
    This patch fixes bug http://bugzilla.kernel.org/show_bug.cgi?id=14016
    
    Cc: Andrew Morton <akpm at linux-foundation.org>
    Cc: Mel Gorman <mel at csn.ul.ie>
    Signed-off-by: Zhu Yi <yi.zhu at intel.com>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit 750a8870fe4016ef3091fc97e084d58c613c2cc7
Author: Eric Paris <eparis at redhat.com>
Date:   Fri Aug 28 12:50:47 2009 -0400

    inotify: update the group mask on mark addition
    
    Seperating the addition and update of marks in inotify resulted in a
    regression in that inotify never gets events.  The inotify group mask is
    always 0.  This mask should be updated any time a new mark is added.
    
    Signed-off-by: Eric Paris <eparis at redhat.com>

commit 83cb10f0ef3c96162be92339ccf8c0c9c9f2d13e
Author: Eric Paris <eparis at redhat.com>
Date:   Fri Aug 28 11:57:55 2009 -0400

    inotify: fix length reporting and size checking
    
    0db501bd0610ee0c0 introduced a regresion in that it now sends a nul
    terminator but the length accounting when checking for space or
    reporting to userspace did not take this into account.  This corrects
    all of the rounding logic.
    
    Signed-off-by: Eric Paris <eparis at redhat.com>

commit b962e7312ae87006aed6f68ceee94bdf8db08338
Author: Brian Rogers <brian at xyzw.org>
Date:   Fri Aug 28 10:00:05 2009 -0400

    inotify: do not send a block of zeros when no pathname is available
    
    When an event has no pathname, there's no need to pad it with a null byte and
    therefore generate an inotify_event sized block of zeros. This fixes a
    regression introduced by commit 0db501bd0610ee0c0aca84d927f90bcccd09e2bd where
    my system wouldn't finish booting because some process was being confused by
    this.
    
    Signed-off-by: Brian Rogers <brian at xyzw.org>
    Signed-off-by: Eric Paris <eparis at redhat.com>

commit 6bb56347f5162d1a7cb1dc461023360781ecd4c0
Author: Ingo Molnar <mingo at elte.hu>
Date:   Fri Aug 28 13:44:53 2009 +0200

    perf_counters: Increase paranoia level
    
    Per-cpu counters are an ASLR information leak as they show
    the execution other tasks do. Increase the paranoia level
    to 1, which disallows per-cpu counters. (they still allow
    counting/profiling of own tasks - and admin can profile
    everything.)
    
    Acked-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    LKML-Reference: <new-submission>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit a1b08e75dff3dc18a88444803753e667bb1d126e
Author: Tao Ma <tao.ma at oracle.com>
Date:   Thu Aug 27 14:46:56 2009 +0800

    ocfs2: invalidate dentry if its dentry_lock isn't initialized.
    
    In commit a5a0a630922a2f6a774b6dac19f70cb5abd86bb0, when
    ocfs2_attch_dentry_lock fails, we call an extra iput and reset
    dentry->d_fsdata to NULL. This resolve a bug, but it isn't
    completed and the dentry is still there. When we want to use
    it again, ocfs2_dentry_revalidate doesn't catch it and return
    true. That make future ocfs2_dentry_lock panic out.
    One bug is http://oss.oracle.com/bugzilla/show_bug.cgi?id=1162.
    
    The resolution is to add a check for dentry->d_fsdata in
    revalidate process and return false if dentry->d_fsdata is NULL,
    so that a new ocfs2_lookup will be called again.
    
    Signed-off-by: Tao Ma <tao.ma at oracle.com>
    Signed-off-by: Joel Becker <joel.becker at oracle.com>

commit 326ba5010a5429a5a528b268b36a5900d4ab0eba
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 27 17:59:04 2009 -0700

    Linux 2.6.31-rc8

commit 1b364bf438cf337a3818aee77d68c0713f3e1fc4
Author: James Bottomley <James.Bottomley at HansenPartnership.com>
Date:   Wed Aug 26 22:04:12 2009 +0930

    module: workaround duplicate section names
    
    The root cause is a duplicate section name (.text); is this legal?
    [ Amerigo Wang: "AFAIK, yes." ]
    
    However, there's a problem with commit
    6d76013381ed28979cd122eb4b249a88b5e384fa in that if you fail to allocate
    a mod->sect_attrs (in this case it's null because of the duplication),
    it still gets used without checking in add_notes_attrs()
    
    This should fix it
    
    [ This patch leaves other problems, particularly the sections directory,
      but recent parisc toolchains seem to produce these modules and this
      prevents a crash and is a minimal change -- RR ]
    
    Signed-off-by: James Bottomley <James.Bottomley at suse.de>
    Signed-off-by: Rusty Russell <rusty at rustcorp.com.au>
    Tested-by: Helge Deller <deller at gmx.de>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 7d1d16e416e61aeef8655d542f8e4a4fc6e808e4
Author: Rusty Russell <rusty at rustcorp.com.au>
Date:   Wed Aug 26 22:02:54 2009 +0930

    module: fix BUG_ON() for powerpc (and other function descriptor archs)
    
    The rarely-used symbol_put_addr() needs to use dereference_function_descriptor
    on powerpc.
    
    Reported-by: Paul Mackerras <paulus at samba.org>
    Signed-off-by: Rusty Russell <rusty at rustcorp.com.au.
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 0a80fb10239b04c45e5e80aad8d4b2ca5ac407b2
Author: Jeremy Fitzhardinge <jeremy at goop.org>
Date:   Thu Aug 27 12:22:43 2009 -0700

    xenfb: connect to backend before registering fb
    
    As soon as the framebuffer is registered, our methods may be called by the
    kernel. This leads to a crash as xenfb_refresh() gets called before we have
    the irq.
    
    Connect to the backend before registering our framebuffer with the kernel.
    
    [ Fixes bug http://bugzilla.kernel.org/show_bug.cgi?id=14059 ]
    
    Signed-off-by: Michal Schmidt <mschmidt at redhat.com>
    Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge at citrix.com>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 9c504cadc443a3d002fa581ec5109c0ef02d7b14
Merge: 4f8ee2c9cc0e885d2bb50ef26db66150ab25213e 0db501bd0610ee0c0aca84d927f90bcccd09e2bd
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 27 12:26:02 2009 -0700

    Merge branch 'for-linus' of git://git.infradead.org/users/eparis/notify
    
    * 'for-linus' of git://git.infradead.org/users/eparis/notify:
      inotify: Ensure we alwasy write the terminating NULL.
      inotify: fix locking around inotify watching in the idr
      inotify: do not BUG on idr entries at inotify destruction
      inotify: seperate new watch creation updating existing watches

commit 4f8ee2c9cc0e885d2bb50ef26db66150ab25213e
Author: Benjamin Herrenschmidt <benh at kernel.crashing.org>
Date:   Thu Aug 27 17:20:30 2009 +1000

    lmb: Remove __init from lmb_end_of_DRAM()
    
    We call lmb_end_of_DRAM() to test whether a DMA mask is ok on a machine
    without IOMMU, but this function is marked as __init.
    
    I don't think there's a clean way to get the top of RAM max_pfn doesn't
    appear to include highmem or I missed (or we have a bug :-) so for now,
    let's just avoid having a broken 2.6.31 by making this function
    non-__init and we can revisit later.
    
    Signed-off-by: Benjamin Herrenschmidt <benh at kernel.crashing.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit cf481442f2e086316ed8a1b3046f00ad23632ac4
Merge: 788d908f2879a17e5f80924f3da2e23f1034482d 7815f4be4026b6c5027058102ae67a4b9feffa5f
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 27 12:24:08 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
      9p: update documentation pointers
      9p: remove unnecessary v9fses->options which duplicates the mount string
      net/9p: insulate the client against an invalid error code sent by a 9p server
      9p: Add missing cast for the error return value in v9fs_get_inode
      9p: Remove redundant inode uid/gid assignment
      9p: Fix possible regressions when ->get_sb fails.
      9p: Fix v9fs show_options
      9p: Fix possible memleak in v9fs_inode_from fid.
      9p: minor comment fixes
      9p: Fix possible inode leak in v9fs_get_inode.
      9p: Check for error in return value of v9fs_fid_add

commit 788d908f2879a17e5f80924f3da2e23f1034482d
Author: Julien TINNES <julien at cr0.org>
Date:   Thu Aug 27 15:26:58 2009 +0200

    ipv4: make ip_append_data() handle NULL routing table
    
    Add a check in ip_append_data() for NULL *rtp to prevent future bugs in
    callers from being exploitable.
    
    Signed-off-by: Julien Tinnes <julien at cr0.org>
    Signed-off-by: Tavis Ormandy <taviso at sdf.lonestar.org>
    Acked-by: David S. Miller <davem at davemloft.net>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 9886e836a6a5dbd273dc55b17e713f0a188d137f
Author: David Howells <dhowells at redhat.com>
Date:   Thu Aug 27 13:09:06 2009 +0100

    AFS: Stop readlink() on AFS crashing due to NULL 'file' ptr
    
    kAFS crashes when asked to read a symbolic link because page_getlink()
    passes a NULL file pointer to read_mapping_page(), but afs_readpage()
    expects a file pointer from which to extract a key.
    
    Modify afs_readpage() to request the appropriate key from the calling
    process's keyrings if a file struct is not supplied with one attached.
    
    Signed-off-by: David Howells <dhowells at redhat.com>
    Acked-by: Anton Blanchard <anton at samba.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 0db501bd0610ee0c0aca84d927f90bcccd09e2bd
Author: Eric W. Biederman <ebiederm at xmission.com>
Date:   Thu Aug 27 03:20:04 2009 -0700

    inotify: Ensure we alwasy write the terminating NULL.
    
    Before the rewrite copy_event_to_user always wrote a terqminating '\0'
    byte to user space after the filename.  Since the rewrite that
    terminating byte was skipped if your filename is exactly a multiple of
    event_size.  Ouch!
    
    So add one byte to name_size before we round up and use clear_user to
    set userspace to zero like /dev/zero does instead of copying the
    strange nul_inotify_event.  I can't quite convince myself len_to_zero
    will never exceed 16 and even if it doesn't clear_user should be more
    efficient and a more accurate reflection of what the code is trying to
    do.
    
    Signed-off-by: Eric W. Biederman <ebiederm at aristanetworks.com>
    Signed-off-by: Eric Paris <eparis at redhat.com>

commit dead537dd8a1c9495322c1d6f7c780697f474af0
Author: Eric Paris <eparis at redhat.com>
Date:   Mon Aug 24 16:03:35 2009 -0400

    inotify: fix locking around inotify watching in the idr
    
    The are races around the idr storage of inotify watches.  It's possible
    that a watch could be found from sys_inotify_rm_watch() in the idr, but it
    could be removed from the idr before that code does it's removal.  Move the
    locking and the refcnt'ing so that these have to happen atomically.
    
    Signed-off-by: Eric Paris <eparis at redhat.com>

commit cf4374267fbe966e8e4e7db68f5dc7b267439780
Author: Eric Paris <eparis at redhat.com>
Date:   Mon Aug 24 16:03:35 2009 -0400

    inotify: do not BUG on idr entries at inotify destruction
    
    If an inotify watch is left in the idr when an fsnotify group is destroyed
    this will lead to a BUG.  This is not a dangerous situation and really
    indicates a programming bug and leak of memory.  This patch changes it to
    use a WARN and a printk rather than killing people's boxes.
    
    Signed-off-by: Eric Paris <eparis at redhat.com>

commit 52cef7555adf5ca09b3b7283097466759120d901
Author: Eric Paris <eparis at redhat.com>
Date:   Mon Aug 24 16:03:35 2009 -0400

    inotify: seperate new watch creation updating existing watches
    
    There is nothing known wrong with the inotify watch addition/modification
    but this patch seperates the two code paths to make them each easy to
    verify as correct.
    
    Signed-off-by: Eric Paris <eparis at redhat.com>

commit 1e23502cc57cef33455ac7cb9111e3c6d991a894
Merge: e99b1f22f91cc5e2d06699b3d8958a0ff6cb24d9 3161e453e496eb5643faad30fff5a5ab183da0fe
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Aug 26 20:54:48 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      virtio: net refill on out-of-memory
      smc91x: fix compilation on SMP

commit e99b1f22f91cc5e2d06699b3d8958a0ff6cb24d9
Merge: 5311034ddda7aad48934520d3536b9d0e4502672 b080f187adb79bbcbe28814b07cbc1ead34c469a
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Aug 26 20:39:31 2009 -0700

    Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
    
    * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
      powerpc/ps3: Update ps3_defconfig
      powerpc/ps3: Add missing check for PS3 to rtc-ps3 platform device registration

commit b080f187adb79bbcbe28814b07cbc1ead34c469a
Author: Geoff Levand <geoffrey.levand at am.sony.com>
Date:   Tue Aug 25 07:53:35 2009 +0000

    powerpc/ps3: Update ps3_defconfig
    
    Update ps3_defconfig.
    
     o Refresh for 2.6.31.
     o Remove MTD support.
     o Add more HID drivers.
    
    Signed-off-by: Geoff Levand <geoffrey.levand at am.sony.com>
    Signed-off-by: Benjamin Herrenschmidt <benh at kernel.crashing.org>

commit 7b6a09f3d6aedeaac923824af2a5df30300b56e9
Author: Geert Uytterhoeven <Geert.Uytterhoeven at sonycom.com>
Date:   Sun Aug 23 22:54:32 2009 +0000

    powerpc/ps3: Add missing check for PS3 to rtc-ps3 platform device registration
    
    On non-PS3, we get:
    
    | kernel BUG at drivers/rtc/rtc-ps3.c:36!
    
    because the rtc-ps3 platform device is registered unconditionally in a kernel
    with builtin support for PS3.
    
    Reported-by: Sachin Sant <sachinp at in.ibm.com>
    Signed-off-by: Geert Uytterhoeven <Geert.Uytterhoeven at sonycom.com>
    Acked-by: Geoff Levand <geoffrey.levand at am.sony.com>
    Signed-off-by: Benjamin Herrenschmidt <benh at kernel.crashing.org>

commit 5311034ddda7aad48934520d3536b9d0e4502672
Merge: 533995ed85730a1f5f385b9ecb2d2b4b731d27b4 53a7197aff20e341487fca8575275056fe1c63e5
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Aug 26 20:17:07 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
      IMA: iint put in ima_counts_get and put

commit 533995ed85730a1f5f385b9ecb2d2b4b731d27b4
Merge: cc674c81f01a6151ca00c617e5efa0812ee5fdbe 9848484fad9ddeb18f18f02f9ecdcd330ac9a216
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Aug 26 20:16:38 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k:
      m68k,m68knommu: Wire up rt_tgsigqueueinfo and perf_counter_open
      m68k: Fix redefinition of pgprot_noncached
      arch/m68k/include/asm/motorola_pgalloc.h: fix kunmap arg
      m68k: cnt reaches -1, not 0
      m68k: count can reach 51, not 50

commit cc674c81f01a6151ca00c617e5efa0812ee5fdbe
Author: Thadeu Lima de Souza Cascardo <cascardo at holoscopio.com>
Date:   Wed Aug 26 14:29:32 2009 -0700

    leds: after setting inverted attribute, we must update the LED
    
    If we change the inverted attribute to another value, the LED will not be
    inverted until we change the GPIO state.
    
    Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo at holoscopio.com>
    Cc: Samuel R. C. Vale <srcvale at holoscopio.com>
    Cc: Richard Purdie <rpurdie at rpsys.net>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 48cccd26f36511ddb6aeca07485ecf2829683907
Author: Thadeu Lima de Souza Cascardo <cascardo at holoscopio.com>
Date:   Wed Aug 26 14:29:31 2009 -0700

    leds: fix multiple requests and releases of IRQ for GPIO LED Trigger
    
    When setting the same GPIO number, multiple IRQ shared requests will be
    done without freing the previous request.  It will also try to free a
    failed request or an already freed IRQ if 0 was written to the gpio file.
    
    All these oops and leaks were fixed with the following solution: keep the
    previous allocated GPIO (if any) still allocated in case the new request
    fails.  The alternative solution would desallocate the previous allocated
    GPIO and set gpio as 0.
    
    Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo at holoscopio.com>
    Signed-off-by: Samuel R. C. Vale <srcvale at holoscopio.com>
    Cc: Richard Purdie <rpurdie at rpsys.net>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit bdf57de4e6abc389cc3f3bd94ec15cce74cf6f4b
Author: Frans Pop <elendil at planet.nl>
Date:   Wed Aug 26 14:29:30 2009 -0700

    acpi processor: remove superfluous warning message
    
    This failure is very common on many platforms.  Handling it in the ACPI
    processor driver is enough, and we don't need a warning message unless
    CONFIG_ACPI_DEBUG is set.
    
    Based on a patch from Zhang Rui.
    
    Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13389
    
    Signed-off-by: Frans Pop <elendil at planet.nl>
    Acked-by: Zhang Rui <rui.zhang at intel.com>
    Cc: Len Brown <lenb at kernel.org>
    Cc: "Rafael J. Wysocki" <rjw at sisk.pl>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 2a908002c7b1b666616103e9df2419b38d7c6f1f
Author: Frans Pop <elendil at planet.nl>
Date:   Wed Aug 26 14:29:29 2009 -0700

    ACPI processor: force throttling state when BIOS returns incorrect value
    
    If the BIOS reports an invalid throttling state (which seems to be
    fairly common after system boot), a reset is done to state T0.
    Because of a check in acpi_processor_get_throttling_ptc(), the reset
    never actually gets executed, which results in the error reoccurring
    on every access of for example /proc/acpi/processor/CPU0/throttling.
    
    Add a 'force' option to acpi_processor_set_throttling() to ensure
    the reset really takes effect.
    
    Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13389
    
    This patch, together with the next one, fixes a regression introduced in
    2.6.30, listed on the regression list. They have been available for 2.5
    months now in bugzilla, but have not been picked up, despite various
    reminders and without any reason given.
    
    Google shows that numerous people are hitting this issue. The issue is in
    itself relatively minor, but the bug in the code is clear.
    
    The patches have been in all my kernels and today testing has shown that
    throttling works correctly with the patches applied when the system
    overheats (http://bugzilla.kernel.org/show_bug.cgi?id=13918#c14).
    
    Signed-off-by: Frans Pop <elendil at planet.nl>
    Acked-by: Zhang Rui <rui.zhang at intel.com>
    Cc: Len Brown <lenb at kernel.org>
    Cc: "Rafael J. Wysocki" <rjw at sisk.pl>
    Cc: Rusty Russell <rusty at rustcorp.com.au>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit f3d83e2415445e5b157bef404d38674e9e8de169
Author: Costantino Leandro <lcostantino at gmail.com>
Date:   Wed Aug 26 14:29:28 2009 -0700

    wmi: fix kernel panic when stack protection enabled.
    
    Summary:
    Kernel panic arise when stack protection is enabled, since strncat will
    add a null terminating byte '\0'; So in functions
    like this one (wmi_query_block):
            char wc[4]="WC";
    	....
    	strncat(method, block->object_id, 2);
            ...
    the length of wc should be n+1 (wc[5]) or stack protection
    fault will arise. This is not noticeable when stack protection is
    disabled,but , isn't good either.
    Config used: [CONFIG_CC_STACKPROTECTOR_ALL=y,
    	      CONFIG_CC_STACKPROTECTOR=y]
    
    Panic Trace
    ------------
           .... stack-protector: kernel stack corrupted in : fa7b182c
           2.6.30-rc8-obelisco-generic
           call_trace:
               [<c04a6c40>] ? panic+0x45/0xd9
    	   [<c012925d>] ? __stack_chk_fail+0x1c/0x40
    	   [<fa7b182c>] ? wmi_query_block+0x15a/0x162 [wmi]
    	   [<fa7b182c>] ? wmi_query_block+0x15a/0x162 [wmi]
    	   [<fa7e7000>] ? acer_wmi_init+0x00/0x61a [acer_wmi]
    	   [<fa7e7135>] ? acer_wmi_init+0x135/0x61a [acer_wmi]
    	   [<c0101159>] ? do_one_initcall+0x50+0x126
    
    Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13514
    
    Signed-off-by: Costantino Leandro <lcostantino at gmail.com>
    Signed-off-by: Carlos Corbacho <carlos at strangeworlds.co.uk>
    Cc: Len Brown <len.brown at intel.com>
    Cc: Bjorn Helgaas <bjorn.helgaas at hp.com>
    Cc: "Rafael J. Wysocki" <rjw at sisk.pl>
    Cc: <stable at kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit ce8442b55135c679809311997d1446f3bbc05de2
Author: Yinghai Lu <yinghai at kernel.org>
Date:   Wed Aug 26 14:29:26 2009 -0700

    acpi: don't call acpi_processor_init if acpi is disabled
    
    Jens reported early_ioremap messages with old ASUS board...
    
    > [    1.507461] pci 0000:00:09.0: Firmware left e100 interrupts enabled; disabling
    > [    1.532778] early_ioremap(3fffd080, 0000005c) [0] => Pid: 1, comm: swapper Not tainted 2.6.31-rc4 #36
    > [    1.561007] Call Trace:
    > [    1.568638]  [<c136e48b>] ? printk+0x18/0x1d
    > [    1.581734]  [<c15513ff>] __early_ioremap+0x74/0x1e9
    > [    1.596898]  [<c15515aa>] early_ioremap+0x1a/0x1c
    > [    1.611270]  [<c154a187>] __acpi_map_table+0x18/0x1a
    > [    1.626451]  [<c135a7f8>] acpi_os_map_memory+0x1d/0x25
    > [    1.642129]  [<c119459c>] acpi_tb_verify_table+0x20/0x49
    > [    1.658321]  [<c1193e50>] acpi_get_table_with_size+0x53/0xa1
    > [    1.675553]  [<c1193eae>] acpi_get_table+0x10/0x15
    > [    1.690192]  [<c155cc19>] acpi_processor_init+0x23/0xab
    > [    1.706126]  [<c1001043>] do_one_initcall+0x33/0x180
    > [    1.721279]  [<c155cbf6>] ? acpi_processor_init+0x0/0xab
    > [    1.737479]  [<c106893a>] ? register_irq_proc+0xaa/0xc0
    > [    1.753411]  [<c10689b7>] ? init_irq_proc+0x67/0x80
    > [    1.768316]  [<c15405e7>] kernel_init+0x120/0x176
    > [    1.782678]  [<c15404c7>] ? kernel_init+0x0/0x176
    > [    1.797062]  [<c10038b7>] kernel_thread_helper+0x7/0x10
    > [    1.812984] 00000080 + ffe00000
    
    that is rather later.
    acpi_gbl_permanent_mmap should be set in acpi_early_init()
    if acpi is not disabled
    
    and we have
    > [    0.000000] ASUS P2B-DS detected: force use of acpi=ht
    
    just don't load acpi_processor_init...
    
    Reported-and-tested-by: Jens Rosenboom <jens at leia.mcbone.net>
    Signed-off-by: Yinghai Lu <yinghai at kernel.org>
    Acked-by: Ingo Molnar <mingo at elte.hu>
    Cc: Len Brown <lenb at kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 0d288162f2afc42b37aab656f4622c076babbca3
Author: Michael Brunner <mibru at gmx.de>
Date:   Wed Aug 26 14:29:25 2009 -0700

    thermal_sys: check get_temp return value
    
    The return value of the get_temp function is not checked when doing a
    thermal zone update.  This may lead to a critical shutdown if get_temp
    fails and the content of the temp variable is incorrectly set higher than
    the critical trip point.
    
    This has been observed on a system with incorrect ACPI implementation
    where the corresponding methods were not serialized and therefore
    sometimes triggered ACPI errors (AE_ALREADY_EXISTS).  The following
    critical shutdowns indicated a temperature of 2097 C, which was obviously
    wrong.
    
    The patch adds a return value check that jumps over all trip point
    evaluations printing a warning if get_temp fails.  The trip points are
    evaluated again on the next polling interval with successful get_temp
    execution.
    
    Signed-off-by: Michael Brunner <mibru at gmx.de>
    Acked-by: Zhang Rui <rui.zhang at intel.com>
    Cc: Len Brown <lenb at kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 4ab6c08336535f8c8e42cf45d7adeda882eff06e
Author: Oleg Nesterov <oleg at redhat.com>
Date:   Wed Aug 26 14:29:24 2009 -0700

    clone(): fix race between copy_process() and de_thread()
    
    Spotted by Hiroshi Shimamoto who also provided the test-case below.
    
    copy_process() uses signal->count as a reference counter, but it is not.
    This test case
    
    	#include <sys/types.h>
    	#include <sys/wait.h>
    	#include <unistd.h>
    	#include <stdio.h>
    	#include <errno.h>
    	#include <pthread.h>
    
    	void *null_thread(void *p)
    	{
    		for (;;)
    			sleep(1);
    
    		return NULL;
    	}
    
    	void *exec_thread(void *p)
    	{
    		execl("/bin/true", "/bin/true", NULL);
    
    		return null_thread(p);
    	}
    
    	int main(int argc, char **argv)
    	{
    		for (;;) {
    			pid_t pid;
    			int ret, status;
    
    			pid = fork();
    			if (pid < 0)
    				break;
    
    			if (!pid) {
    				pthread_t tid;
    
    				pthread_create(&tid, NULL, exec_thread, NULL);
    				for (;;)
    					pthread_create(&tid, NULL, null_thread, NULL);
    			}
    
    			do {
    				ret = waitpid(pid, &status, 0);
    			} while (ret == -1 && errno == EINTR);
    		}
    
    		return 0;
    	}
    
    quickly creates an unkillable task.
    
    If copy_process(CLONE_THREAD) races with de_thread()
    copy_signal()->atomic(signal->count) breaks the signal->notify_count
    logic, and the execing thread can hang forever in kernel space.
    
    Change copy_process() to increment count/live only when we know for sure
    we can't fail.  In this case the forked thread will take care of its
    reference to signal correctly.
    
    If copy_process() fails, check CLONE_THREAD flag.  If it it set - do
    nothing, the counters were not changed and current belongs to the same
    thread group.  If it is not set, ->signal must be released in any case
    (and ->count must be == 1), the forked child is the only thread in the
    thread group.
    
    We need more cleanups here, in particular signal->count should not be used
    by de_thread/__exit_signal at all.  This patch only fixes the bug.
    
    Reported-by: Hiroshi Shimamoto <h-shimamoto at ct.jp.nec.com>
    Tested-by: Hiroshi Shimamoto <h-shimamoto at ct.jp.nec.com>
    Signed-off-by: Oleg Nesterov <oleg at redhat.com>
    Acked-by: Roland McGrath <roland at redhat.com>
    Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu at jp.fujitsu.com>
    Cc: <stable at kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 03ef83af528899aa339e42d8024b37e2f434fba4
Author: Minchan Kim <minchan.kim at gmail.com>
Date:   Wed Aug 26 14:29:23 2009 -0700

    mm: fix for infinite churning of mlocked pages
    
    An mlocked page might lose the isolatation race.  This causes the page to
    clear PG_mlocked while it remains in a VM_LOCKED vma.  This means it can
    be put onto the [in]active list.  We can rescue it by using try_to_unmap()
    in shrink_page_list().
    
    But now, As Wu Fengguang pointed out, vmscan has a bug.  If the page has
    PG_referenced, it can't reach try_to_unmap() in shrink_page_list() but is
    put into the active list.  If the page is referenced repeatedly, it can
    remain on the [in]active list without being moving to the unevictable
    list.
    
    This patch fixes it.
    
    Reported-by: Wu Fengguang <fengguang.wu at intel.com>
    Signed-off-by: Minchan Kim <minchan.kim at gmail.com>
    Reviewed-by: KOSAKI Motohiro <<kosaki.motohiro at jp.fujitsu.com>
    Cc: Lee Schermerhorn <lee.schermerhorn at hp.com>
    Acked-by: Rik van Riel <riel at redhat.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit b62e408c05228f40e69bb38a48db8961cac6cd23
Author: David Rientjes <rientjes at google.com>
Date:   Wed Aug 26 14:29:22 2009 -0700

    flex_array: convert element_nr formals to unsigned
    
    It's problematic to allow signed element_nr's or total's to be passed as
    part of the flex array API.
    
    flex_array_alloc() allows total_nr_elements to be set to a negative
    quantity, which is obviously erroneous.
    
    flex_array_get() and flex_array_put() allows negative array indices in
    dereferencing an array part, which could address memory mapped before
    struct flex_array.
    
    The fix is to convert all existing element_nr formals to be qualified as
    unsigned.  Existing checks to compare it to total_nr_elements or the max
    array size based on element_size need not be changed.
    
    Signed-off-by: David Rientjes <rientjes at google.com>
    Cc: Dave Hansen <dave at linux.vnet.ibm.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 8e7ee27095aee87b5db1b0061e2ceea5878a1bbd
Author: David Rientjes <rientjes at google.com>
Date:   Wed Aug 26 14:29:21 2009 -0700

    flex_array: declare parts member to have incomplete type
    
    The `parts' member of struct flex_array should evaluate to an incomplete
    type so that sizeof() cannot be used and C99 does not require the
    zero-length specification.
    
    Signed-off-by: David Rientjes <rientjes at google.com>
    Acked-by: Dave Hansen <dave at linux.vnet.ibm.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 105b6e8a74cac11cdf70903877593c7f202075cc
Author: David Rientjes <rientjes at google.com>
Date:   Wed Aug 26 14:29:20 2009 -0700

    flex_array: fix flex_array_free_parts comment
    
    flex_array_free_parts() does not take `src' or `element_nr' formals, so
    remove their respective comments.
    
    Signed-off-by: David Rientjes <rientjes at google.com>
    Acked-by: Dave Hansen <dave at linux.vnet.ibm.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit a30b595d2ca6d39e784a1bed5f2b35f3d7a03af7
Author: David Rientjes <rientjes at google.com>
Date:   Wed Aug 26 14:29:20 2009 -0700

    flex_array: fix get function for elements in base starting at non-zero
    
    If all array elements fit into the base structure and data is copied using
    flex_array_put() starting at a non-zero index, flex_array_get() will fail
    to return the data.
    
    This fixes the bug by only checking for NULL parts when all elements do
    not fit in the base structure when flex_array_get() is used.  Otherwise,
    fa_element_to_part_nr() will always be 0 since there are no parts
    structures needed and such element may never have been put.  Thus, it will
    remain NULL due to the kzalloc() of the base.
    
    Additionally, flex_array_put() now only checks for a NULL part when all
    elements do not fit in the base structure.  This is otherwise unnecessary
    since the base structure is guaranteed to exist (or we would have already
    hit a NULL pointer).
    
    Signed-off-by: David Rientjes <rientjes at google.com>
    Acked-by: Dave Hansen <dave at linux.vnet.ibm.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 054b2b13ccba4876a1ce98a7ede7dab7d6893d01
Author: Joonwoo Park <joonwpark81 at gmail.com>
Date:   Wed Aug 26 14:29:18 2009 -0700

    pps: fix incorrect verdict check
    
    Fix incorrect verdict check and returns error if device_create failed,
    otherwise driver triggers kernel oops.
    
    Signed-off-by: Joonwoo Park<joonwpark81 at gmail.com>
    Cc: Rodolfo Giometti <giometti at enneenne.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 53a7197aff20e341487fca8575275056fe1c63e5
Author: Eric Paris <eparis at redhat.com>
Date:   Wed Aug 26 14:56:48 2009 -0400

    IMA: iint put in ima_counts_get and put
    
    ima_counts_get() calls ima_iint_find_insert_get() which takes a reference
    to the iint in question, but does not put that reference at the end of the
    function.  This can lead to a nasty memory leak.  Easy enough to reproduce:
    
    #include <sys/mman.h>
    #include <stdio.h>
    
    int main (void)
    {
    	int i;
    	void *ptr;
    
    	for (i=0; i < 100000; i++) {
    		ptr = mmap(NULL, 4096, PROT_READ|PROT_WRITE,
    			   MAP_SHARED|MAP_ANONYMOUS, -1, 0);
    		if (ptr == MAP_FAILED)
    			return 2;
    		munmap(ptr, 4096);
    	}
    
    	return 0;
    }
    
    Signed-off-by: Eric Paris <eparis at redhat.com>
    Signed-off-by: James Morris <jmorris at namei.org>

commit 9848484fad9ddeb18f18f02f9ecdcd330ac9a216
Author: Geert Uytterhoeven <geert at linux-m68k.org>
Date:   Fri Aug 21 22:03:54 2009 +0200

    m68k,m68knommu: Wire up rt_tgsigqueueinfo and perf_counter_open
    
    Signed-off-by: Geert Uytterhoeven <geert at linux-m68k.org>
    Acked-by: Greg Ungerer <gerg at uclinux.org>

commit 9fd926b4ab1e38ac5e3eb3ba0afb56726d90aa88
Author: Alexey Dobriyan <adobriyan at gmail.com>
Date:   Thu Jul 9 17:08:38 2009 +0400

    m68k: Fix redefinition of pgprot_noncached
    
    arch/m68k/include/asm/pgtable_mm.h:148:1: warning: "pgprot_noncached" redefined
    In file included from arch/m68k/include/asm/pgtable_mm.h:138,
                     from arch/m68k/include/asm/pgtable.h:4,
                     from include/linux/mm.h:40,
                     from include/linux/pagemap.h:7,
                     from include/linux/blkdev.h:12,
                     from arch/m68k/emu/nfblock.c:17:
    include/asm-generic/pgtable.h:133:1: warning: this is the location of the previous definition
    
    pgprot_noncached() should be defined _before_ including asm-generic/pgtable.h
    
    Signed-off-by: Alexey Dobriyan <adobriyan at gmail.com>
    Signed-off-by: Geert Uytterhoeven <geert at linux-m68k.org>

commit dc71c7d5dbd8cd8bb6e3b548ddc0454b64ded5f8
Author: Andrew Morton <akpm at linux-foundation.org>
Date:   Wed Jun 17 13:13:58 2009 -0700

    arch/m68k/include/asm/motorola_pgalloc.h: fix kunmap arg
    
    arch/m68k/include/asm/motorola_pgalloc.h: In function 'pte_alloc_one':
    arch/m68k/include/asm/motorola_pgalloc.h:44: warning: passing argument 1 of 'kunmap' from incompatible pointer type
    
    Also, remove unneeded test for kmap() failure.
    
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Geert Uytterhoeven <geert at linux-m68k.org>

commit dd9b3e84f2095ed19582f4df5d20e1e40c01ca3c
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Wed Jun 17 13:13:57 2009 -0700

    m68k: cnt reaches -1, not 0
    
    With the postfix decrement cnt reaches -1 rather than 0.
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Cc: Geert Uytterhoeven <geert at linux-m68k.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Geert Uytterhoeven <geert at linux-m68k.org>

commit dac9ff79a8122b30176e23359bb879b3144d7f1f
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Wed Jun 17 13:13:56 2009 -0700

    m68k: count can reach 51, not 50
    
    With while (count++ < 50) { ...  } count can reach 51, not 50, so we
    shouldn't give an error message on a count of 50.
    
    [akpm at linux-foundation.org: coding-style fixes]
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Cc: Geert Uytterhoeven <geert at linux-m68k.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Geert Uytterhoeven <geert at linux-m68k.org>

commit 3161e453e496eb5643faad30fff5a5ab183da0fe
Author: Rusty Russell <rusty at rustcorp.com.au>
Date:   Wed Aug 26 12:22:32 2009 -0700

    virtio: net refill on out-of-memory
    
    If we run out of memory, use keventd to fill the buffer.  There's a
    report of this happening: "Page allocation failures in guest",
    Message-ID: <20090713115158.0a4892b0 at mjolnir.ossman.eu>
    
    Signed-off-by: Rusty Russell <rusty at rustcorp.com.au>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 0b4f2928f14c4a9770b0866923fc81beb7f4aa57
Author: Alexey Dobriyan <adobriyan at gmail.com>
Date:   Wed Aug 26 12:03:35 2009 -0700

    smc91x: fix compilation on SMP
    
    Signed-off-by: Alexey Dobriyan <adobriyan at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit ced909ff048c9950e211783417f3c01361f3be28
Author: Dmitry Torokhov <dmitry.torokhov at gmail.com>
Date:   Tue Aug 25 19:24:10 2009 -0700

    Input: i8042 - add Acer Aspire 5536 to the nomux list
    
    When KBC is in active multiplexing mode, disabling and re-enabling the
    touchpad with the special key leaves the touchpad dead. Since the laptop
    does not have any external PS/2 ports disabling MUX mode should be safe.
    
    Reported-by: Eugeniy Meshcheryakov <eugen at debian.org>
    Signed-off-by: Dmitry Torokhov <dtor at mail.ru>

commit 295594e9cf6ae2efd73371777aa8feba0f87f42f
Author: Yinghai Lu <yinghai at kernel.org>
Date:   Tue Aug 25 13:44:44 2009 -0700

    x86: Fix vSMP boot crash
    
    2.6.31-rc7 does not boot on vSMP systems:
    
    [    8.501108] CPU31: Thermal monitoring enabled (TM1)
    [    8.501127] CPU 31 MCA banks SHD:2 SHD:3 SHD:5 SHD:6 SHD:8
    [    8.650254] CPU31: Intel(R) Xeon(R) CPU           E5540  @ 2.53GHz stepping 04
    [    8.710324] Brought up 32 CPUs
    [    8.713916] Total of 32 processors activated (162314.96 BogoMIPS).
    [    8.721489] ERROR: parent span is not a superset of domain->span
    [    8.727686] ERROR: domain->groups does not contain CPU0
    [    8.733091] ERROR: groups don't span domain->span
    [    8.737975] ERROR: domain->cpu_power not set
    [    8.742416]
    
    Ravikiran Thirumalai bisected it to:
    
    | commit 2759c3287de27266e06f1f4e82cbd2d65f6a044c
    | x86: don't call read_apic_id if !cpu_has_apic
    
    The problem is that on vSMP systems the CPUID derived
    initial-APICIDs are overlapping - so we need to fall
    back on hard_smp_processor_id() which reads the local
    APIC.
    
    Both come from the hardware (influenced by firmware
    though) so it's a tough call which one to trust.
    
    Doing the quirk expresses the vSMP property properly
    and also does not affect other systems, so we go for
    this solution instead of a revert.
    
    Reported-and-Tested-by: Ravikiran Thirumalai <kiran at scalex86.org>
    Signed-off-by: Yinghai Lu <yinghai at kernel.org>
    Cc: Linus Torvalds <torvalds at linux-foundation.org>
    Cc: Cyrill Gorcunov <gorcunov at gmail.com>
    Cc: Shai Fultheim <shai at scalex86.org>
    Cc: Suresh Siddha <suresh.b.siddha at intel.com>
    LKML-Reference: <4A944D3C.5030100 at kernel.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit f415c413f458837bd0c27086b79aca889f9435e4
Merge: 4dc627d55edad85e26ae81f17634bd4590993ba0 4484b9c8b4976acee181d377f8ba571109d1a2be
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 25 21:24:49 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      irda/sa1100_ir: fix broken netdev_ops conversion
      irda/au1k_ir: fix broken netdev_ops conversion
      pkt_sched: Fix bogon in tasklet_hrtimer changes.

commit 4dc627d55edad85e26ae81f17634bd4590993ba0
Merge: 9c9376886622b45c32f64c4444f5628dde77dfe6 d8ed1d43e17898761c7221014a15a4c7501d2ff3
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 25 21:24:26 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-2.6:
      sparc64: Validate linear D-TLB misses.
      sparc64: Update defconfig.
      sparc32: Update defconfig.
      sparc32: Kill trap table freeing code.
      sparc: sys32.S incorrect compat-layer splice() system call
      sparc: Use page_fault_out_of_memory() for VM_FAULT_OOM.
      sparc64: Sign extend length arg to truncate syscalls when compat.
      sparc: Fix cleanup crash in bbc_envctrl_cleanup()

commit 7adb4df410966dfe43e4815256e3215110648fb8
Author: H. Peter Anvin <hpa at zytor.com>
Date:   Tue Aug 25 21:06:03 2009 -0700

    x86, xen: Initialize cx to suppress warning
    
    Initialize cx before calling xen_cpuid(), in order to suppress the
    "may be used uninitialized in this function" warning.
    
    Signed-off-by: H. Peter Anvin <hpa at zytor.com>
    Cc: Jeremy Fitzhardinge <jeremy at goop.org>

commit d560bc61575efae43595cbcb56d0ba3b9450139c
Author: Jeremy Fitzhardinge <jeremy at goop.org>
Date:   Tue Aug 25 12:53:02 2009 -0700

    x86, xen: Suppress WP test on Xen
    
    Xen always runs on CPUs which properly support WP enforcement in
    privileged mode, so there's no need to test for it.
    
    This also works around a crash reported by Arnd Hannemann, though I
    think its just a band-aid for that case.
    
    Reported-by: Arnd Hannemann <hannemann at nets.rwth-aachen.de>
    Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge at citrix.com>
    Acked-by: Pekka Enberg <penberg at cs.helsinki.fi>
    Signed-off-by: H. Peter Anvin <hpa at zytor.com>

commit 4484b9c8b4976acee181d377f8ba571109d1a2be
Author: Alexander Beregalov <a.beregalov at gmail.com>
Date:   Tue Aug 25 20:39:37 2009 -0700

    irda/sa1100_ir: fix broken netdev_ops conversion
    
    This patch is based on commit d2f3ad4 (pxaficp-ir: remove incorrect
    net_device_ops). Do the same for sa1100_ir.
    Untested.
    
    Signed-off-by: Alexander Beregalov <a.beregalov at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 730a9cfc2dcead5538c0c96a046000d97140b0c0
Author: Alexander Beregalov <a.beregalov at gmail.com>
Date:   Tue Aug 25 20:39:18 2009 -0700

    irda/au1k_ir: fix broken netdev_ops conversion
    
    This patch is based on commit d2f3ad4 (pxaficp-ir: remove incorrect
    net_device_ops). Do the same for au1k_ir.
    Untested.
    
    Signed-off-by: Alexander Beregalov <a.beregalov at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit d8ed1d43e17898761c7221014a15a4c7501d2ff3
Author: David S. Miller <davem at davemloft.net>
Date:   Tue Aug 25 16:47:46 2009 -0700

    sparc64: Validate linear D-TLB misses.
    
    When page alloc debugging is not enabled, we essentially accept any
    virtual address for linear kernel TLB misses.  But with kgdb, kernel
    address probing, and other facilities we can try to access arbitrary
    crap.
    
    So, make sure the address we miss on will translate to physical memory
    that actually exists.
    
    In order to make this work we have to embed the valid address bitmap
    into the kernel image.  And in order to make that less expensive we
    make an adjustment, in that the max physical memory address is
    decreased to "1 << 41", even on the chips that support a 42-bit
    physical address space.  We can do this because bit 41 indicates
    "I/O space" and thus covers non-memory ranges.
    
    The result of this is that:
    
    1) kpte_linear_bitmap shrinks from 2K to 1K in size
    
    2) we need 64K more for the valid address bitmap
    
    We can't let the valid address bitmap be dynamically allocated
    once we start using it to validate TLB misses, otherwise we have
    crazy issues to deal with wrt. recursive TLB misses and such.
    
    If we're in a TLB miss it could be the deepest trap level that's legal
    inside of the cpu.  So if we TLB miss referencing the bitmap, the cpu
    will be out of trap levels and enter RED state.
    
    To guard against out-of-range accesses to the bitmap, we have to check
    to make sure no bits in the physical address above bit 40 are set.  We
    could export and use last_valid_pfn for this check, but that's just an
    unnecessary extra memory reference.
    
    On the plus side of all this, since we load all of these translations
    into the special 4MB mapping TSB, and we check the TSB first for TLB
    misses, there should be absolutely no real cost for these new checks
    in the TLB miss path.
    
    Reported-by: heyongli at gmail.com
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 9c9376886622b45c32f64c4444f5628dde77dfe6
Merge: 87bcfa33669449e517fda718ed3c2e1899e6541b 4464fcaa9cbfc9c551956b48af203e2f775ca892
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 25 11:24:37 2009 -0700

    Merge branch 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      perf_counter: Fix typo in read() output generation
      perf tools: Check perf.data owner

commit 87bcfa33669449e517fda718ed3c2e1899e6541b
Merge: 44afa9a4b8c5773f47e6494da12ca086c9ffea34 ec9c96ef3cc0124cb94375b17faaa8cff5dfdf97
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 25 11:24:24 2009 -0700

    Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      dma-debug: Fix check_unmap null pointer dereference

commit 44afa9a4b8c5773f47e6494da12ca086c9ffea34
Merge: 7d63e6359a2e86cd6335337de99354ab07680c55 f833bab87fca5c3ce13778421b1365845843b976
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 25 11:24:04 2009 -0700

    Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      clockevent: Prevent dead lock on clockevents_lock
      timers: Drop write permission on /proc/timer_list

commit 7d63e6359a2e86cd6335337de99354ab07680c55
Merge: 9f459fadbb38abe68aa342f533ca17d8d90d6f2e 4a683bf94b8a10e2bb0da07aec3ac0a55e5de61f
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 25 11:23:43 2009 -0700

    Merge branch 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      tracing: Fix too large stack usage in do_one_initcall()
      tracing: handle broken names in ftrace filter
      ftrace: Unify effect of writing to trace_options and option/*

commit 9f459fadbb38abe68aa342f533ca17d8d90d6f2e
Merge: e9cab24cf3e5610898fb26bfd664615d0fd6a8d6 c62e43202e7cf50ca24bce58b255df7bf5de69d0
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 25 11:23:25 2009 -0700

    Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86: Fix build with older binutils and consolidate linker script
      x86: Fix an incorrect argument of reserve_bootmem()
      x86: add vmlinux.lds to targets in arch/x86/boot/compressed/Makefile
      xen: rearrange things to fix stackprotector
      x86: make sure load_percpu_segment has no stackprotector
      i386: Fix section mismatches for init code with !HOTPLUG_CPU
      x86, pat: Allow ISA memory range uncacheable mapping requests

commit e9cab24cf3e5610898fb26bfd664615d0fd6a8d6
Merge: a206e9417f19cf42156249953b72223a0076dc6b 3c4cec65274481ec6332b0a91f19b4c8c5394801
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 25 09:47:36 2009 -0700

    Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6
    
    * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6:
      ext3: Improve error message that changing journaling mode on remount is not possible
      ext3: Update Kconfig description of EXT3_DEFAULTS_TO_ORDERED

commit a206e9417f19cf42156249953b72223a0076dc6b
Merge: 7cafe60550469ad80e990d9223c4b5d501635015 b1ddaf681e362ed453182ddee1699d7487069a16
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 25 09:47:06 2009 -0700

    Merge branch 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6
    
    * 'fix/misc' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
      sound: pcm_lib: fix unsorted list constraint handling
      sound: vx222: fix input level control range check
      ALSA: ali5451: fix timeout handling in snd_ali_{codecs,timer}_ready()

commit 7cafe60550469ad80e990d9223c4b5d501635015
Merge: 5c58ceff103d8a654f24769bb1baaf84a841b0cc c5e7f5a38a7ebf3697281bc7cb494e676f287ac0
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 25 09:30:58 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
      [WATCHDOG] ar7_wdt: fix path to ar7-specific headers

commit 5c58ceff103d8a654f24769bb1baaf84a841b0cc
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 25 09:12:43 2009 -0700

    tty: make sure to flush any pending work when halting the ldisc
    
    When I rewrote tty ldisc code to use proper reference counts (commits
    65b770468e98 and cbe9352fa08f) in order to avoid a race with hangup, the
    test-program that Eric Biederman used to trigger the original problem
    seems to have exposed another long-standing bug: the hangup code did the
    'tty_ldisc_halt()' to stop any buffer flushing activity, but unlike the
    other call sites it never actually flushed any pending work.
    
    As a result, if you get just the right timing, the pending work may be
    just about to execute (ie the timer has already triggered and thus
    cancel_delayed_work() was a no-op), when we then re-initialize the ldisc
    from under it.
    
    That, in turn, results in various random problems, usually seen as a
    NULL pointer dereference in run_timer_softirq() or a BUG() in
    worker_thread (but it can be almost anything).
    
    Fix it by adding the required 'flush_scheduled_work()' after doing the
    tty_ldisc_halt() (this also requires us to move the ldisc halt to before
    taking the ldisc mutex in order to avoid a deadlock with the workqueue
    executing do_tty_hangup, which requires the mutex).
    
    The locking should be cleaned up one day (the requirement to do this
    outside the ldisc_mutex is very annoying, and weakens the lock), but
    that's a larger and separate undertaking.
    
    Reported-by: Eric W. Biederman <ebiederm at xmission.com>
    Tested-by: Xiaotian Feng <xtfeng at gmail.com>
    Tested-by: Yanmin Zhang <yanmin_zhang at linux.intel.com>
    Tested-by: Dave Young <hidave.darkstar at gmail.com>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Greg Kroah-Hartman <gregkh at suse.de>
    Cc: Alan Cox <alan at lxorguk.ukuu.org.uk>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit c62e43202e7cf50ca24bce58b255df7bf5de69d0
Author: Jan Beulich <JBeulich at novell.com>
Date:   Tue Aug 25 14:50:53 2009 +0100

    x86: Fix build with older binutils and consolidate linker script
    
    binutils prior to 2.17 can't deal with the currently possible
    situation of a new segment following the per-CPU segment, but
    that new segment being empty - objcopy misplaces the .bss (and
    perhaps also the .brk) sections outside of any segment.
    
    However, the current ordering of sections really just appears
    to be the effect of cumulative unrelated changes; re-ordering
    things allows to easily guarantee that the segment following
    the per-CPU one is non-empty, and at once eliminates the need
    for the bogus data.init2 segment.
    
    Once touching this code, also use the various data section
    helper macros from include/asm-generic/vmlinux.lds.h.
    
    -v2: fix !SMP builds.
    
    Signed-off-by: Jan Beulich <jbeulich at novell.com>
    Cc: <sam at ravnborg.org>
    LKML-Reference: <4A94085D02000078000119A5 at vpn.id2.novell.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit b1ddaf681e362ed453182ddee1699d7487069a16
Author: Clemens Ladisch <clemens at ladisch.de>
Date:   Tue Aug 25 08:15:41 2009 +0200

    sound: pcm_lib: fix unsorted list constraint handling
    
    snd_interval_list() expected a sorted list but did not document this, so
    there are drivers that give it an unsorted list.  To fix this, change
    the algorithm to work with any list.
    
    This fixes the "Slave PCM not usable" error with USB devices that have
    multiple alternate settings with sample rates in decreasing order, such
    as the Philips Askey VC010 WebCam.
    
    http://bugzilla.kernel.org/show_bug.cgi?id=14028
    
    Reported-and-tested-by: Andrzej <adkadk at gmail.com>
    Signed-off-by: Clemens Ladisch <clemens at ladisch.de>
    Cc: <stable at kernel.org>
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

commit a2cb6a4dd470d7a64255a10b843b0d188416b78f
Author: David S. Miller <davem at davemloft.net>
Date:   Mon Aug 24 19:37:05 2009 -0700

    pkt_sched: Fix bogon in tasklet_hrtimer changes.
    
    Reported by Stephen Rothwell, luckily it's harmless:
    
    net/sched/sch_api.c: In function 'qdisc_watchdog':
    net/sched/sch_api.c:460: warning: initialization from incompatible pointer type
    net/sched/sch_cbq.c: In function 'cbq_undelay':
    net/sched/sch_cbq.c:595: warning: initialization from incompatible pointer type
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit f8aed700c6ec46ddade6570004ce25332283b306
Author: Ma Ling <ling.ma at intel.com>
Date:   Mon Aug 24 13:50:24 2009 +0800

    drm/i915: Set crtc/clone mask in different output devices
    
    Based on Bspec each encoder has different sharing pipe property,
    i.e. Integrated or SDVO TV both will occupy one pipe exclusively,
    and sdvo-non-tv and crt are allowed to share one. The patch moves
    sharing judgment into differnet output functions, and sets the right
    clone bit.
    
    This fixes both HDMI outputs choosing the same pipe.
    
    https://bugs.freedesktop.org/show_bug.cgi?id=22247
    
    Signed-off-by: Ma Ling <ling.ma at intel.com>
    Reviewed-by : Jesse Barnes <jbarnes at virtuousgeek.org>
    Signed-off-by: Zhao Yakui <yakui.zhao at intel.com>
    Signed-off-by: Eric Anholt <eric at anholt.net>

commit 27185ae1b795a4ba5e25b95fb5584e950545d774
Author: Ma Ling <ling.ma at intel.com>
Date:   Mon Aug 24 13:50:23 2009 +0800

    drm/i915: Always use SDVO_B detect bit for SDVO output detection.
    
    After the following commit is shipped, the SDVO C detection will depend on
    the SDVO_C/DP detion bit.
    commit 13520b051e8888dd3af9bda639d83e7df76613d1
    Author: Kristian Høgsberg <krh at redhat.com>
    Date:   Fri Mar 13 15:42:14 2009 -0400
    
        drm/i915: Read the right SDVO register when detecting SVDO/HDMI.
    
    According to the spec we should continue to detect the SDVO_B/C based on
    the SDVO_B detection bit.  The new detection bit on G4X platform is for
    the HDMI_C detection rather than SDVO_C detection.
    
    https://bugs.freedesktop.org/show_bug.cgi?id=20639
    
    Signed-off-by: Ma Ling <ling.ma at intel.com>
    Acked-by: Zhao Yakui <yakui.zhao at intel.com>
    Signed-off-by: Eric Anholt <eric at anholt.net>

commit 19e1f888c681d9f71ae0a814902d334eac1911dd
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Sun Aug 9 13:50:53 2009 +0200

    drm/i915: Fix typo that broke SVID1 in intel_sdvo_multifunc_encoder()
    
    Bit SDVO_OUTPUT_SVID0 was tested twice
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: Eric Anholt <eric at anholt.net>

commit bc5e5718acd7f7d000d913e619562767863610bf
Author: Bruno Prémont <bonbons at linux-vserver.org>
Date:   Sat Aug 8 13:01:17 2009 +0200

    drm/i915: Check if BIOS enabled dual-channel LVDS on 8xx, not only on 9xx
    
    Commit 0c2e39525b3b53a97a0202c5f35058147e53977e is not sufficient to
    get fd.o bug #20115 fixed.
    In addition intel_find_best_PLL() must not only rely on BIOS settings
    for i9xx chips but also for i8xx, so drop the IS_I9XX() check.
    
    Signed-off-by: Bruno Prémont <bonbons at linux-vserver.org>
    Signed-off-by: Eric Anholt <eric at anholt.net>

commit 942642a412454c3365f0abc8399c8ef2944f4eac
Author: Sean Young <sean at mess.org>
Date:   Thu Aug 6 17:35:50 2009 +0800

    drm/i915: Set the multiplier for SDVO on G33 platform
    
    http://bugs.freedesktop.org/show_bug.cgi?id=21417
    
    Signed-off-by: Sean Young <sean at mess.org>
    Reviewed-by: Zhao Yakui <yakui.zhao at intel.com>
    Acked-by: Zhenyu Wang <zhenyuw at linux.intel.com>
    Signed-off-by: Eric Anholt <eric at anholt.net>

commit 7111dc73923e9737b38a3ef5b5f236109000ff28
Author: Trond Myklebust <Trond.Myklebust at netapp.com>
Date:   Mon Aug 24 19:21:29 2009 -0400

    NFSv4: Fix an infinite looping problem with the nfs4_state_manager
    
    Commit 76db6d9500caeaa774a3e32a997eba30bbdc176b (nfs41: add session setup
    to the state manager) introduces an infinite loop possibility in the NFSv4
    state manager. By first checking nfs4_has_session() before clearing the
    NFS4CLNT_SESSION_SETUP flag, it allows for a situation where someone sets
    that flag, but it never gets cleared, and so the state manager loops.
    
    In fact commit c3fad1b1aaf850bf692642642ace7cd0d64af0a3 (nfs41: add session
    reset to state manager) causes this to happen every time we get a network
    partition error.
    
    Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
    Tested-by: Daniel J Blueman <daniel.blueman at gmail.com>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 2584e7986f235572d4b03bbe52fd1e85c1679b8e
Merge: 7c0a57d5c47bcfc492b3139e77400f888a935c44 c795b33ba171e41563ab7e25105c0cd4edd81cd7
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 24 14:41:28 2009 -0700

    Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2
    
    * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2:
      ocfs2/dlm: Wait on lockres instead of erroring cancel requests
      ocfs2: Add missing lock name
      ocfs2: Don't oops in ocfs2_kill_sb on a failed mount
      ocfs2: release the buffer head in ocfs2_do_truncate.
      ocfs2: Handle quota file corruption more gracefully

commit 7c0a57d5c47bcfc492b3139e77400f888a935c44
Merge: 353d5c30c666580347515da609dd74a2b8e9b828 94da210af4978b94cb70318bd1b282a73c50b175
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 24 12:53:45 2009 -0700

    Merge branch 'fixes' of git://git.marvell.com/orion
    
    * 'fixes' of git://git.marvell.com/orion:
      [ARM] Orion NAND: Make asm volatile avoid GCC pushing ldrd out of the loop
      [ARM] Kirkwood: enable eSATA on QNAP TS-219P
      [ARM] Kirkwood: __init requires linux/init.h

commit 353d5c30c666580347515da609dd74a2b8e9b828
Author: Hugh Dickins <hugh.dickins at tiscali.co.uk>
Date:   Mon Aug 24 16:30:28 2009 +0100

    mm: fix hugetlb bug due to user_shm_unlock call
    
    2.6.30's commit 8a0bdec194c21c8fdef840989d0d7b742bb5d4bc removed
    user_shm_lock() calls in hugetlb_file_setup() but left the
    user_shm_unlock call in shm_destroy().
    
    In detail:
    Assume that can_do_hugetlb_shm() returns true and hence user_shm_lock()
    is not called in hugetlb_file_setup(). However, user_shm_unlock() is
    called in any case in shm_destroy() and in the following
    atomic_dec_and_lock(&up->__count) in free_uid() is executed and if
    up->__count gets zero, also cleanup_user_struct() is scheduled.
    
    Note that sched_destroy_user() is empty if CONFIG_USER_SCHED is not set.
    However, the ref counter up->__count gets unexpectedly non-positive and
    the corresponding structs are freed even though there are live
    references to them, resulting in a kernel oops after a lots of
    shmget(SHM_HUGETLB)/shmctl(IPC_RMID) cycles and CONFIG_USER_SCHED set.
    
    Hugh changed Stefan's suggested patch: can_do_hugetlb_shm() at the
    time of shm_destroy() may give a different answer from at the time
    of hugetlb_file_setup().  And fixed newseg()'s no_id error path,
    which has missed user_shm_unlock() ever since it came in 2.6.9.
    
    Reported-by: Stefan Huber <shuber2 at gmail.com>
    Signed-off-by: Hugh Dickins <hugh.dickins at tiscali.co.uk>
    Tested-by: Stefan Huber <shuber2 at gmail.com>
    Cc: stable at kernel.org
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 0257a0c0c1997aac28420e784b3ef8f3ce17f093
Merge: e40c9056db75e093e6d99d2c14510cb131eb482a 9f844e5118d1627025c8ea7cfc0ea69038ea63fd
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 24 12:48:41 2009 -0700

    Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6
    
    * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
      drm/radeon/kms: Fix radeon_gem_busy_ioctl harder.

commit e40c9056db75e093e6d99d2c14510cb131eb482a
Merge: 22e93eddd9c63c61e5a38b82eea08f6095189e7f 92c548cd35d50df398f442b07021150094578460
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 24 12:26:48 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/hskinnemoen/avr32-2.6:
      favr32: improve touchscreen response
      avr32/lib: fix unaligned memcpy where len < 4
      avr32/lib: fix unaligned memcpy()

commit 22e93eddd9c63c61e5a38b82eea08f6095189e7f
Merge: 1cac6ec9b7f9c48a26309380656f399a0587b860 9b2fb2da4edfb163842800abbeb4c14bc1759469
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 24 12:25:27 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
      Input: ucb1400_ts - enable interrupt unconditionally
      Input: ucb1400_ts - enable ADC Filter
      Input: wacom - don't use on-stack memory for report buffers
      Input: iforce - support new revision of ACT LABS Force RS
      Input: joydev - decouple axis and button map ioctls from input constants

commit 1cac6ec9b7f9c48a26309380656f399a0587b860
Merge: ce0cfd4ca817dbfd5f8267e7a6a235ed2041bf4a 8ff499e43c537648399fca8ba39d24c0768b3fab
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 24 12:25:03 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      smc91x: let smc91x work well under netpoll
      pxaficp-ir: remove incorrect net_device_ops
      NET: llc, zero sockaddr_llc struct
      drivers/net: fixed drivers that support netpoll use ndo_start_xmit()
      netpoll: warning for ndo_start_xmit returns with interrupts enabled
      net: Fix Micrel KSZ8842 Kconfig description
      netfilter: xt_quota: fix wrong return value (error case)
      ipv6: Fix commit 63d9950b08184e6531adceb65f64b429909cc101 (ipv6: Make v4-mapped bindings consistent with IPv4)
      E100: fix interaction with swiotlb on X86.
      pkt_sched: Convert CBQ to tasklet_hrtimer.
      pkt_sched: Convert qdisc_watchdog to tasklet_hrtimer
      rtl8187: always set MSR_LINK_ENEDCA flag with RTL8187B
      ibm_newemac: emac_close() needs to call netif_carrier_off()
      net: fix ks8851 build errors
      net: Rename MAC platform driver for w90p910 platform
      yellowfin: Fix buffer underrun after dev_alloc_skb() failure
      orinoco: correct key bounds check in orinoco_hw_get_tkip_iv
      mac80211: fix todo lock

commit ce0cfd4ca817dbfd5f8267e7a6a235ed2041bf4a
Merge: 637952ca689013339b977558061fa4ca8e07e1c1 16bfa38b1936212428cb38fbfbbb8f6c62b8d81f
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 24 12:24:01 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
      ima: hashing large files bug fix
      kernel_read: redefine offset type

commit a6a06f7b577f89d0b916c5ccaff67ca5ed444a78
Author: Amerigo Wang <amwang at redhat.com>
Date:   Fri Aug 21 04:34:45 2009 -0400

    x86: Fix an incorrect argument of reserve_bootmem()
    
    This line looks suspicious, because if this is true, then the
    'flags' parameter of function reserve_bootmem_generic() will be
    unused when !CONFIG_NUMA. I don't think this is what we want.
    
    Signed-off-by: WANG Cong <amwang at redhat.com>
    Cc: Yinghai Lu <yinghai at kernel.org>
    Cc: akpm at linux-foundation.org
    LKML-Reference: <20090821083709.5098.52505.sendpatchset at localhost.localdomain>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 94da210af4978b94cb70318bd1b282a73c50b175
Author: Simon Kagstrom <simon.kagstrom at netinsight.net>
Date:   Thu Aug 20 09:19:53 2009 +0200

    [ARM] Orion NAND: Make asm volatile avoid GCC pushing ldrd out of the loop
    
    GCC 4.3.3 and 4.4.1 happily moves the dword load instruction out of the
    loop in orion_nand_read_buf. This patch makes the instruction volatile
    to avoid the issue. I've discussed this at gcc-help, refer to the thread
    at
    
      http://gcc.gnu.org/ml/gcc-help/2009-08/msg00187.html
    
    The early clobber is added to avoid the destination registers and the
    source register overlapping.
    
    Signed-off-by: Simon Kagstrom <simon.kagstrom at netinsight.net>
    Signed-off-by: Nicolas Pitre <nico at marvell.com>

commit c55bf102b675c94edef006ce487d909669221d90
Author: John Holland <john.holland at cellent-fs.de>
Date:   Wed Aug 19 13:24:03 2009 -1000

    [ARM] Kirkwood: enable eSATA on QNAP TS-219P
    
    Initialize PCI/PCIe on the QNAP TS-119, TS-219 and TS-219P hardware
    allowing the use of the discrete eSATA controller connected to the PCIe
    bus in the TS-219P.
    
    Signed-off-by: John Holland <john.holland at cellent-fs.de>
    Tested-by: Thomas Reitmayr <treitmayr at devbase.at>
    Signed-off-by: Martin Michlmayr <tbm at cyrius.com>
    Signed-off-by: Nicolas Pitre <nico at marvell.com>

commit 3e475f579e56caf57cadc0cc995c152f9da641a9
Author: Martin Michlmayr <tbm at cyrius.com>
Date:   Mon Aug 17 23:34:10 2009 -1000

    [ARM] Kirkwood: __init requires linux/init.h
    
    Include linux/init.h for __init to fix this error:
    
    CC [M]  drivers/net/wireless/wl12xx/boot.o
    In file included from arch/arm/mach-kirkwood/include/mach/gpio.h:13,
                     from arch/arm/include/asm/gpio.h:5,
                     from include/linux/gpio.h:7,
                     from drivers/net/wireless/wl12xx/boot.c:24:
    arch/arm/plat-orion/include/plat/gpio.h:32: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ before ‘orion_gpio_init’
    make[6]: *** [drivers/net/wireless/wl12xx/boot.o] Error 1
    make[5]: *** [drivers/net/wireless/wl12xx] Error 2
    
    Signed-off-by: Martin Michlmayr <tbm at cyrius.com>
    Signed-off-by: Nicolas Pitre <nico at marvell.com>

commit 3c4cec65274481ec6332b0a91f19b4c8c5394801
Author: Jan Kara <jack at suse.cz>
Date:   Mon Aug 24 16:38:43 2009 +0200

    ext3: Improve error message that changing journaling mode on remount is not possible
    
    This patch makes the error message about changing journaling mode on remount
    more descriptive. Some people are going to hit this error now due to commit
    bbae8bcc49bc4d002221dab52c79a50a82e7cd1f if they configure a kernel to default
    to data=writeback mode. The problem happens if they have data=ordered set for
    the root filesystem in /etc/fstab but not in the kernel command line (and they
    don't use initrd). Their filesystem then gets mounted as data=writeback by
    kernel but then their boot fails because init scripts won't be able to remount
    the filesystem rw. Better error message will hopefully make it easier for them
    to find the error in their setup and bother us less with error reports :).
    
    Signed-off-by: Jan Kara <jack at suse.cz>

commit 6d41807614151829ae17a3a58bff8572af5e407e
Author: Theodore Ts'o <tytso at mit.edu>
Date:   Mon Aug 10 16:03:43 2009 -0400

    ext3: Update Kconfig description of EXT3_DEFAULTS_TO_ORDERED
    
    The old description for this configuration option was perhaps not
    completely balanced in terms of describing the tradeoffs of using a
    default of data=writeback vs. data=ordered.  Despite the fact that old
    description very strongly recomended disabling this feature, all of
    the major distributions have elected to preserve the existing 'legacy'
    default, which is a strong hint that it perhaps wasn't telling the
    whole story.
    
    This revised description has been vetted by a number of ext3
    developers as being better at informing the user about the tradeoffs
    of enabling or disabling this configuration feature.
    
    Cc: linux-ext4 at vger.kernel.org
    Signed-off-by: "Theodore Ts'o" <tytso at mit.edu>
    Signed-off-by: Jan Kara <jack at suse.cz>

commit edd1365e90eb32625041d09de427d7b03461bc5c
Author: Clemens Ladisch <clemens at ladisch.de>
Date:   Mon Aug 24 09:11:58 2009 +0200

    sound: vx222: fix input level control range check
    
    Fix a logic error in the range check of the input level control that
    would prevent setting any volume less than the maximum.
    
    Signed-off-by: Clemens Ladisch <clemens at ladisch.de>
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

commit 8ff499e43c537648399fca8ba39d24c0768b3fab
Author: Dongdong Deng <dongdong.deng at windriver.com>
Date:   Sun Aug 23 22:59:04 2009 -0700

    smc91x: let smc91x work well under netpoll
    
    The NETPOLL requires that interrupts remain disabled in its callbacks.
    
    Using *_irq_save()/irq_restore() to replace *_irq_disable()/irq_enable()
    functions in NETPOLL's callbacks of smc91x, so that it doesn't enable
    interrupts when already disabled, and kgdboe/netconsole would work
    properly over smc91x.
    
    Signed-off-by: Dongdong Deng <dongdong.deng at windriver.com>
    Acked-by: Nicolas Pitre <nico at cam.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit d2f3ad4cedc00c8ee848e7abe9b2bbc93b9a8c2d
Author: Marek Vasut <marek.vasut at gmail.com>
Date:   Sun Aug 23 22:57:30 2009 -0700

    pxaficp-ir: remove incorrect net_device_ops
    
    This patch fixes broken pxaficp-ir. The problem was in incorrect
    net_device_ops being specified which prevented the driver from
    operating. The symptoms were:
     - failing ifconfig for IrLAN, resulting in
    	SIOCSIFFLAGS: Cannot assign requested address
     - irattach working for IrCOMM, but the port stayed disabled
    
    Moreover this patch corrects missing sysfs device link.
    
    Signed-off-by: Marek Vasut <marek.vasut at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 28e9fc592cb8c7a43e4d3147b38be6032a0e81bc
Author: Jiri Slaby <jirislaby at gmail.com>
Date:   Sun Aug 23 22:55:51 2009 -0700

    NET: llc, zero sockaddr_llc struct
    
    sllc_arphrd member of sockaddr_llc might not be changed. Zero sllc
    before copying to the above layer's structure.
    
    Signed-off-by: Jiri Slaby <jirislaby at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 16bfa38b1936212428cb38fbfbbb8f6c62b8d81f
Author: Mimi Zohar <zohar at linux.vnet.ibm.com>
Date:   Fri Aug 21 14:32:49 2009 -0400

    ima: hashing large files bug fix
    
    Hashing files larger than INT_MAX causes process to loop.
    Dependent on redefining kernel_read() offset type to loff_t.
    
    (http://bugzilla.kernel.org/show_bug.cgi?id=13909)
    
    Cc: stable at kernel.org
    Signed-off-by: Mimi Zohar <zohar at us.ibm.com>
    Signed-off-by: James Morris <jmorris at namei.org>

commit 6777d773a463ac045d333b989d4e44660f8d92ad
Author: Mimi Zohar <zohar at linux.vnet.ibm.com>
Date:   Fri Aug 21 14:32:48 2009 -0400

    kernel_read: redefine offset type
    
    vfs_read() offset is defined as loff_t, but kernel_read()
    offset is only defined as unsigned long. Redefine
    kernel_read() offset as loff_t.
    
    Cc: stable at kernel.org
    Signed-off-by: Mimi Zohar <zohar at us.ibm.com>
    Signed-off-by: James Morris <jmorris at namei.org>

commit 4871953c0ef2cafeb37bbe186d9d13dcb24fc2c5
Author: Dongdong Deng <dongdong.deng at windriver.com>
Date:   Sun Aug 23 19:49:07 2009 -0700

    drivers/net: fixed drivers that support netpoll use ndo_start_xmit()
    
    The NETPOLL API requires that interrupts remain disabled in
    netpoll_send_skb(). The use of "A functions set" in the NETPOLL API
    callbacks causes the interrupts to get enabled and can lead to kernel
    instability.
    
    The solution is to use "B functions set" to prevent the irqs from
    getting enabled while in netpoll_send_skb().
    
    A functions set:
    local_irq_disable()/local_irq_enable()
    spin_lock_irq()/spin_unlock_irq()
    spin_trylock_irq()/spin_unlock_irq()
    
    B functions set:
    local_irq_save()/local_irq_restore()
    spin_lock_irqsave()/spin_unlock_irqrestore()
    spin_trylock_irqsave()/spin_unlock_irqrestore()
    
    Signed-off-by: Dongdong Deng <dongdong.deng at windriver.com>
    Acked-by: Matt Mackall <mpm at selenic.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 79b1bee888d43b14cf0c08fb8e5aa6cb161e48f8
Author: Dongdong Deng <dongdong.deng at windriver.com>
Date:   Fri Aug 21 03:33:36 2009 +0000

    netpoll: warning for ndo_start_xmit returns with interrupts enabled
    
    WARN_ONCE for ndo_start_xmit() enable interrupts in netpoll_send_skb(),
    because the NETPOLL API requires that interrupts remain disabled in
    netpoll_send_skb().
    
    Signed-off-by: Dongdong Deng <dongdong.deng at windriver.com>
    Acked-by: Matt Mackall <mpm at selenic.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit c189308bd8b6a29b11c3ec29a42a3f0aabad6bc8
Author: Andreas Mohr <andi at lisas.de>
Date:   Fri Aug 21 00:46:06 2009 +0000

    net: Fix Micrel KSZ8842 Kconfig description
    
    Signed-off-by: Andreas Mohr <andi at lisas.de>
    Acked-by: Richard Röjfors <richard.rojfors.ext at mocean-labs.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 2149f66f49ab07515666127bf5140c5c94677af8
Author: Patrick McHardy <kaber at trash.net>
Date:   Thu Aug 20 02:47:34 2009 +0000

    netfilter: xt_quota: fix wrong return value (error case)
    
    Success was indicated on a memory allocation failure, thereby causing
    a crash due to a later NULL deref.
    (Affects v2.6.30-rc1 up to here.)
    
    Signed-off-by: Jan Engelhardt <jengelh at medozas.de>
    Signed-off-by: Patrick McHardy <kaber at trash.net>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit ca6982b858e1d08010c1d29d8e8255b2ac2ad70a
Author: Bruno Prémont <bonbons at linux-vserver.org>
Date:   Sun Aug 23 19:06:28 2009 -0700

    ipv6: Fix commit 63d9950b08184e6531adceb65f64b429909cc101 (ipv6: Make v4-mapped bindings consistent with IPv4)
    
    Commit 63d9950b08184e6531adceb65f64b429909cc101
      (ipv6: Make v4-mapped bindings consistent with IPv4)
    changes behavior of inet6_bind() for v4-mapped addresses so it should
    behave the same way as inet_bind().
    
    During this change setting of err to -EADDRNOTAVAIL got lost:
    
    af_inet.c:469 inet_bind()
    	err = -EADDRNOTAVAIL;
    	if (!sysctl_ip_nonlocal_bind &&
    	    !(inet->freebind || inet->transparent) &&
    	    addr->sin_addr.s_addr != htonl(INADDR_ANY) &&
    	    chk_addr_ret != RTN_LOCAL &&
    	    chk_addr_ret != RTN_MULTICAST &&
    	    chk_addr_ret != RTN_BROADCAST)
    		goto out;
    
    
    af_inet6.c:463 inet6_bind()
    	if (addr_type == IPV6_ADDR_MAPPED) {
    		int chk_addr_ret;
    
    		/* Binding to v4-mapped address on a v6-only socket
    		 * makes no sense
    		 */
    		if (np->ipv6only) {
    			err = -EINVAL;
    			goto out;
    		}
    
    		/* Reproduce AF_INET checks to make the bindings consitant */
    		v4addr = addr->sin6_addr.s6_addr32[3];
    		chk_addr_ret = inet_addr_type(net, v4addr);
    		if (!sysctl_ip_nonlocal_bind &&
    		    !(inet->freebind || inet->transparent) &&
    		    v4addr != htonl(INADDR_ANY) &&
    		    chk_addr_ret != RTN_LOCAL &&
    		    chk_addr_ret != RTN_MULTICAST &&
    		    chk_addr_ret != RTN_BROADCAST)
    			goto out;
    	} else {
    
    
    Signed-off-by Bruno Prémont <bonbons at linux-vserver.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 6ff9c2e7fa8ca63a575792534b63c5092099c286
Author: Krzysztof Hałasa <khc at pm.waw.pl>
Date:   Sun Aug 23 19:02:13 2009 -0700

    E100: fix interaction with swiotlb on X86.
    
    E100 places it's RX packet descriptors inside skb->data and uses them
    with bidirectional streaming DMA mapping. Data in descriptors is
    accessed simultaneously by the chip (writing status and size when
    a packet is received) and CPU (reading to check if the packet was
    received). This isn't a valid usage of PCI DMA API, which requires use
    of the coherent (consistent) memory for such purpose. Unfortunately e100
    chips working in "simplified" RX mode have to store received data
    directly after the descriptor. Fixing the driver to conform to the API
    would require using unsupported "flexible" RX mode or receiving data
    into a coherent memory and using CPU to copy it to network buffers.
    
    This patch, while not yet making the driver conform to the PCI DMA API,
    allows it to work correctly on X86 with swiotlb (while not breaking
    other architectures).
    
    Signed-off-by: Krzysztof Hałasa <khc at pm.waw.pl>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 38acce2d7983632100a9ff3fd20295f6e34074a8
Author: David S. Miller <davem at davemloft.net>
Date:   Fri Aug 21 16:51:38 2009 -0700

    pkt_sched: Convert CBQ to tasklet_hrtimer.
    
    This code expects to run in softirq context, and bare hrtimers
    run in hw IRQ context.
    
    Signed-off-by: David S. Miller <davem at davemloft.net>
    Acked-by: Thomas Gleixner <tglx at linutronix.de>

commit 70bdbd3d1ae9c4ca3e84a43df34262face26575d
Author: Bartlomiej Zolnierkiewicz <bzolnier at gmail.com>
Date:   Sun Aug 23 15:27:25 2009 +0200

    ALSA: ali5451: fix timeout handling in snd_ali_{codecs,timer}_ready()
    
    Modify loops in such way that the register value is checked also after
    the timeout condition, just in case the heavy interrupt load etc. caused
    the thread to sleep for the time period exceeding the timeout value.
    
    While at it remove an extra ALI_STIMER read from snd_ali_stimer_ready().
    
    Reported-by: Jack Byer <ojbyer at usa.net>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier at gmail.com>
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

commit 637952ca689013339b977558061fa4ca8e07e1c1
Author: Hendrik Brueckner <brueckner at linux.vnet.ibm.com>
Date:   Sun Aug 23 18:09:06 2009 +0200

    [S390] set preferred console based on conmode
    
    setup_arch() unconditionally sets the preferred console to ttyS.
    This breaks the use of 3270 devices as the console. Provide a new
    function to set the default preferred console for s390. The preferred
    console depends on the conmode parameter that is used to switch
    between 3270 and 3215 terminal/console mode.
    
    Signed-off-by: Hendrik Brueckner <brueckner at linux.vnet.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky at de.ibm.com>

commit cf05b824dbb871159e1b4c4f2733b9c9d2f756cf
Author: Julia Lawall <julia at diku.dk>
Date:   Sun Aug 23 18:09:05 2009 +0200

    [S390] drivers/s390: put NULL test before dereference
    
    If the NULL test on block is needed, it should be before the dereference of
    the base field.
    
    The semantic match that finds this problem is as follows:
    (http://coccinelle.lip6.fr/)
    
    // <smpl>
    @r@
    expression E1,E2;
    identifier fld;
    statement S1,S2;
    @@
    
    E1 = E2->fld;
    (
    if (E1 == NULL) S1 else S2
    |
    *if (E2 == NULL) S1 else S2
    )
    // </smpl>
    
    Signed-off-by: Julia Lawall <julia at diku.dk>
    Signed-off-by: Martin Schwidefsky <schwidefsky at de.ibm.com>

commit 06739a8ad321b1e5140b318c648b0cc4bf8c6daa
Author: Sebastian Ott <sebott at linux.vnet.ibm.com>
Date:   Sun Aug 23 18:09:04 2009 +0200

    [S390] cio: fix double free after failed device initialization
    
    If io_subchannel_initialize_dev fails it will release the only
    reference to the ccw device therefore the caller should not
    kfree this device since this is done in the release function.
    
    Signed-off-by: Sebastian Ott <sebott at linux.vnet.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky at de.ibm.com>

commit 9f844e5118d1627025c8ea7cfc0ea69038ea63fd
Author: Michel Dänzer <daenzer at vmware.com>
Date:   Sat Aug 22 17:38:23 2009 +0200

    drm/radeon/kms: Fix radeon_gem_busy_ioctl harder.
    
    It was mixing up TTM placement values and flags.
    
    Signed-off-by: Michel Dänzer <daenzer at vmware.com>
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit ee5f9757ea17759e1ce5503bdae2b07e48e32af9
Author: David S. Miller <davem at davemloft.net>
Date:   Fri Aug 21 16:33:34 2009 -0700

    pkt_sched: Convert qdisc_watchdog to tasklet_hrtimer
    
    None of this stuff should execute in hw IRQ context, therefore
    use a tasklet_hrtimer so that it runs in softirq context.
    
    Signed-off-by: David S. Miller <davem at davemloft.net>
    Acked-by: Thomas Gleixner <tglx at linutronix.de>

commit 3edf2fb9d80a46d6c32ba12547a42419845b4b76
Merge: e3054ea7f79db2c694a4f74febead2d4f8de5a98 c82f63e411f1b58427c103bd95af2863b1c96dd1
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Aug 22 12:14:01 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
      PCI: check saved state before restore

commit e3054ea7f79db2c694a4f74febead2d4f8de5a98
Merge: 422bef879e84104fee6dc68ded0e371dbeb5f88e 388ce4beb7135722c584b0af18f215e3ec657adf
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sat Aug 22 08:30:58 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6:
      [SCSI] mpt2sas: fix config request and diag reset deadlock
      [SCSI] mpt2sas: Bump driver version 01.100.04.00
      [SCSI] mpt2sas: fix oops because drv data points to NULL on resume from hibernate
      [SCSI] mpt2sas: fix crash due to Watchdog is active while OS in standby mode
      [SCSI] mpt2sas: fix infinite loop inside config request
      [SCSI] mpt2sas: Excessive log info causes sas iounit page time out
      [SCSI] mpt2sas: Raid 10 Value is showing as Raid 1E in /va/log/messages
      [SCSI] mpt2sas: Expander fix oops saying "Already part of another port"
      [SCSI] mpt2sas: Introduced check for enclosure_handle to avoid crash

commit 422bef879e84104fee6dc68ded0e371dbeb5f88e
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 21 18:00:46 2009 -0700

    Linux 2.6.31-rc7

commit 8e9d78edea3ce5c0036f85b93091483f2f15443a
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 21 17:40:08 2009 -0700

    Re-introduce page mapping check in mark_buffer_dirty()
    
    In commit a8e7d49aa7be728c4ae241a75a2a124cdcabc0c5 ("Fix race in
    create_empty_buffers() vs __set_page_dirty_buffers()"), I removed a test
    for a NULL page mapping unintentionally when some of the code inside
    __set_page_dirty() was moved to the callers.
    
    That removal generally didn't matter, since a filesystem would serialize
    truncation (which clears the page mapping) against writing (which marks
    the buffer dirty), so locking at a higher level (either per-page or an
    inode at a time) should mean that the buffer page would be stable.  And
    indeed, nothing bad seemed to happen.
    
    Except it turns out that apparently reiserfs does something odd when
    under load and writing out the journal, and we have a number of bugzilla
    entries that look similar:
    
    	http://bugzilla.kernel.org/show_bug.cgi?id=13556
    	http://bugzilla.kernel.org/show_bug.cgi?id=13756
    	http://bugzilla.kernel.org/show_bug.cgi?id=13876
    
    and it looks like reiserfs depended on that check (the common theme
    seems to be "data=journal", and a journal writeback during a truncate).
    
    I suspect reiserfs should have some additional locking, but in the
    meantime this should get us back to the pre-2.6.29 behavior.
    
    Pattern-pointed-out-by: Roland Kletzing <devzero at web.de>
    Cc: stable at kernel.org (2.6.29 and 2.6.30)
    Cc: Jeff Mahoney <jeffm at suse.com>
    Cc: Nick Piggin <npiggin at suse.de>
    Cc: Al Viro <viro at zeniv.linux.org.uk>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 649bf17829d087f83754e2a8161e094a167ce3d3
Merge: d3b325f9c25be6d504bc73afce7f92d0e25001d7 1a9937b7f07ab6e35515e32a7625f0ba50ab7670
Author: David S. Miller <davem at davemloft.net>
Date:   Fri Aug 21 13:13:04 2009 -0700

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

commit 4dfd79e7b42bff334128907e28c3b41f1ef1cec8
Merge: b57f92157e6517f0b3bd22e3a8ce7227e230c4f5 f779b3e513478218cbaaaa0a506d7801cab6fd14
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 21 10:45:09 2009 -0700

    Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6
    
    * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
      drm/radeon: add GET_PARAM/INFO support for Z pipes
      drm/radeon/kms: add r100/r200 OQ support.
      drm: Fix sysfs device confusion.
      drm/radeon/kms: implement the bo busy ioctl properly.

commit b57f92157e6517f0b3bd22e3a8ce7227e230c4f5
Merge: b04e6373d694e977c95ae0ae000e2c1e2cf92d73 03e860bd9f6a3cca747b0795bed26279a8b420a0
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 21 09:56:55 2009 -0700

    Merge branch 'btrfs' of git://git.kernel.dk/linux-2.6-block
    
    * 'btrfs' of git://git.kernel.dk/linux-2.6-block:
      btrfs: fix inode rbtree corruption

commit b04e6373d694e977c95ae0ae000e2c1e2cf92d73
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 21 09:48:10 2009 -0700

    x86: don't call '->send_IPI_mask()' with an empty mask
    
    As noted in 83d349f35e1ae72268c5104dbf9ab2ae635425d4 ("x86: don't send
    an IPI to the empty set of CPU's"), some APIC's will be very unhappy
    with an empty destination mask.  That commit added a WARN_ON() for that
    case, and avoided the resulting problem, but didn't fix the underlying
    reason for why those empty mask cases happened.
    
    This fixes that, by checking the result of 'cpumask_andnot()' of the
    current CPU actually has any other CPU's left in the set of CPU's to be
    sent a TLB flush, and not calling down to the IPI code if the mask is
    empty.
    
    The reason this started happening at all is that we started passing just
    the CPU mask pointers around in commit 4595f9620 ("x86: change
    flush_tlb_others to take a const struct cpumask"), and when we did that,
    the cpumask was no longer thread-local.
    
    Before that commit, flush_tlb_mm() used to create it's own copy of
    'mm->cpu_vm_mask' and pass that copy down to the low-level flush
    routines after having tested that it was not empty.  But after changing
    it to just pass down the CPU mask pointer, the lower level TLB flush
    routines would now get a pointer to that 'mm->cpu_vm_mask', and that
    could still change - and become empty - after the test due to other
    CPU's having flushed their own TLB's.
    
    See
    
    	http://bugzilla.kernel.org/show_bug.cgi?id=13933
    
    for details.
    
    Tested-by: Thomas Björnell <thomas.bjornell at gmail.com>
    Cc: stable at kernel.org
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 1a9937b7f07ab6e35515e32a7625f0ba50ab7670
Author: Herton Ronaldo Krzesinski <herton at mandriva.com.br>
Date:   Thu Aug 20 21:16:17 2009 -0300

    rtl8187: always set MSR_LINK_ENEDCA flag with RTL8187B
    
    RTL8187B always needs MSR_LINK_ENEDCA flag to be set even when it is in
    no link mode, otherwise it'll not be able to associate when this flag is
    not set after the change "mac80211: fix managed mode BSSID handling".
    
    By accident, setting BSSID of AP before association makes 8187B to
    successfuly associate even when ENEDCA flag isn't set, which was the
    case before the mac80211 change. But now the BSSID of AP we are trying
    to associate is only available after association is successful, and
    any attempt to associate without the needed flag doesn't work.
    
    Signed-off-by: Herton Ronaldo Krzesinski <herton at mandriva.com.br>
    Tested-by: Larry Finger <Larry.Finger at lwfinger.net>
    Acked-by: Hin-Tak Leung <htl10 at users.sourceforge.net>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit f4b0373b26567cafd421d91101852ed7a34e9e94
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 21 09:26:15 2009 -0700

    Make bitmask 'and' operators return a result code
    
    When 'and'ing two bitmasks (where 'andnot' is a variation on it), some
    cases want to know whether the result is the empty set or not.  In
    particular, the TLB IPI sending code wants to do cpumask operations and
    determine if there are any CPU's left in the final set.
    
    So this just makes the bitmask (and cpumask) functions return a boolean
    for whether the result has any bits set.
    
    Cc: stable at kernel.org (2.6.30, needed by TLB shootdown fix)
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 83d349f35e1ae72268c5104dbf9ab2ae635425d4
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 21 09:23:57 2009 -0700

    x86: don't send an IPI to the empty set of CPU's
    
    The default_send_IPI_mask_logical() function uses the "flat" APIC mode
    to send an IPI to a set of CPU's at once, but if that set happens to be
    empty, some older local APIC's will apparently be rather unhappy.  So
    just warn if a caller gives us an empty mask, and ignore it.
    
    This fixes a regression in 2.6.30.x, due to commit 4595f9620 ("x86:
    change flush_tlb_others to take a const struct cpumask"), documented
    here:
    
    	http://bugzilla.kernel.org/show_bug.cgi?id=13933
    
    which causes a silent lock-up.  It only seems to happen on PPro, P2, P3
    and Athlon XP cores.  Most developers sadly (or not so sadly, if you're
    a developer..) have more modern CPU's.  Also, on x86-64 we don't use the
    flat APIC mode, so it would never trigger there even if the APIC didn't
    like sending an empty IPI mask.
    
    Reported-by: Pavel Vilim <wylda at volny.cz>
    Reported-and-tested-by: Thomas Björnell <thomas.bjornell at gmail.com>
    Reported-and-tested-by: Martin Rogge <marogge at onlinehome.de>
    Cc: Mike Travis <travis at sgi.com>
    Cc: Ingo Molnar <mingo at elte.hu>
    Cc: stable at kernel.org
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 4464fcaa9cbfc9c551956b48af203e2f775ca892
Author: Peter Zijlstra <a.p.zijlstra at chello.nl>
Date:   Fri Aug 21 17:19:36 2009 +0200

    perf_counter: Fix typo in read() output generation
    
    When you iterate a list, using the iterator is useful.
    
    Before:
    
       ID: 5
       ID: 5
       ID: 5
       ID: 5
       EVNT: 0x40088b scale: nan ID: 5 CNT: 1006252 ID: 6 CNT: 1011090 ID: 7 CNT: 1011196 ID: 8 CNT: 1011095
       EVNT: 0x40088c scale: 1.000000 ID: 5 CNT: 2003065 ID: 6 CNT: 2011671 ID: 7 CNT: 2012620 ID: 8 CNT: 2013479
       EVNT: 0x40088c scale: 1.000000 ID: 5 CNT: 3002390 ID: 6 CNT: 3015996 ID: 7 CNT: 3018019 ID: 8 CNT: 3020006
       EVNT: 0x40088b scale: 1.000000 ID: 5 CNT: 4002406 ID: 6 CNT: 4021120 ID: 7 CNT: 4024241 ID: 8 CNT: 4027059
    
    After:
    
       ID: 1
       ID: 2
       ID: 3
       ID: 4
       EVNT: 0x400889 scale: nan ID: 1 CNT: 1005270 ID: 2 CNT: 1009833 ID: 3 CNT: 1010065 ID: 4 CNT: 1010088
       EVNT: 0x400898 scale: nan ID: 1 CNT: 2001531 ID: 2 CNT: 2022309 ID: 3 CNT: 2022470 ID: 4 CNT: 2022627
       EVNT: 0x400888 scale: 0.489467 ID: 1 CNT: 3001261 ID: 2 CNT: 3027088 ID: 3 CNT: 3027941 ID: 4 CNT: 3028762
    
    Reported-by: stephane eranian <eranian at googlemail.com>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: Corey J Ashford <cjashfor at us.ibm.com>
    Cc: perfmon2-devel <perfmon2-devel at lists.sourceforge.net>
    LKML-Reference: <1250867976.7538.73.camel at twins>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 4a683bf94b8a10e2bb0da07aec3ac0a55e5de61f
Author: Ingo Molnar <mingo at elte.hu>
Date:   Fri Aug 21 12:53:36 2009 +0200

    tracing: Fix too large stack usage in do_one_initcall()
    
    One of my testboxes triggered this nasty stack overflow crash
    during SCSI probing:
    
    [    5.874004] sd 0:0:0:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA
    [    5.875004] device: 'sda': device_add
    [    5.878004] BUG: unable to handle kernel NULL pointer dereference at 00000a0c
    [    5.878004] IP: [<b1008321>] print_context_stack+0x81/0x110
    [    5.878004] *pde = 00000000
    [    5.878004] Thread overran stack, or stack corrupted
    [    5.878004] Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
    [    5.878004] last sysfs file:
    [    5.878004]
    [    5.878004] Pid: 1, comm: swapper Not tainted (2.6.31-rc6-tip-01272-g9919e28-dirty #5685)
    [    5.878004] EIP: 0060:[<b1008321>] EFLAGS: 00010083 CPU: 0
    [    5.878004] EIP is at print_context_stack+0x81/0x110
    [    5.878004] EAX: cf8a3000 EBX: cf8a3fe4 ECX: 00000049 EDX: 00000000
    [    5.878004] ESI: b1cfce84 EDI: 00000000 EBP: cf8a3018 ESP: cf8a2ff4
    [    5.878004]  DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
    [    5.878004] Process swapper (pid: 1, ti=cf8a2000 task=cf8a8000 task.ti=cf8a3000)
    [    5.878004] Stack:
    [    5.878004]  b1004867 fffff000 cf8a3ffc
    [    5.878004] Call Trace:
    [    5.878004]  [<b1004867>] ? kernel_thread_helper+0x7/0x10
    [    5.878004] BUG: unable to handle kernel NULL pointer dereference at 00000a0c
    [    5.878004] IP: [<b1008321>] print_context_stack+0x81/0x110
    [    5.878004] *pde = 00000000
    [    5.878004] Thread overran stack, or stack corrupted
    [    5.878004] Oops: 0000 [#2] PREEMPT SMP DEBUG_PAGEALLOC
    
    The oops did not reveal any more details about the real stack
    that we have and the system got into an infinite loop of
    recursive pagefaults.
    
    So i booted with CONFIG_STACK_TRACER=y and the 'stacktrace' boot
    parameter. The box did not crash (timings/conditions probably
    changed a tiny bit to trigger the catastrophic crash), but the
    /debug/tracing/stack_trace file was rather revealing:
    
            Depth    Size   Location    (72 entries)
            -----    ----   --------
      0)     3704      52   __change_page_attr+0xb8/0x290
      1)     3652      24   __change_page_attr_set_clr+0x43/0x90
      2)     3628      60   kernel_map_pages+0x108/0x120
      3)     3568      40   prep_new_page+0x7d/0x130
      4)     3528      84   get_page_from_freelist+0x106/0x420
      5)     3444     116   __alloc_pages_nodemask+0xd7/0x550
      6)     3328      36   allocate_slab+0xb1/0x100
      7)     3292      36   new_slab+0x1c/0x160
      8)     3256      36   __slab_alloc+0x133/0x2b0
      9)     3220       4   kmem_cache_alloc+0x1bb/0x1d0
     10)     3216     108   create_object+0x28/0x250
     11)     3108      40   kmemleak_alloc+0x81/0xc0
     12)     3068      24   kmem_cache_alloc+0x162/0x1d0
     13)     3044      52   scsi_pool_alloc_command+0x29/0x70
     14)     2992      20   scsi_host_alloc_command+0x22/0x70
     15)     2972      24   __scsi_get_command+0x1b/0x90
     16)     2948      28   scsi_get_command+0x35/0x90
     17)     2920      24   scsi_setup_blk_pc_cmnd+0xd4/0x100
     18)     2896     128   sd_prep_fn+0x332/0xa70
     19)     2768      36   blk_peek_request+0xe7/0x1d0
     20)     2732      56   scsi_request_fn+0x54/0x520
     21)     2676      12   __generic_unplug_device+0x2b/0x40
     22)     2664      24   blk_execute_rq_nowait+0x59/0x80
     23)     2640     172   blk_execute_rq+0x6b/0xb0
     24)     2468      32   scsi_execute+0xe0/0x140
     25)     2436      64   scsi_execute_req+0x152/0x160
     26)     2372      60   scsi_vpd_inquiry+0x6c/0x90
     27)     2312      44   scsi_get_vpd_page+0x112/0x160
     28)     2268      52   sd_revalidate_disk+0x1df/0x320
     29)     2216      92   rescan_partitions+0x98/0x330
     30)     2124      52   __blkdev_get+0x309/0x350
     31)     2072       8   blkdev_get+0xf/0x20
     32)     2064      44   register_disk+0xff/0x120
     33)     2020      36   add_disk+0x6e/0xb0
     34)     1984      44   sd_probe_async+0xfb/0x1d0
     35)     1940      44   __async_schedule+0xf4/0x1b0
     36)     1896       8   async_schedule+0x12/0x20
     37)     1888      60   sd_probe+0x305/0x360
     38)     1828      44   really_probe+0x63/0x170
     39)     1784      36   driver_probe_device+0x5d/0x60
     40)     1748      16   __device_attach+0x49/0x50
     41)     1732      32   bus_for_each_drv+0x5b/0x80
     42)     1700      24   device_attach+0x6b/0x70
     43)     1676      16   bus_attach_device+0x47/0x60
     44)     1660      76   device_add+0x33d/0x400
     45)     1584      52   scsi_sysfs_add_sdev+0x6a/0x2c0
     46)     1532     108   scsi_add_lun+0x44b/0x460
     47)     1424     116   scsi_probe_and_add_lun+0x182/0x4e0
     48)     1308      36   __scsi_add_device+0xd9/0xe0
     49)     1272      44   ata_scsi_scan_host+0x10b/0x190
     50)     1228      24   async_port_probe+0x96/0xd0
     51)     1204      44   __async_schedule+0xf4/0x1b0
     52)     1160       8   async_schedule+0x12/0x20
     53)     1152      48   ata_host_register+0x171/0x1d0
     54)     1104      60   ata_pci_sff_activate_host+0xf3/0x230
     55)     1044      44   ata_pci_sff_init_one+0xea/0x100
     56)     1000      48   amd_init_one+0xb2/0x190
     57)      952       8   local_pci_probe+0x13/0x20
     58)      944      32   pci_device_probe+0x68/0x90
     59)      912      44   really_probe+0x63/0x170
     60)      868      36   driver_probe_device+0x5d/0x60
     61)      832      20   __driver_attach+0x89/0xa0
     62)      812      32   bus_for_each_dev+0x5b/0x80
     63)      780      12   driver_attach+0x1e/0x20
     64)      768      72   bus_add_driver+0x14b/0x2d0
     65)      696      36   driver_register+0x6e/0x150
     66)      660      20   __pci_register_driver+0x53/0xc0
     67)      640       8   amd_init+0x14/0x16
     68)      632     572   do_one_initcall+0x2b/0x1d0
     69)       60      12   do_basic_setup+0x56/0x6a
     70)       48      20   kernel_init+0x84/0xce
     71)       28      28   kernel_thread_helper+0x7/0x10
    
    There's a lot of fat functions on that stack trace, but
    the largest of all is do_one_initcall(). This is due to
    the boot trace entry variables being on the stack.
    
    Fixing this is relatively easy, initcalls are fundamentally
    serialized, so we can move the local variables to file scope.
    
    Note that this large stack footprint was present for a
    couple of months already - what pushed my system over
    the edge was the addition of kmemleak to the call-chain:
    
      6)     3328      36   allocate_slab+0xb1/0x100
      7)     3292      36   new_slab+0x1c/0x160
      8)     3256      36   __slab_alloc+0x133/0x2b0
      9)     3220       4   kmem_cache_alloc+0x1bb/0x1d0
     10)     3216     108   create_object+0x28/0x250
     11)     3108      40   kmemleak_alloc+0x81/0xc0
     12)     3068      24   kmem_cache_alloc+0x162/0x1d0
     13)     3044      52   scsi_pool_alloc_command+0x29/0x70
    
    This pushes the total to ~3800 bytes, only a tiny bit
    more was needed to corrupt the on-kernel-stack thread_info.
    
    The fix reduces the stack footprint from 572 bytes
    to 28 bytes.
    
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Thomas Gleixner <tglx at linutronix.de>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Steven Rostedt <srostedt at redhat.com>
    Cc: Catalin Marinas <catalin.marinas at arm.com>
    Cc: Jens Axboe <jens.axboe at oracle.com>
    Cc: Linus Torvalds <torvalds at linux-foundation.org>
    Cc: <stable at kernel.org>
    LKML-Reference: <new-submission>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit f779b3e513478218cbaaaa0a506d7801cab6fd14
Author: Alex Deucher <alexdeucher at gmail.com>
Date:   Wed Aug 19 19:11:39 2009 -0400

    drm/radeon: add GET_PARAM/INFO support for Z pipes
    
    Needed for occlusion queries on rv530 chips.
    
    Signed-off-by: Alex Deucher <alexdeucher at gmail.com>
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 03e860bd9f6a3cca747b0795bed26279a8b420a0
Author: From: Nick Piggin <npiggin at suse.de>
Date:   Fri Aug 21 10:09:44 2009 +0200

    btrfs: fix inode rbtree corruption
    
    Node may not be inserted over existing node. This causes inode tree
    corruption and I was seeing crashes in inode_tree_del which I can not
    reproduce after this patch.
    
    The other way to fix this would be to tie inode lifetime in the rbtree
    with inode while not in freeing state. I had a look at this but it is
    not so trivial at this point. At least this patch gets things working again.
    
    Signed-off-by: Nick Piggin <npiggin at suse.de>
    Cc: Chris Mason <chris.mason at oracle.com>
    Acked-by: Yan Zheng <zheng.yan at oracle.com>
    Signed-off-by: Jens Axboe <jens.axboe at oracle.com>

commit ec9c96ef3cc0124cb94375b17faaa8cff5dfdf97
Author: Kyle McMartin <kyle at redhat.com>
Date:   Wed Aug 19 21:17:08 2009 -0400

    dma-debug: Fix check_unmap null pointer dereference
    
    While it's debatable whether or not a NULL device argument to
    the DMA API functions is valid... since it certainly isn't
    valid on devices with an IOMMU... dma-debug really shouldn't be
    dereferencing null pointers either.
    
    Guard against that in err_printk and the driver_filter
    functions. A Fedora rawhide user was seeing this in one of the
    dvb drivers resulting in an oops on boot.
    
    [ A patch has been sent for testing to the driver, but I feel
      the dma debugging support should be fixed as well. (There's
      still a pile of legacy garbage in the kernel passing null
      pointers to dma_{alloc,free}_*. :( ]
    
    Signed-off-by: Kyle McMartin <kyle at redhat.com>
    Cc: mchehab at infradead.org
    Cc: Joerg Roedel <joerg.roedel at amd.com>
    LKML-Reference: <20090820011708.GP25206 at bombadil.infradead.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 9b2fb2da4edfb163842800abbeb4c14bc1759469
Author: Pavel Revak <palo at bielyvlk.sk>
Date:   Thu Aug 20 22:30:54 2009 -0700

    Input: ucb1400_ts - enable interrupt unconditionally
    
    Sometimes, when using the touchscreen, it stops working till next restart
    and the following message is printed:
    
    	ucb1400: unexpected IE_STATUS = 0x0
    
    The following patch retriggers the touchscreen interrupt unconditionally.
    This prevents hanging of the touchscreen in case of bogus interrupt
    occurence.
    
    Signed-off-by: Pavel Revak <palo at bielyvlk.sk>
    Acked-by: Marek Vasut <marek.vasut at gmail.com>
    Signed-off-by: Dmitry Torokhov <dtor at mail.ru>

commit 1700f5fde88f9a251037bc86bde538ee32c59905
Author: Marek Vasut <marek.vasut at gmail.com>
Date:   Thu Aug 20 22:05:53 2009 -0700

    Input: ucb1400_ts - enable ADC Filter
    
    This patch enables ADC filtering on UCB1400 codec by default. The
    benefit from this change is mostly on some Colibri boards where
    the ADCSYNC pin of the UCB1400 codec isn't connected causing the
    touchscreen to jitter very badly. This change has no visible
    effect on boards where the ADCSYNC pin is connected.
    
    Signed-off-by: Marek Vasut <marek.vasut at gmail.com>
    Tested-by: Palo Revak <palo at bielyvlk.sk>
    Signed-off-by: Dmitry Torokhov <dtor at mail.ru>

commit 3b7307c2d66dd575ef24b88898b4bc4bddb254f4
Author: Dmitry Torokhov <dmitry.torokhov at gmail.com>
Date:   Thu Aug 20 21:41:04 2009 -0700

    Input: wacom - don't use on-stack memory for report buffers
    
    Tested-by: Martin Capitanio <martin at capitanio.org>
    Signed-off-by: Dmitry Torokhov <dtor at mail.ru>

commit c795b33ba171e41563ab7e25105c0cd4edd81cd7
Author: Goldwyn Rodrigues <rgoldwyn at gmail.com>
Date:   Thu Aug 20 13:43:19 2009 -0500

    ocfs2/dlm: Wait on lockres instead of erroring cancel requests
    
    In case a downconvert is queued, and a flock receives a signal,
    BUG_ON(lockres->l_action != OCFS2_AST_INVALID) is triggered
    because a lock cancel triggers a dlmunlock while an AST is
    scheduled.
    
    To avoid this, allow a LKM_CANCEL to pass through, and let it
    wait on __dlm_wait_on_lockres().
    
    Signed-off-by: Goldwyn Rodrigues <rgoldwyn at suse.de>
    Acked-off-by: Mark Fasheh <mfasheh at suse.com>
    Signed-off-by: Joel Becker <joel.becker at oracle.com>

commit 17782d99502851dc7e48114ee9c5a6d6741cba18
Author: Dave Airlie <airlied at redhat.com>
Date:   Fri Aug 21 10:07:54 2009 +1000

    drm/radeon/kms: add r100/r200 OQ support.
    
    This adds the relocation necessary for OQ support on the r100/r200
    chipsets.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 08e4d534743f4e9af3602aebbc1cca9372762028
Author: Thomas Hellstrom <thellstrom at vmware.com>
Date:   Thu Aug 20 19:02:31 2009 +1000

    drm: Fix sysfs device confusion.
    
    The drm sysfs class suspend / resume methods could not distinguish
    between different device types wich could lead to illegal type casts.
    
    Use struct device_type and make sure the class suspend / resume callbacks
    are aware of those. There is no per device-type suspend / resume. Only
    new-style PM.
    
    Signed-off-by: Thomas Hellstrom <thellstrom at vmware.com>
    Reviewed-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit e3b2415e281a97ade36d88404094a90cfea838c0
Author: Dave Airlie <airlied at redhat.com>
Date:   Fri Aug 21 09:47:45 2009 +1000

    drm/radeon/kms: implement the bo busy ioctl properly.
    
    The previous patch assumes the ioctl already existed, when
    it actually didn't.
    
    It also didn't return the correct error code.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit a8b88d3d49623ac701b5dc996cbd61219c793c7c
Author: Jan Kara <jack at suse.cz>
Date:   Thu Aug 20 18:26:52 2009 +0200

    ocfs2: Add missing lock name
    
    There is missing name for NFSSync cluster lock. This makes lockdep unhappy
    because we end up passing NULL to lockdep when initializing lock key. Fix it.
    
    Signed-off-by: Jan Kara <jack at suse.cz>
    Signed-off-by: Joel Becker <joel.becker at oracle.com>

commit fc0ce23506d943b9eaa731a051769d0e0605eb03
Author: Jan Beulich <JBeulich at novell.com>
Date:   Thu Aug 20 16:14:15 2009 +0100

    x86: add vmlinux.lds to targets in arch/x86/boot/compressed/Makefile
    
    The absence of vmlinux.lds here keeps .vmlinux.lds.cmd from being
    included, which in turn leads to it and all its dependents always
    getting rebuilt independent of whether they are already up-to-date.
    
    Signed-off-by: Jan Beulich <jbeulich at novell.com>
    LKML-Reference: <4A8D84670200007800010D31 at vpn.id2.novell.com>
    Signed-off-by: H. Peter Anvin <hpa at zytor.com>

commit 429966b8f644dda2afddb4f834a944e9b46a7645
Merge: a1d12511157c8d22a5a6779f8a9d73a1adcfc3b0 c37faafa7d46622b749437f7d294201a63af4beb
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 20 14:55:24 2009 -0700

    Merge branch 'i2c-fixes-rc6' of git://aeryn.fluff.org.uk/bjdooks/linux
    
    * 'i2c-fixes-rc6' of git://aeryn.fluff.org.uk/bjdooks/linux:
      i2c-stu300: I2C STU300 stability updates
      i2c-omap: Enable workaround for Errata 1.153 based on
      i2c-omap: ACK pending [R/X]DR and [R/X]RDY interrupts
      i2c-omap: Fix I2C status ACK

commit c37faafa7d46622b749437f7d294201a63af4beb
Author: Linus Walleij <linus.walleij at stericsson.com>
Date:   Thu Aug 13 22:14:23 2009 +0200

    i2c-stu300: I2C STU300 stability updates
    
    - blk clk is enabled when an irq arrives. The clk should be enabled,
      but just to make sure.
    - All error bits are handled no matter state machine state
    - All irq's will run complete() except for irq's that wasn't an event.
    - No more looking into status registers just in case an interrupt
      has happend and the irq handle wasn't executed.
    - irq_disable/enable are now separete functions.
    - clk settings calculation changed to round upwards instead of
      downwards.
    - Number of address send attempts before giving up is increased to 12
      from 10 since it most times take 8 tries before getting through.
    
    Signed-off-by: Linus Walleij <linus.walleij at stericsson.com>
    Signed-off-by: Ben Dooks <ben-linux at fluff.org>

commit 61149787d65b4a2f9c638d363dc65e13cb063e29
Author: Moiz Sonasath <m-sonasath at ti.com>
Date:   Thu Aug 20 11:21:16 2009 -0500

    i2c-omap: Enable workaround for Errata 1.153 based on
    
    Silicon Errata 1.153 has been fixed on OMAP 3630|4430 with the use of a later
    version of I2C IP block.
    
    The errata impacts OMAP 2420|2430|3430, enable the workaround for these based
    on I2C IP block revision number instead of OMAP CPU type
    
    Signed-off-by: Moiz Sonasath <m-sonasath at ti.com>
    Signed-off-by: Vikram Pandita <vikram.pandita at ti.com
    Reviewed-by: Paul Walmsley <paul at pwsan.com>
    Signed-off-by: Ben Dooks <ben-linux at fluff.org>

commit dd11976aea15bde53ce40b076dd5fa462c74f41a
Author: Moiz Sonasath <m-sonasath at ti.com>
Date:   Thu Aug 20 11:21:15 2009 -0500

    i2c-omap: ACK pending [R/X]DR and [R/X]RDY interrupts
    
    ACK any pending read/write interrupts before exiting the ISR either after
    completing the operation [ARDY interrupt] or in case of an error
    [NACK|AL interrupt]
    
    Signed-off-by: Moiz Sonasath <m-sonasath at ti.com>
    Signed-off-by: Vikram Pandita <vikram.pandita at ti.com>
    Signed-off-by: Ben Dooks <ben-linux at fluff.org>

commit dcc4ec26942d3bae2c5a82ab8346ab53b540a171
Author: Nishanth Menon <nm at ti.com>
Date:   Thu Aug 20 11:21:14 2009 -0500

    i2c-omap: Fix I2C status ACK
    
    I2C status ack for [RX]RDR and [RX]RDY could
    cause race conditions of clearing the event
    twice and a violation of the programing
    sequence as defined in TRM This patch fixes
    the same.
    
    Signed-off-by: Nishanth Menon <nm at ti.com>
    Signed-off-by: Moiz Sonasath <m-sonasath at ti.com>
    Signed-off-by: Ben Dooks <ben-linux at fluff.org>

commit a1d12511157c8d22a5a6779f8a9d73a1adcfc3b0
Merge: 6c30c53fd5ae6a99a23ad78e90c428d2c8ffb07f 3abf2f3639959e4f53f209f93cd4d93fe9356de1
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 20 10:19:39 2009 -0700

    Merge branch 'fix/hda' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6
    
    * 'fix/hda' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
      ALSA: hda - Fix probe of Toshiba laptops with ALC268 codec
      ALSA: hda: add model for Intel DG45ID/DG45FC boards
      ALSA: hda: enable speaker output for Compaq 6530s/6531s

commit c82f63e411f1b58427c103bd95af2863b1c96dd1
Author: Alek Du <alek.du at intel.com>
Date:   Sat Aug 8 08:46:19 2009 +0800

    PCI: check saved state before restore
    
    Without the check, the config space may be filled with zeros. Though
    the driver should try to avoid call restoring before saving, but the
    pci layer also should check this.
    
    Also removes the existing check in pci_restore_standard_config, since
    it's superfluous with the new check in restore_state.
    
    Acked-by: Rafael J. Wysocki <rjw at sisk.pl>
    Signed-off-by: Alek Du <alek.du at intel.com>
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>

commit cbcb340cb6a6f9f32724c90493f509dd41105e20
Merge: 78b89ecd731798f2fec8cc26ca90739253cec33c ce2eef33d35cd7b932492b5a81fb0febd2b323cd
Author: Ingo Molnar <mingo at elte.hu>
Date:   Thu Aug 20 12:05:24 2009 +0200

    Merge branch 'bugfix' of git://git.kernel.org/pub/scm/linux/kernel/git/jeremy/xen into x86/urgent

commit d3b325f9c25be6d504bc73afce7f92d0e25001d7
Author: Petri Gynther <pgynther at google.com>
Date:   Thu Aug 20 02:21:27 2009 -0700

    ibm_newemac: emac_close() needs to call netif_carrier_off()
    
    When ibm_newemac netdev instance is shutdown with "ifconfig down",
    the netdev interface does not go properly down. netif_carrier_ok()
    keeps returning TRUE even after "ifconfig down".
    
    The problem can be seen when ibm_newemac instances are slaves of
    a bonding interface. The bonding interface code uses netif_carrier_ok()
    to determine the link status of its slaves. When ibm_newemac slave is
    shutdown with "ifconfig down", the bonding interface won't detect any
    link status change because netif_carrier_ok() keeps returning TRUE.
    
    Signed-off-by: Petri Gynther <pgynther at google.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 68947b8f9a36f7f7f54ca95e0c6e169bb603e803
Author: Jiri Kosina <jkosina at suse.cz>
Date:   Wed Aug 19 22:07:44 2009 -0700

    Input: iforce - support new revision of ACT LABS Force RS
    
    Reported-by: cemede at gmail.com
    Signed-off-by: Jiri Kosina <jkosina at suse.cz>
    Signed-off-by: Dmitry Torokhov <dtor at mail.ru>

commit ce2eef33d35cd7b932492b5a81fb0febd2b323cd
Author: Jeremy Fitzhardinge <jeremy.fitzhardinge at citrix.com>
Date:   Mon Aug 17 12:26:53 2009 -0700

    xen: rearrange things to fix stackprotector
    
    Make sure the stack-protector segment registers are properly set up
    before calling any functions which may have stack-protection compiled
    into them.
    
    [ Impact: prevent Xen early-boot crash when stack-protector is enabled ]
    Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge at citrix.com>

commit 5416c2663517ebd0be0664c4d4ce3df0b116c059
Author: Jeremy Fitzhardinge <jeremy.fitzhardinge at citrix.com>
Date:   Mon Aug 17 12:25:41 2009 -0700

    x86: make sure load_percpu_segment has no stackprotector
    
    load_percpu_segment() is used to set up the per-cpu segment registers,
    which are also used for -fstack-protector.  Make sure that the
    load_percpu_segment() function doesn't have stackprotector enabled.
    
    [ Impact: allow percpu setup before calling stack-protected functions ]
    
    Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge at citrix.com>

commit cbb35f8a2858f7e0fff5df598cb286c4bcae5976
Author: Randy Dunlap <randy.dunlap at oracle.com>
Date:   Wed Aug 19 12:13:31 2009 -0700

    net: fix ks8851 build errors
    
    Fix build errors due to missing Kconfig select of CRC32:
    
    ks8851.c:(.text+0x7d2ee): undefined reference to `crc32_le'
    ks8851.c:(.text+0x7d2f5): undefined reference to `bitrev32'
    
    Signed-off-by: Randy Dunlap <randy.dunlap at oracle.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 3abf2f3639959e4f53f209f93cd4d93fe9356de1
Author: Takashi Iwai <tiwai at suse.de>
Date:   Wed Aug 19 20:05:02 2009 +0200

    ALSA: hda - Fix probe of Toshiba laptops with ALC268 codec
    
    There are many variants of Toshiba laptops with ALC268 codec, and
    it seems that a few of them don't work with model=toshiba preset
    since they have the secondary ALC268 codec just for HDMI output.
    This is a regression due to the previous clean-up work to merge all
    Toshiba quirk entries into a single check.
    
    This patch adds the identification of such laptops to apply the
    standard BIOS-probing method.  Unfortunately, Toshiba laptops have
    all the same PCI SSID, so we need to check the codec SSID to identify
    each device.
    
    Tested-by: Alexey Dobriyan <adobriyan at gmail.com>
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

commit 6c30c53fd5ae6a99a23ad78e90c428d2c8ffb07f
Merge: 0dc9aa845c20ed1f46c85f229591b811dffc4b3b a924586036833086b262a371b09d1266c23bb4d1
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Aug 19 10:40:24 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2:
      nilfs2: fix oopses with doubly mounted snapshots
      nilfs2: missing a read lock for segment writer in nilfs_attach_checkpoint()

commit 0dc9aa845c20ed1f46c85f229591b811dffc4b3b
Author: Anton Blanchard <anton at samba.org>
Date:   Wed Aug 19 16:10:16 2009 +0100

    AFS: Documentation updates
    
    Fix some issues with the AFS documentation, found when testing AFS on ppc64:
    
    - Update AFS features: reading/writing, local caching
    - Typo in kafs sysfs debug file
    - Use modprobe instead of insmod in example
    - Update IPs for grand.central.org
    
    Signed-off-by: Anton Blanchard <anton at samba.org>
    Signed-off-by: David Howells <dhowells at redhat.com>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit cad2c8fd9b3afceced08838c87c520e6da417a65
Merge: 4aa2d56b2149e70a0b944b4f21e4aed33d9ab94e 5ef5f72febfea420ce58f670bad83830a5e5e3de
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Aug 19 10:38:36 2009 -0700

    Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6
    
    * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
      drm/kms: teardown crtc correctly when fb is destroyed.
      drm/kms/radeon: cleanup combios TV table like DDX.
      drm/radeon/kms: memset the allocated framebuffer before using it.
      drm/radeon/kms: although LVDS might be possible on crtc 1 don't do it.
      drm/radeon/kms: implement bo busy check + current domain
      drm/radeon/kms: cut down indirects in register accesses.
      drm/radeon/kms: Fix up vertical blank interrupt support.
      drm/radeon/kms: add rv530 R300_SU_REG_DEST + reloc for ZPASS_ADDR
      drm/edid: fixup detailed timings like the X server.
      drm/radeon/kms: Add specific rs690 authorized register table

commit 4aa2d56b2149e70a0b944b4f21e4aed33d9ab94e
Merge: d46c7d9ab8289f23a5e161060b84fd7e63de7921 1fef7891755d99039592aa8d1ed02e981f38de15
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Aug 19 09:44:51 2009 -0700

    Merge branch 'next' of git://git.monstr.eu/linux-2.6-microblaze
    
    * 'next' of git://git.monstr.eu/linux-2.6-microblaze:
      microblaze: Update Microblaze defconfigs
      microblaze: Use klimit instead of _end for memory init
      microblaze: Enable ppoll syscall
      microblaze: Sane handling of missing timer/intc in device tree
      microblaze: use the generic ack_bad_irq implementation

commit d46c7d9ab8289f23a5e161060b84fd7e63de7921
Merge: c124891f50f11e33acdfa276864ea089bab726b6 b395cd8a74b4a8d943dd4b5585e676f62f7350b3
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Aug 19 09:43:19 2009 -0700

    Merge branch 'perfcounters-fixes-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'perfcounters-fixes-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      perf tools: Make 'make html' work
      perf annotate: Fix segmentation fault
      perf_counter: Fix the PARISC build
      perf_counter: Check task on counter read IPI
      perf: Rename perf-examples.txt to examples.txt
      perf record: Fix typo in pid_synthesize_comm_event

commit f833bab87fca5c3ce13778421b1365845843b976
Author: Suresh Siddha <suresh.b.siddha at intel.com>
Date:   Mon Aug 17 14:34:59 2009 -0700

    clockevent: Prevent dead lock on clockevents_lock
    
    Currently clockevents_notify() is called with interrupts enabled at
    some places and interrupts disabled at some other places.
    
    This results in a deadlock in this scenario.
    
    cpu A holds clockevents_lock in clockevents_notify() with irqs enabled
    cpu B waits for clockevents_lock in clockevents_notify() with irqs disabled
    cpu C doing set_mtrr() which will try to rendezvous of all the cpus.
    
    This will result in C and A come to the rendezvous point and waiting
    for B. B is stuck forever waiting for the spinlock and thus not
    reaching the rendezvous point.
    
    Fix the clockevents code so that clockevents_lock is taken with
    interrupts disabled and thus avoid the above deadlock.
    
    Also call lapic_timer_propagate_broadcast() on the destination cpu so
    that we avoid calling smp_call_function() in the clockevents notifier
    chain.
    
    This issue left us wondering if we need to change the MTRR rendezvous
    logic to use stop machine logic (instead of smp_call_function) or add
    a check in spinlock debug code to see if there are other spinlocks
    which gets taken under both interrupts enabled/disabled conditions.
    
    Signed-off-by: Suresh Siddha <suresh.b.siddha at intel.com>
    Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi at intel.com>
    Cc: "Pallipadi Venkatesh" <venkatesh.pallipadi at intel.com>
    Cc: "Brown Len" <len.brown at intel.com>
    LKML-Reference: <1250544899.2709.210.camel at sbs-t61.sc.intel.com>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>

commit fa6963b2481beff8b11f76006fbb63fdbbf2d2d7
Author: Peter Zijlstra <a.p.zijlstra at chello.nl>
Date:   Wed Aug 19 11:18:26 2009 +0200

    perf tools: Check perf.data owner
    
    Add an owner check to opening perf.data files and a switch to
    silence it.
    
    Because perf-report/perf-annotate are binary parsers reading
    another users' perf.data file could be a security risk if the
    file were explicitly engineered to trigger bugs in the parser
    (we hope of course there are non such bugs, but you never
    know).
    
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Paul Mackerras <paulus at samba.org>
    LKML-Reference: <20090819092023.896648538 at chello.nl>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit ae709440edb2d36f51f5ea51cfab931f45c03e02
Author: Wu Fengguang <fengguang.wu at intel.com>
Date:   Wed Aug 19 17:05:11 2009 +0800

    ALSA: hda: add model for Intel DG45ID/DG45FC boards
    
    The BIOS pin configs are in fact correct and shall not be overwritten.
    
    Signed-off-by: Wu Fengguang <fengguang.wu at intel.com>
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

commit 150fe14c1a1f08cb430d8382bf5554c2a168b79b
Author: Wu Fengguang <fengguang.wu at intel.com>
Date:   Wed Aug 19 16:58:59 2009 +0800

    ALSA: hda: enable speaker output for Compaq 6530s/6531s
    
    HP Compaq 6530s and 6531s internal speaker is silence or becomes silence
    within 1 minute after fresh boot. It is found that pin 0x1c must be set to
    PIN_OUT mode to make the speaker work. This is weird - line-in pin 0x1c and
    speaker pin 0x16 seem to be unrelated.
    
    The codec differences before/after patch are:
    
    @@ Node 0x17 [Pin Complex] wcaps 0x40020b:
       Pin Default 0x41a6e130: [N/A] Mic at Ext Rear
         Conn = Digital, Color = White
         DefAssociation = 0x3, Sequence = 0x0
         Misc = NO_PRESENCE
    -  Pin-ctls: 0x24: IN
    +  Pin-ctls: 0x40: OUT
    @@ Node 0x1c [Pin Complex] wcaps 0x40018d:
       Pin Default 0x41813021: [N/A] Line In at Ext Rear
         Conn = 1/8, Color = Blue
         DefAssociation = 0x2, Sequence = 0x1
    -  Pin-ctls: 0x24: IN VREF_80
    +  Pin-ctls: 0x40: OUT VREF_HIZ
       Unsolicited: tag=00, enabled=0
       Connection: 1
          0x24
    
    Tests show that it won't impact (external) Mic recording.
    
    Reported-by: "Lin, Ming M" <ming.m.lin at intel.com>
    Signed-off-by: Wu Fengguang <fengguang.wu at intel.com>
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

commit 1ca3976d8ca8b0b44145994b1433f759a642615b
Author: David S. Miller <davem at davemloft.net>
Date:   Tue Aug 18 23:56:21 2009 -0700

    sparc64: Update defconfig.
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 2193aa276e2579d9c781c5269521d43f47da9959
Author: David S. Miller <davem at davemloft.net>
Date:   Tue Aug 18 23:46:12 2009 -0700

    sparc32: Update defconfig.
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit a9919646d12a13bea7eb74b996686f900dffb120
Author: David S. Miller <davem at davemloft.net>
Date:   Tue Aug 18 23:44:08 2009 -0700

    sparc32: Kill trap table freeing code.
    
    Normally, srmmu uses different trap table register values to allow
    determination of the cpu we're on.  All of the trap tables have
    identical content, they just sit at different offsets from the first
    trap table, and the offset shifted down and masked out determines
    the cpu we are on.
    
    The code tries to free them up when they aren't actually used
    (don't have all 4 cpus, we're on sun4d, etc.) but that causes
    problems.
    
    For one thing it triggers false positives in the DMA debugging
    code.  And fixing that up while preserving this relative offset
    thing isn't trivial.
    
    So just kill the freeing code, it costs us at most 3 pages, big
    deal...
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 456d8991a795ff5e44dbc1c2a7f8d5b4ed675866
Author: Wan ZongShun <mcuos.com at gmail.com>
Date:   Tue Aug 18 23:34:58 2009 -0700

    net: Rename MAC platform driver for w90p910 platform
    
    Due to I modified the corresponding platform device name,
    so I make the patch to rename MAC platform driver
    for w90p910 platform.
    
    Signed-off-by: Wan ZongShun <mcuos.com at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 5ef5f72febfea420ce58f670bad83830a5e5e3de
Author: Dave Airlie <airlied at redhat.com>
Date:   Mon Aug 17 13:11:23 2009 +1000

    drm/kms: teardown crtc correctly when fb is destroyed.
    
    If userspace destroys a framebuffer that is in use on a crtc,
    don't just null it out, tear down the crtc properly so the
    hw gets turned off.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 6a719e05330ef19acd9392dbbfb95a774776dee5
Author: Dave Airlie <airlied at redhat.com>
Date:   Mon Aug 17 10:19:51 2009 +1000

    drm/kms/radeon: cleanup combios TV table like DDX.
    
    The fallback case wasn't getting executed properly if there
    was no TV table, which my T42 M7 hasn't got.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit bf8e828b00a5b6a0fea16f452be578c060d57d64
Author: Dave Airlie <airlied at redhat.com>
Date:   Mon Aug 17 10:20:47 2009 +1000

    drm/radeon/kms: memset the allocated framebuffer before using it.
    
    This gets rid of some ugliness, we shuold probably find a way
    for the GPU to zero this.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 80e6914db18e702549a15dea36fa7ace17f25c50
Author: Dave Airlie <airlied at redhat.com>
Date:   Mon Aug 17 10:22:37 2009 +1000

    drm/radeon/kms: although LVDS might be possible on crtc 1 don't do it.
    
    LVDS always requests RMX_FULL, we need to fix it so that doesn't happen
    before we can enable LVDS on crtc 1.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit e7a5965a81a29a13cd4994fa23a6a7a1488bcdb6
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Tue Aug 18 20:21:40 2009 -0700

    yellowfin: Fix buffer underrun after dev_alloc_skb() failure
    
    yellowfin_init_ring() needs to clean up if dev_alloc_skb() fails and
    should pass an error status up to the caller. This also prevents an
    buffer underrun if failure occurred in the first iteration.
    yellowfin_open() which calls yellowfin_init_ring() should free its
    requested irq upon failure.
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit e2c6cbd9ace61039d3de39e717195e38f1492aee
Author: Mathieu Desnoyers <mathieu.desnoyers at polymtl.ca>
Date:   Tue Aug 18 20:16:55 2009 -0700

    sparc: sys32.S incorrect compat-layer splice() system call
    
    I think arch/sparc/kernel/sys32.S has an incorrect splice definition:
    
    SIGN2(sys32_splice, sys_splice, %o0, %o1)
    
    The splice() prototype looks like :
    
           long splice(int fd_in, loff_t *off_in, int fd_out,
                       loff_t *off_out, size_t len, unsigned int flags);
    
    So I think we should have :
    
    SIGN2(sys32_splice, sys_splice, %o0, %o2)
    
    Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers at polymtl.ca>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit c124891f50f11e33acdfa276864ea089bab726b6
Merge: 77f312a96dd1e01c49ccd872265e70a8346b53cc 024e6cb408307de41cbfcb1e5a170d9af60ab2a9
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 18 19:41:47 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
      security: Fix prompt for LSM_MMAP_MIN_ADDR
      security: Make LSM_MMAP_MIN_ADDR default match its help text.

commit 77f312a96dd1e01c49ccd872265e70a8346b53cc
Merge: dc8ed71eeb8adce08d3070f4130e12ee540baa59 142d44b0dd6741a64a7bdbe029110e7c1dcf1d23
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 18 19:41:05 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu:
      percpu: use the right flag for get_vm_area()
      percpu, sparc64: fix sparse possible cpu map handling
      init: set nr_cpu_ids before setup_per_cpu_areas()

commit eda1e328556565e211b7450250e40d6de751563a
Author: Jiri Olsa <jolsa at redhat.com>
Date:   Tue Aug 11 17:29:04 2009 +0200

    tracing: handle broken names in ftrace filter
    
    If one filter item (for set_ftrace_filter and set_ftrace_notrace) is being
    setup by more than 1 consecutive writes (FTRACE_ITER_CONT flag), it won't
    be handled corretly.
    
    I used following program to test/verify:
    
    [snip]
    #include <stdio.h>
    #include <sys/types.h>
    #include <sys/stat.h>
    #include <fcntl.h>
    #include <string.h>
    
    int main(int argc, char **argv)
    {
            int fd, i;
            char *file = argv[1];
    
            if (-1 == (fd = open(file, O_WRONLY))) {
                    perror("open failed");
                    return -1;
            }
    
            for(i = 0; i < (argc - 2); i++) {
                    int len = strlen(argv[2+i]);
                    int cnt, off = 0;
    
                    while(len) {
                            cnt = write(fd, argv[2+i] + off, len);
                            len -= cnt;
                            off += cnt;
                    }
            }
    
            close(fd);
            return 0;
    }
    [snip]
    
    before change:
    sh-4.0# echo > ./set_ftrace_filter
    sh-4.0# /test ./set_ftrace_filter "sys" "_open "
    sh-4.0# cat ./set_ftrace_filter
    #### all functions enabled ####
    sh-4.0#
    
    after change:
    sh-4.0# echo > ./set_ftrace_notrace
    sh-4.0# test ./set_ftrace_notrace "sys" "_open "
    sh-4.0# cat ./set_ftrace_notrace
    sys_open
    sh-4.0#
    
    Signed-off-by: Jiri Olsa <jolsa at redhat.com>
    LKML-Reference: <20090811152904.GA26065 at jolsa.lab.eng.brq.redhat.com>
    Signed-off-by: Steven Rostedt <rostedt at goodmis.org>

commit dc8ed71eeb8adce08d3070f4130e12ee540baa59
Merge: 7f9cfb31030737a7fc9a1cbca3fd01bec184c849 e412cd257e0d51e0ecbb89f50953835b5a0681b2
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 18 16:55:43 2009 -0700

    Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86, mce: Don't initialize MCEs on unknown CPUs
      x86, mce: don't log boot MCEs on Pentium M (model == 13) CPUs
      x86: Annotate section mismatch warnings in kernel/apic/x2apic_uv_x.c
      x86, mce: therm_throt: Don't log redundant normality
      x86: Fix UV BAU destination subnode id

commit 7f9cfb31030737a7fc9a1cbca3fd01bec184c849
Author: Bo Liu <bo-liu at hotmail.com>
Date:   Tue Aug 18 14:11:19 2009 -0700

    mm: build_zonelists(): move clear node_load[] to __build_all_zonelists()
    
    If node_load[] is cleared everytime build_zonelists() is
    called,node_load[] will have no help to find the next node that should
    appear in the given node's fallback list.
    
    Because of the bug, zonelist's node_order is not calculated as expected.
    This bug affects on big machine, which has asynmetric node distance.
    
    [synmetric NUMA's node distance]
         0    1    2
    0   10   12   12
    1   12   10   12
    2   12   12   10
    
    [asynmetric NUMA's node distance]
         0    1    2
    0   10   12   20
    1   12   10   14
    2   20   14   10
    
    This (my bug) is very old but no one has reported this for a long time.
    Maybe because the number of asynmetric NUMA is very small and they use
    cpuset for customizing node memory allocation fallback.
    
    [akpm at linux-foundation.org: fix CONFIG_NUMA=n build]
    Signed-off-by: Bo Liu <bo-liu at hotmail.com>
    Reviewed-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu at jp.fujitsu.com>
    Cc: Mel Gorman <mel at csn.ul.ie>
    Cc: Christoph Lameter <cl at linux-foundation.org>
    Cc: <stable at kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 503f7944fac68f4fdf71f8ebd06907f51eb64515
Author: Joe Perches <joe at perches.com>
Date:   Tue Aug 18 14:11:18 2009 -0700

    REPORTING-BUGS: add get_maintainer.pl blurb
    
    Signed-off-by: Joe Perches <joe at perches.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 28d7a6ae92c099d81cbea08c20be0d2cf7ccd7ca
Author: Graff Yang <graff.yang at gmail.com>
Date:   Tue Aug 18 14:11:17 2009 -0700

    nommu: check fd read permission in validate_mmap_request()
    
    According to the POSIX (1003.1-2008), the file descriptor shall have been
    opened with read permission, regardless of the protection options specified to
    mmap().  The ltp test cases mmap06/07 need this.
    
    Signed-off-by: Graff Yang <graff.yang at gmail.com>
    Acked-by: Paul Mundt <lethal at linux-sh.org>
    Signed-off-by: David Howells <dhowells at redhat.com>
    Acked-by: Greg Ungerer <gerg at snapgear.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 191529756633052680dd9d23ad63744ca5aa02a1
Author: Ben Dooks <ben at simtec.co.uk>
Date:   Tue Aug 18 14:11:17 2009 -0700

    spi_s3c24xx: fix transfer setup code
    
    Since the changes to the bitbang driver, there is the possibility we will
    be called with either the speed_hz or bpw values zero.  We take these to
    mean that the default values (8 bits per word, or maximum bus speed).
    
    Signed-off-by: Ben Dooks <ben at simtec.co.uk>
    Cc: David Brownell <david-b at pacbell.net>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit b8978784544e8b4e8fbacb558df8580957d4f8a5
Author: Ben Dooks <ben at simtec.co.uk>
Date:   Tue Aug 18 14:11:16 2009 -0700

    spi_s3c24xx: fix clock rate calculation
    
    Currently the clock rate calculation may round as pleased, which means
    that it is possible that we will round down and end up with a faster clock
    rate than intended.
    
    Change the calculation to use DIV_ROUND_UP() to ensure that we end up with
    a clock rate either the same as or lower than the user requested one.
    
    Signed-off-by: Ben Dooks <ben at simtec.co.uk>
    Cc: David Brownell <david-b at pacbell.net>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit b2503a9408e44eb0531adc3436c513ea70f91c42
Author: Andrew Morton <akpm at linux-foundation.org>
Date:   Tue Aug 18 14:11:12 2009 -0700

    mmc: add the new linux-mmc mailing list to MAINTAINERS
    
    There are a number of individual MMC drivers listed in MAINTAINERS.  I
    didn't modify those records.  Perhaps I should have.
    
    Cc: <linux-mmc at vger.kernel.org>
    Cc: Manuel Lauss <manuel.lauss at gmail.com>
    Cc: Nicolas Pitre <nico at cam.org>
    Cc: Pierre Ossman <drzeus at drzeus.cx>
    Cc: Pavel Pisa <ppisa at pikron.com>
    Cc: Jarkko Lavinen <jarkko.lavinen at nokia.com>
    Cc: Ben Dooks <ben-linux at fluff.org>
    Cc: Sascha Sommer <saschasommer at freenet.de>
    Cc: Ian Molton <ian at mnementh.co.uk>
    Cc: Joseph Chan <JosephChan at via.com.tw>
    Cc: Harald Welte <HaraldWelte at viatech.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 0753ba01e126020bf0f8150934903b48935b697d
Author: KOSAKI Motohiro <kosaki.motohiro at jp.fujitsu.com>
Date:   Tue Aug 18 14:11:10 2009 -0700

    mm: revert "oom: move oom_adj value"
    
    The commit 2ff05b2b (oom: move oom_adj value) moveed the oom_adj value to
    the mm_struct.  It was a very good first step for sanitize OOM.
    
    However Paul Menage reported the commit makes regression to his job
    scheduler.  Current OOM logic can kill OOM_DISABLED process.
    
    Why? His program has the code of similar to the following.
    
    	...
    	set_oom_adj(OOM_DISABLE); /* The job scheduler never killed by oom */
    	...
    	if (vfork() == 0) {
    		set_oom_adj(0); /* Invoked child can be killed */
    		execve("foo-bar-cmd");
    	}
    	....
    
    vfork() parent and child are shared the same mm_struct.  then above
    set_oom_adj(0) doesn't only change oom_adj for vfork() child, it's also
    change oom_adj for vfork() parent.  Then, vfork() parent (job scheduler)
    lost OOM immune and it was killed.
    
    Actually, fork-setting-exec idiom is very frequently used in userland program.
    We must not break this assumption.
    
    Then, this patch revert commit 2ff05b2b and related commit.
    
    Reverted commit list
    ---------------------
    - commit 2ff05b2b4e (oom: move oom_adj value from task_struct to mm_struct)
    - commit 4d8b9135c3 (oom: avoid unnecessary mm locking and scanning for OOM_DISABLE)
    - commit 8123681022 (oom: only oom kill exiting tasks with attached memory)
    - commit 933b787b57 (mm: copy over oom_adj value at fork time)
    
    Signed-off-by: KOSAKI Motohiro <kosaki.motohiro at jp.fujitsu.com>
    Cc: Paul Menage <menage at google.com>
    Cc: David Rientjes <rientjes at google.com>
    Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu at jp.fujitsu.com>
    Cc: Rik van Riel <riel at redhat.com>
    Cc: Linus Torvalds <torvalds at linux-foundation.org>
    Cc: Oleg Nesterov <oleg at redhat.com>
    Cc: Nick Piggin <npiggin at suse.de>
    Cc: Mel Gorman <mel at csn.ul.ie>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 89a4eb4b66e8f4d395e14a14d262dac4d6ca52f0
Author: Jeff Layton <jlayton at redhat.com>
Date:   Tue Aug 18 14:11:08 2009 -0700

    vfs: make get_sb_pseudo set s_maxbytes to value that can be cast to signed
    
    get_sb_pseudo sets s_maxbytes to ~0ULL which becomes negative when cast
    to a signed value.  Fix it to use MAX_LFS_FILESIZE which casts properly
    to a positive signed value.
    
    Signed-off-by: Jeff Layton <jlayton at redhat.com>
    Reviewed-by: Johannes Weiner <hannes at cmpxchg.org>
    Acked-by: Steve French <smfrench at gmail.com>
    Reviewed-by: Christoph Hellwig <hch at lst.de>
    Cc: Al Viro <viro at zeniv.linux.org.uk>
    Cc: Robert Love <rlove at google.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 6b6f0b6c131321e1bc34c47b7f671b0360315402
Author: Joe Perches <joe at perches.com>
Date:   Tue Aug 18 14:11:06 2009 -0700

    MAINTAINERS: OSD LIBRARY and FILESYSTEM pattern fix
    
    Signed-off-by: Joe Perches <joe at perches.com>
    Acked-by: Benny Halevy <bhalevy at panasas.com>
    Cc: Boaz Harrosh <bharrosh at panasas.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 08fdef99342955a62884fb5c49ab43431a1cafbf
Merge: c1a8f1f1c8e01eab5862c8db39b49ace814e6c66 518ff04fd84290a7ad9042e8a46d78d29cb443d3
Author: David S. Miller <davem at davemloft.net>
Date:   Tue Aug 18 16:29:16 2009 -0700

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

commit 024e6cb408307de41cbfcb1e5a170d9af60ab2a9
Author: Andreas Schwab <schwab at linux-m68k.org>
Date:   Tue Aug 18 22:14:29 2009 +0200

    security: Fix prompt for LSM_MMAP_MIN_ADDR
    
    Fix prompt for LSM_MMAP_MIN_ADDR.
    
    (Verbs are cool!)
    
    Signed-off-by: Andreas Schwab <schwab at linux-m68k.org>
    Acked-by: Eric Paris <eparis at redhat.com>
    Signed-off-by: James Morris <jmorris at namei.org>

commit a58578e47f004017cf47803ad372490806630e58
Author: Dave Jones <davej at redhat.com>
Date:   Tue Aug 18 13:47:37 2009 -0400

    security: Make LSM_MMAP_MIN_ADDR default match its help text.
    
    Commit 788084aba2ab7348257597496befcbccabdc98a3 added the LSM_MMAP_MIN_ADDR
    option, whose help text states "For most ia64, ppc64 and x86 users with lots
    of address space a value of 65536 is reasonable and should cause no problems."
    Which implies that it's default setting was typoed.
    
    Signed-off-by: Dave Jones <davej at redhat.com>
    Acked-by: Eric Paris <eparis at redhat.com>
    Signed-off-by: James Morris <jmorris at namei.org>

commit dcd94dbdaff452b95d4ba11fdbf853b5bda8e6e7
Merge: 8486a0f95c844b27ecc855cfec89b7e34f831cad 69ab849439b506cd8dd2879527fdb64d95dd5211
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 18 13:57:38 2009 -0700

    Merge branch 'irq-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'irq-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      genirq: Wake up irq thread after action has been installed

commit 8486a0f95c844b27ecc855cfec89b7e34f831cad
Merge: b9d030a123b6b7fbf262c995455197ea5184b497 c1a8f1f1c8e01eab5862c8db39b49ace814e6c66
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 18 13:55:01 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (60 commits)
      net: restore gnet_stats_basic to previous definition
      NETROM: Fix use of static buffer
      e1000e: fix use of pci_enable_pcie_error_reporting
      e1000e: WoL does not work on 82577/82578 with manageability enabled
      cnic: Fix locking in init/exit calls.
      cnic: Fix locking in start/stop calls.
      bnx2: Use mutex on slow path cnic calls.
      cnic: Refine registration with bnx2.
      cnic: Fix symbol_put_addr() panic on ia64.
      gre: Fix MTU calculation for bound GRE tunnels
      pegasus: Add new device ID.
      drivers/net: fixed drivers that support netpoll use ndo_start_xmit()
      via-velocity: Fix test of mii_status bit VELOCITY_DUPLEX_FULL
      rt2x00: fix memory corruption in rf cache, add a sanity check
      ixgbe: Fix receive on real device when VLANs are configured
      ixgbe: Do not return 0 in ixgbe_fcoe_ddp() upon FCP_RSP in DDP completion
      netxen: free napi resources during detach
      netxen: remove netxen workqueue
      ixgbe: fix issues setting rx-usecs with legacy interrupts
      can: fix oops caused by wrong rtnl newlink usage
      ...

commit b9d030a123b6b7fbf262c995455197ea5184b497
Merge: 435a71d9ef68b03343949c814986e01dae849763 237674e050ae8ea40a432412df6c15d60b7ae8a6
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 18 13:54:26 2009 -0700

    Merge branch 'sh/for-2.6.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6
    
    * 'sh/for-2.6.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
      sh: sh7724 ddr self-refresh changes
      sh: use in-soc KEYSC on se7724
      sh: CMT suspend/resume
      sh: skip disabled LCDC channels

commit 435a71d9ef68b03343949c814986e01dae849763
Merge: df4ecf1524c7793de3121b2d4e5fc6bcc0da3bfb 80ffb3cceaefa405f2ecd46d66500ed8d53efe74
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 18 13:54:08 2009 -0700

    Merge branch 'for-linus' of git://neil.brown.name/md
    
    * 'for-linus' of git://neil.brown.name/md:
      Fix new incorrect error return from do_md_stop.

commit a924586036833086b262a371b09d1266c23bb4d1
Author: Ryusuke Konishi <konishi.ryusuke at lab.ntt.co.jp>
Date:   Wed Aug 19 00:29:43 2009 +0900

    nilfs2: fix oopses with doubly mounted snapshots
    
    will fix kernel oopses like the following:
    
     # mount -t nilfs2 -r -o cp=20 /dev/sdb1 /test1
     # mount -t nilfs2 -r -o cp=20 /dev/sdb1 /test2
     # umount /test1
     # umount /test2
    
    BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:1069
    in_atomic(): 0, irqs_disabled(): 1, pid: 3886, name: umount.nilfs2
    1 lock held by umount.nilfs2/3886:
     #0:  (&type->s_umount_key#31){+.+...}, at: [<c10b398a>] deactivate_super+0x52/0x6c
    irq event stamp: 1219
    hardirqs last  enabled at (1219): [<c135c774>] __mutex_unlock_slowpath+0xf8/0x119
    hardirqs last disabled at (1218): [<c135c6d5>] __mutex_unlock_slowpath+0x59/0x119
    softirqs last  enabled at (1214): [<c1033316>] __do_softirq+0x1a5/0x1ad
    softirqs last disabled at (1205): [<c1033354>] do_softirq+0x36/0x5a
    Pid: 3886, comm: umount.nilfs2 Not tainted 2.6.31-rc6 #55
    Call Trace:
     [<c1023549>] __might_sleep+0x107/0x10e
     [<c13603c0>] do_page_fault+0x246/0x397
     [<c136017a>] ? do_page_fault+0x0/0x397
     [<c135e753>] error_code+0x6b/0x70
     [<c136017a>] ? do_page_fault+0x0/0x397
     [<c104f805>] ? __lock_acquire+0x91/0x12fd
     [<c1050a62>] ? __lock_acquire+0x12ee/0x12fd
     [<c1050a62>] ? __lock_acquire+0x12ee/0x12fd
     [<c1050b2b>] lock_acquire+0xba/0xdd
     [<d0d17d3f>] ? nilfs_detach_segment_constructor+0x2f/0x2fa [nilfs2]
     [<c135d4fe>] down_write+0x2a/0x46
     [<d0d17d3f>] ? nilfs_detach_segment_constructor+0x2f/0x2fa [nilfs2]
     [<d0d17d3f>] nilfs_detach_segment_constructor+0x2f/0x2fa [nilfs2]
     [<c104ea2c>] ? mark_held_locks+0x43/0x5b
     [<c104ecb1>] ? trace_hardirqs_on_caller+0x10b/0x133
     [<c104ece4>] ? trace_hardirqs_on+0xb/0xd
     [<d0d09ac1>] nilfs_put_super+0x2f/0xca [nilfs2]
     [<c10b3352>] generic_shutdown_super+0x49/0xb8
     [<c10b33de>] kill_block_super+0x1d/0x31
     [<c10e6599>] ? vfs_quota_off+0x0/0x12
     [<c10b398f>] deactivate_super+0x57/0x6c
     [<c10c4bc3>] mntput_no_expire+0x8c/0xb4
     [<c10c5094>] sys_umount+0x27f/0x2a4
     [<c10c50c6>] sys_oldumount+0xd/0xf
     [<c10031a4>] sysenter_do_call+0x12/0x38
     ...
    
    This turns out to be a bug brought by an -rc1 patch ("nilfs2: simplify
    remaining sget() use").
    
    In the patch, a new "put resource" function, nilfs_put_sbinfo()
    was introduced to delay freeing nilfs_sb_info struct.
    
    But the nilfs_put_sbinfo() mistakenly used atomic_dec_and_test()
    function to check the reference count, and it caused the nilfs_sb_info
    was freed when user mounted a snapshot twice.
    
    This bug also suggests there was unseen memory leak in usual mount
    /umount operations for nilfs.
    
    Signed-off-by: Ryusuke Konishi <konishi.ryusuke at lab.ntt.co.jp>

commit b395cd8a74b4a8d943dd4b5585e676f62f7350b3
Author: Kyle McMartin <kyle at redhat.com>
Date:   Tue Aug 18 12:41:25 2009 -0400

    perf tools: Make 'make html' work
    
    pushd tools/perf/Documentation
    make html
    popd
    
    is failing for me...
    
        ASCIIDOC perf-annotate.html
    ERROR: unsafe: include file: /etc/asciidoc/./stylesheets/xhtml11.css
    ERROR: unsafe: include file:
    /etc/asciidoc/./stylesheets/xhtml11-manpage.css
    ERROR: unsafe: include file:
    /etc/asciidoc/./stylesheets/xhtml11-quirks.css
    make: *** [perf-annotate.html] Error 1
    
    Apparently asciidoc "unsafe" is the default mode of operation
    in practice.
    
    https://bugzilla.redhat.com/show_bug.cgi?id=506953
    
    Works tidily now.
    
    Signed-off-by: Kyle McMartin <kyle at redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    LKML-Reference: <20090818164125.GM25206 at bombadil.infradead.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 78b89ecd731798f2fec8cc26ca90739253cec33c
Author: Jan Beulich <JBeulich at novell.com>
Date:   Tue Aug 18 16:41:33 2009 +0100

    i386: Fix section mismatches for init code with !HOTPLUG_CPU
    
    Commit 0e83815be719d3391bf5ea24b7fe696c07dbd417 changed the
    section the initial_code variable gets allocated in, in an
    attempt to address a section conflict warning. This, however
    created a new section conflict when building without
    HOTPLUG_CPU. The apparently only (reasonable) way to address
    this is to always use __REFDATA.
    
    Once at it, also fix a second section mismatch when not using
    HOTPLUG_CPU.
    
    Signed-off-by: Jan Beulich <jbeulich at novell.com>
    Cc: Robert Richter <robert.richter at amd.com>
    LKML-Reference: <4A8AE7CD020000780001054B at vpn.id2.novell.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 69ab849439b506cd8dd2879527fdb64d95dd5211
Author: Thomas Gleixner <tglx at linutronix.de>
Date:   Mon Aug 17 14:07:16 2009 +0200

    genirq: Wake up irq thread after action has been installed
    
    The wake_up_process() of the new irq thread in __setup_irq() is too
    early as the irqaction is not yet fully initialized especially
    action->irq is not yet set. The interrupt thread might dereference the
    wrong irq descriptor.
    
    Move the wakeup after the action is installed and action->irq has been
    set.
    
    Reported-by: Michael Buesch <mb at bu3sch.de>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>
    Tested-by: Michael Buesch <mb at bu3sch.de>

commit 15f3fa4e7f608c5ce19187b3b4a953222fdfa751
Author: Ingo Molnar <mingo at elte.hu>
Date:   Tue Aug 18 13:52:28 2009 +0200

    perf annotate: Fix segmentation fault
    
    Linus reported this perf annotate segfault:
    
            [torvalds at nehalem git]$ perf annotate unmap_vmas
            Segmentation fault
    
           	#0  map__clone (self=<value optimized out>) at builtin-annotate.c:236
           	#1  thread__fork (self=<value optimized out>) at builtin-annotate.c:372
    
    The bug here was that builtin-annotate.c was a copy of
    builtin-report.c and a threading related fix to builtin-report.c
    didnt get propagated to builtin-annotate.c ...
    
    Reported-by: Linus Torvalds <torvalds at linux-foundation.org>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    LKML-Reference: <new-submission>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit f738eb1b63edf664da1b4ac76895d988749b2f07
Author: Ingo Molnar <mingo at elte.hu>
Date:   Tue Aug 18 11:32:24 2009 +0200

    perf_counter: Fix the PARISC build
    
    PARISC does not build:
    
    /home/mingo/tip/kernel/perf_counter.c: In function 'perf_counter_index':
    /home/mingo/tip/kernel/perf_counter.c:2016: error: 'PERF_COUNTER_INDEX_OFFSET' undeclared (first use in this function)
    /home/mingo/tip/kernel/perf_counter.c:2016: error: (Each undeclared identifier is reported only once
    /home/mingo/tip/kernel/perf_counter.c:2016: error: for each function it appears in.)
    
    As PERF_COUNTER_INDEX_OFFSET is not defined.
    
    Now, we could define it in the architecture - but lets also provide
    a core default of 0 (which happens to be what all but one
    architecture uses at the moment).
    
    Architectures that need a different index offset should set this
    value in their asm/perf_counter.h files.
    
    Cc: Kyle McMartin <kyle at mcmartin.ca>
    Cc: Helge Deller <deller at gmx.de>
    Cc: linux-parisc at vger.kernel.org
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    LKML-Reference: <new-submission>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 1fef7891755d99039592aa8d1ed02e981f38de15
Author: Michal Simek <monstr at monstr.eu>
Date:   Tue Aug 18 11:05:11 2009 +0200

    microblaze: Update Microblaze defconfigs
    
    Signed-off-by: Michal Simek <monstr at monstr.eu>

commit 8f37b6c9852ff79cc8472c44ea6f6485dfd58bd2
Author: Michal Simek <monstr at monstr.eu>
Date:   Tue Aug 11 12:36:12 2009 +0200

    microblaze: Use klimit instead of _end for memory init
    
    For noMMU system when you use larger rootfs image
    there is problem with using _end label because
    we increase klimit but in memory initialization
    we use still _end which is wrong. Larger mtd rootfs
    was rewritten by init_bootmem_node.
    
    MMU kernel use static initialization where klimit
    is setup to _end. There is no any other hanling
    with klimit.
    
    Signed-off-by: Michal Simek <monstr at monstr.eu>

commit 2856ed35ead295a7cc8788d9ba860e746dfc92bb
Author: Michal Simek <monstr at monstr.eu>
Date:   Thu Aug 6 16:00:52 2009 +0200

    microblaze: Enable ppoll syscall
    
    Signed-off-by: Michal Simek <monstr at monstr.eu>

commit 892ee92b81b6e7fa5f6147c96e11c6c1b9802fc6
Author: John Williams <john.williams at petalogix.com>
Date:   Wed Jul 29 22:08:40 2009 +1000

    microblaze: Sane handling of missing timer/intc in device tree
    
    This code path doesn't test any returned pointers for NULL, leading to a bad
    kernel page fault if there's no timer/intc found.
    
    Slightly better is to BUG(), but even better still would be a printk beforehand.
    
    Signed-off-by: John Williams <john.williams at petalogix.com>
    Signed-off-by: Michal Simek <monstr at monstr.eu>

commit 6b99ecec25c8fd501e74306f5d23dd0365065e2a
Author: Christoph Hellwig <hch at lst.de>
Date:   Thu Aug 6 23:00:38 2009 +0200

    microblaze: use the generic ack_bad_irq implementation
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Signed-off-by: Michal Simek <monstr at monstr.eu>

commit 1154ecbd2f8298ef75609f5f8ed5aca96be599fb
Author: Zhang Qiang <zhangqiang.buaa at gmail.com>
Date:   Tue Aug 18 14:58:24 2009 +0800

    nilfs2: missing a read lock for segment writer in nilfs_attach_checkpoint()
    
    'ns_cno' of structure 'the_nilfs' must be protected from segment
    writer, in other words, the caller of nilfs_get_checkpoint should hold
    read lock for nilfs->ns_segctor_sem.  This patch adds the lock/unlock
    operations in nilfs_attach_checkpoint() when calling
    nilfs_cpfile_get_checkpoint().
    
    Signed-off-by: Zhang Qiang <zhangqiang.buaa at gmail.com>
    Signed-off-by: Ryusuke Konishi <konishi.ryusuke at lab.ntt.co.jp>

commit c1a8f1f1c8e01eab5862c8db39b49ace814e6c66
Author: Eric Dumazet <eric.dumazet at gmail.com>
Date:   Sun Aug 16 09:36:49 2009 +0000

    net: restore gnet_stats_basic to previous definition
    
    In 5e140dfc1fe87eae27846f193086724806b33c7d "net: reorder struct Qdisc
    for better SMP performance" the definition of struct gnet_stats_basic
    changed incompatibly, as copies of this struct are shipped to
    userland via netlink.
    
    Restoring old behavior is not welcome, for performance reason.
    
    Fix is to use a private structure for kernel, and
    teach gnet_stats_copy_basic() to convert from kernel to user land,
    using legacy structure (struct gnet_stats_basic)
    
    Based on a report and initial patch from Michael Spang.
    
    Reported-by: Michael Spang <mspang at csclub.uwaterloo.ca>
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit c6ba973b8fa97422aab4204f7d79f1d413cde925
Author: Ralf Baechle <ralf at linux-mips.org>
Date:   Mon Aug 17 18:05:32 2009 -0700

    NETROM: Fix use of static buffer
    
    The static variable used by nr_call_to_digi might result in corruption if
    multiple threads are trying to usee a node or neighbour via ioctl.  Fixed
    by having the caller pass a structure in.  This is safe because nr_add_node
    rsp. nr_add_neigh will allocate a permanent structure, if needed.
    
    Signed-off-by: Ralf Baechle <ralf at linux-mips.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 80ffb3cceaefa405f2ecd46d66500ed8d53efe74
Author: NeilBrown <neilb at suse.de>
Date:   Tue Aug 18 10:35:26 2009 +1000

    Fix new incorrect error return from do_md_stop.
    
    Recent commit c8c00a6915a2e3d10416e8bdd3138429beb96210
    changed the exit paths in do_md_stop and was not quite
    careful enough.  There is one path were 'err' now needs
    to be cleared but it isn't.
    So setting an array to readonly (with mdadm --readonly) will
    work, but will incorrectly report and error: ENXIO.
    
    Signed-off-by: NeilBrown <neilb at suse.de>

commit f2d84b65b9778e8a35dd904f7d3993f0a60c9756
Author: Zhaolei <zhaolei at cn.fujitsu.com>
Date:   Fri Aug 7 18:55:48 2009 +0800

    ftrace: Unify effect of writing to trace_options and option/*
    
    "echo noglobal-clock > trace_options" can be used to change trace
    clock but "echo 0 > options/global-clock" can't. The flag toggling
    will be silently accepted without actually changing the clock callback.
    
    We can fix it by using set_tracer_flags() in
    trace_options_core_write().
    
    Changelog:
    v1->v2: Simplified switch() after Li Zefan <lizf at cn.fujitsu.com>'s
            suggestion
    
    Signed-off-by: Zhao Lei <zhaolei at cn.fujitsu.com>
    Cc: Steven Rostedt <srostedt at redhat.com>
    Cc: Li Zefan <lizf at cn.fujitsu.com>
    Signed-off-by: Frederic Weisbecker <fweisbec at gmail.com>

commit 7815f4be4026b6c5027058102ae67a4b9feffa5f
Author: Eric Van Hensbergen <ericvh at gmail.com>
Date:   Mon Aug 17 16:49:44 2009 -0500

    9p: update documentation pointers
    
    Signed-off-by: Eric Van Hensbergen <ericvh at gmail.com>

commit 4b53e4b500779230aedd5355940aeaaed0b5353b
Author: Abhishek Kulkarni <adkulkar at umail.iu.edu>
Date:   Mon Aug 17 16:42:28 2009 -0500

    9p: remove unnecessary v9fses->options which duplicates the mount string
    
    The mount options string is saved in sb->s_options. This patch removes
    the redundant duplicating of the mount options. Also, since we are not
    displaying anything special in show options, we replace v9fs_show_options
    with generic_show_options for now.
    
    Signed-off-by: Abhishek Kulkarni <adkulkar at umail.iu.edu>
    Signed-off-by: Eric Van Hensbergen <ericvh at gmail.com>

commit 0aad37ef3deed118d3816e1d1a600eb2ec9dcb87
Author: Abhishek Kulkarni <adkulkar at umail.iu.edu>
Date:   Mon Aug 17 16:38:45 2009 -0500

    net/9p: insulate the client against an invalid error code sent by a 9p server
    
    A looney tunes server sending an invalid error code (which is !IS_ERR_VALUE)
    can result in a client oops. So fix it by adding a check and converting unknown
    or invalid error codes to -ESERVERFAULT.
    
    Signed-off-by: Abhishek Kulkarni <adkulkar at umail.iu.edu>
    Signed-off-by: Eric Van Hensbergen <ericvh at gmail.com>

commit 48559b4c30708ebdc849483da9fb83ee08c6c908
Author: Abhishek Kulkarni <adkulkar at umail.iu.edu>
Date:   Mon Aug 17 16:32:18 2009 -0500

    9p: Add missing cast for the error return value in v9fs_get_inode
    
    Cast the error return value (ENOMEM) in v9fs_get_inode() to its
    correct type using ERR_PTR.
    
    Signed-off-by: Abhishek Kulkarni <adkulkar at umail.iu.edu>
    Signed-off-by: Eric Van Hensbergen <ericvh at gmail.com>

commit 5fd131893793567c361ae64cbeb28a2a753bbe35
Author: Jan Kara <jack at suse.cz>
Date:   Thu Jul 30 17:01:53 2009 +0200

    ocfs2: Don't oops in ocfs2_kill_sb on a failed mount
    
    If we fail to mount the filesystem, we have to be careful not to dereference
    uninitialized structures in ocfs2_kill_sb.
    
    Signed-off-by: Jan Kara <jack at suse.cz>
    Signed-off-by: Joel Becker <joel.becker at oracle.com>

commit 4d3297ca5bf37ff5956f76fb352e009880aad62d
Author: Abhishek Kulkarni <adkulkar at umail.iu.edu>
Date:   Sun Jul 19 13:41:51 2009 -0600

    9p: Remove redundant inode uid/gid assignment
    
    Remove a redundant update of inode's i_uid and i_gid
    after v9fs_get_inode() since the latter already sets up
    a new inode and sets the proper uid and gid values.
    
    Signed-off-by: Abhishek Kulkarni <adkulkar at umail.iu.edu>
    Signed-off-by: Eric Van Hensbergen <ericvh at gmail.com>

commit 1b5ab3e86712b6be38ebbe0d821387c1d8f91d7c
Author: Abhishek Kulkarni <adkulkar at umail.iu.edu>
Date:   Sun Jul 19 13:41:52 2009 -0600

    9p: Fix possible regressions when ->get_sb fails.
    
    ->get_sb can fail causing some badness. this patch fixes
       * clear sb->fs_s_info in kill_sb.
       * deactivate_locked_super() calls kill_sb (v9fs_kill_super) which closes the
         destroys the client, clunks all its fids and closes the v9fs session.
         Attempting to do it twice will cause an oops.
    
    Signed-off-by: Abhishek Kulkarni <adkulkar at umail.iu.edu>
    Signed-off-by: Eric Van Hensbergen <ericvh at gmail.com>

commit 4f4038328da5eb9cc237b51d3fe68138fd3fea14
Author: Abhishek Kulkarni <adkulkar at umail.iu.edu>
Date:   Sun Jul 19 13:41:53 2009 -0600

    9p: Fix v9fs show_options
    
    Add the delimiter ',' before the options when they are passed
    and check if no option parameters are passed to prevent displaying
    NULL in /proc/mounts.
    
    Signed-off-by: Abhishek Kulkarni <adkulkar at umail.iu.edu>
    Signed-off-by: Eric Van Hensbergen <ericvh at gmail.com>

commit 02bc35672b2fdf251e264adca5407792f63191e4
Author: Abhishek Kulkarni <adkulkar at umail.iu.edu>
Date:   Sun Jul 19 13:41:54 2009 -0600

    9p: Fix possible memleak in v9fs_inode_from fid.
    
    Add missing p9stat_free in v9fs_inode_from_fid to avoid
    any possible leaks.
    
    Signed-off-by: Abhishek Kulkarni <adkulkar at umail.iu.edu>
    Signed-off-by: Eric Van Hensbergen <ericvh at gmail.com>

commit 0e15597ebfe00e28857185f46aba00f400480ffe
Author: Abhishek Kulkarni <adkulkar at umail.iu.edu>
Date:   Sun Jul 19 13:41:55 2009 -0600

    9p: minor comment fixes
    
    Fix the comments -- mostly the improper and/or missing descriptions
    of function parameters.
    
    Signed-off-by: Abhishek Kulkarni <adkulkar at umail.iu.edu>
    Signed-off-by: Eric Van Hensbergen <ericvh at gmail.com>

commit 2bb541157fe2602af7b9952096d0524f6f9c1e73
Author: Abhishek Kulkarni <adkulkar at umail.iu.edu>
Date:   Sun Jul 19 13:41:56 2009 -0600

    9p: Fix possible inode leak in v9fs_get_inode.
    
    Add a missing iput when cleaning up if v9fs_get_inode
    fails after returning a valid inode.
    
    Signed-off-by: Abhishek Kulkarni <adkulkar at umail.iu.edu>
    Signed-off-by: Eric Van Hensbergen <ericvh at gmail.com>

commit 50fb6d2bd7062708892ae7147f30c3ee905b7a3d
Author: Abhishek Kulkarni <adkulkar at umail.iu.edu>
Date:   Sun Jul 19 13:41:57 2009 -0600

    9p: Check for error in return value of v9fs_fid_add
    
    Check if v9fs_fid_add was successful or not based on its
    return value.
    
    Signed-off-by: Abhishek Kulkarni <adkulkar at umail.iu.edu>
    Signed-off-by: Eric Van Hensbergen <ericvh at gmail.com>

commit 1adcaafe7414c5731f758b158aa0525057225deb
Author: Suresh Siddha <suresh.b.siddha at intel.com>
Date:   Mon Aug 17 13:23:50 2009 -0700

    x86, pat: Allow ISA memory range uncacheable mapping requests
    
    Max Vozeler reported:
    >  Bug 13877 -  bogl-term broken with CONFIG_X86_PAT=y, works with =n
    >
    >  strace of bogl-term:
    >  814   mmap2(NULL, 65536, PROT_READ|PROT_WRITE, MAP_SHARED, 4, 0)
    >				 = -1 EAGAIN (Resource temporarily unavailable)
    >  814   write(2, "bogl: mmaping /dev/fb0: Resource temporarily unavailable\n",
    >	       57) = 57
    
    PAT code maps the ISA memory range as WB in the PAT attribute, so that
    fixed range MTRR registers define the actual memory type (UC/WC/WT etc).
    
    But the upper level is_new_memtype_allowed() API checks are failing,
    as the request here is for UC and the return tracked type is WB (Tracked type is
    WB as MTRR type for this legacy range potentially will be different for each
    4k page).
    
    Fix is_new_memtype_allowed() by always succeeding the ISA address range
    checks, as the null PAT (WB) and def MTRR fixed range register settings
    satisfy the memory type needs of the applications that map the ISA address
    range.
    
    Reported-and-Tested-by: Max Vozeler <xam at debian.org>
    Signed-off-by: Suresh Siddha <suresh.b.siddha at intel.com>
    Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi at intel.com>
    Signed-off-by: H. Peter Anvin <hpa at zytor.com>

commit df4ecf1524c7793de3121b2d4e5fc6bcc0da3bfb
Merge: c58afec8b2576b121eced7b94eb94eaf4626bacc 87c62a66edd645a9b1ff1f9b00ab20c5a93d8845
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 17 13:39:52 2009 -0700

    Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus
    
    * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
      MIPS: Fix HPAGE_SIZE redefinition

commit c58afec8b2576b121eced7b94eb94eaf4626bacc
Merge: 52dec22e739eec8f3a0154f768a599f5489048bd bc990f5cb424cdca9dda866785d088e2c2110ecc
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 17 13:39:30 2009 -0700

    Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
    
    * 'for-linus' of git://oss.sgi.com/xfs/xfs:
      xfs: fix locking in xfs_iget_cache_hit

commit 52dec22e739eec8f3a0154f768a599f5489048bd
Merge: 08e53fcb0db34baca3db84a457b6d67faabee4c6 1d9959734a1949ea4f2427bd2d8b21ede6b2441c
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 17 13:38:58 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
      security: define round_hint_to_min in !CONFIG_SECURITY
      Security/SELinux: seperate lsm specific mmap_min_addr
      SELinux: call cap_file_mmap in selinux_file_mmap
      Capabilities: move cap_file_mmap to commoncap.c

commit 08e53fcb0db34baca3db84a457b6d67faabee4c6
Author: Eric Paris <eparis at redhat.com>
Date:   Sun Aug 16 21:51:55 2009 -0400

    inotify: start watch descriptor count at 1
    
    The inotify_add_watch man page specifies that inotify_add_watch() will
    return a non-negative integer.  However, historically the inotify
    watches started at 1, not at 0.
    
    Turns out that the inotifywait program provided by the inotify-tools
    package doesn't properly handle a 0 watch descriptor.  In 7e790dd5 we
    changed from starting at 1 to starting at 0.  This patch starts at 1,
    just like in previous kernels, but also just like in previous kernels
    it's possible for it to wrap back to 0.  This preserves the kernel
    functionality exactly like it was before the patch (neither method broke
    the spec)
    
    Signed-off-by: Eric Paris <eparis at redhat.com>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit cd94c8bbef8d4b796a7ed4c551355a334604fd36
Author: Eric Paris <eparis at redhat.com>
Date:   Sun Aug 16 21:51:49 2009 -0400

    inotify: tail drop inotify q_overflow events
    
    In f44aebcc the tail drop logic of events with no file backing
    (q_overflow and in_ignored) was reversed so IN_IGNORED events would
    never be tail dropped.  This now means that Q_OVERFLOW events are NOT
    tail dropped.  The fix is to not tail drop IN_IGNORED, but to tail drop
    Q_OVERFLOW.
    
    Signed-off-by: Eric Paris <eparis at redhat.com>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit eef3a116be11d35396efb2a8cc7345fd3221e294
Author: Eric Paris <eparis at redhat.com>
Date:   Sun Aug 16 21:51:44 2009 -0400

    notify: unused event private race
    
    inotify decides if private data it passed to get added to an event was
    used by checking list_empty().  But it's possible that the event may
    have been dequeued and the private event removed so it would look empty.
    
    The fix is to use the return code from fsnotify_add_notify_event rather
    than looking at the list.
    
    Signed-off-by: Eric Paris <eparis at redhat.com>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 0f66f96d21b4bbff49baaa337546e687d7c58e87
Merge: 894ef820b10d77e2d6d717342fc408bdd9825139 a2bb9f4d6a5a589b481595207ac3588cc08d1b60
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 17 13:36:39 2009 -0700

    Merge master.kernel.org:/home/rmk/linux-2.6-arm
    
    * master.kernel.org:/home/rmk/linux-2.6-arm: (37 commits)
      ARM: 5673/1: U300 fix initsection compile warning
      ARM: Fix broken highmem support
      mx31moboard: invert sdhc ro signal sense
      ARM: S3C24XX: Fix clkout mpx error
      ARM: S3C64XX: serial: Fix a typo in Kconfig
      IXP4xx: Fix IO_SPACE_LIMIT for 2.6.31-rc core PCI changes
      OMAP3: RX51: Updated rx51_defconfig
      OMAP2/3: mmc-twl4030: Free up MMC regulators while cleaning up
      OMAP3: RX51: Define TWL4030 USB transceiver in board file
      OMAP3: Overo: Fix smsc911x platform device resource value
      OMAP3: Fix omap3 sram virtual addres overlap vmalloc space after increasing vmalloc size
      OMAP2/3: DMA errata correction
      OMAP: Fix testing of cpu defines for mach-omap1
      OMAP3: Overo: add missing pen-down GPIO definition
      OMAP: GPIO: clear/restore level/edge detect settings on mask/unmask
      OMAP3: PM: Fix wrong sequence in suspend.
      OMAP: PM: CPUfreq: obey min/max settings of policy
      OMAP2/3/4: UART: allow in-order port traversal
      OMAP2/3/4: UART: Allow per-UART disabling wakeup for serial ports
      OMAP3: Fixed crash bug with serial + suspend
      ...

commit 60e2ec48665b8495360ca4a6004c5cd52beb2bc1
Author: Tao Ma <tao.ma at oracle.com>
Date:   Wed Aug 12 14:42:47 2009 +0800

    ocfs2: release the buffer head in ocfs2_do_truncate.
    
    In ocfs2_do_truncate, we forget to release last_eb_bh which
    will cause memleak. So call brelse in the end.
    
    Signed-off-by: Tao Ma <tao.ma at oracle.com>
    Signed-off-by: Joel Becker <joel.becker at oracle.com>

commit ada508274b8698a33cb0e5bd037db0f9dc781795
Author: Jan Kara <jack at suse.cz>
Date:   Mon Aug 3 18:24:21 2009 +0200

    ocfs2: Handle quota file corruption more gracefully
    
    ocfs2_read_virt_blocks() does BUG when we try to read a block from a file
    beyond its end. Since this can happen due to filesystem corruption, it
    is not really an appropriate answer. Make ocfs2_read_quota_block() check
    the condition and handle it by calling ocfs2_error() and returning EIO.
    
    [ Modified to print ip_blkno in the error - Joel ]
    
    Reported-by: Tristan Ye <tristan.ye at oracle.com>
    Signed-off-by: Jan Kara <jack at suse.cz>
    Signed-off-by: Joel Becker <joel.becker at oracle.com>

commit 518ff04fd84290a7ad9042e8a46d78d29cb443d3
Author: John W. Linville <linville at tuxdriver.com>
Date:   Mon Aug 17 12:09:26 2009 -0400

    orinoco: correct key bounds check in orinoco_hw_get_tkip_iv
    
    If key is 4 that is an array out of bounds.
    
    Reported-by: Dan Carpenter <error27 at gmail.com>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit 523d2f6982136d332c9b7dd00e9e16da1091f060
Author: Johannes Berg <johannes at sipsolutions.net>
Date:   Wed Jul 1 21:26:43 2009 +0200

    mac80211: fix todo lock
    
    The key todo lock can be taken from different locks
    that require it to be _bh to avoid lock inversion
    due to (soft)irqs.
    
    This should fix the two problems reported by Bob and
    Gabor:
    http://mid.gmane.org/20090619113049.GB18956@hash.localnet
    http://mid.gmane.org/4A3FA376.8020307@openwrt.org
    
    Signed-off-by: Johannes Berg <johannes at sipsolutions.net>
    Cc: Bob Copeland <me at bobcopeland.com>
    Cc: Gabor Juhos <juhosg at openwrt.org>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit 87c62a66edd645a9b1ff1f9b00ab20c5a93d8845
Author: Atsushi Nemoto <anemo at mba.ocn.ne.jp>
Date:   Tue Jul 14 22:37:09 2009 +0900

    MIPS: Fix HPAGE_SIZE redefinition
    
    This patch fixes warnings like this:
      CC      fs/proc/meminfo.o
    In file included from /work/linux/include/linux/mmzone.h:20,
                     from /work/linux/include/linux/gfp.h:4,
                     from /work/linux/include/linux/mm.h:8,
                     from /work/linux/fs/proc/meminfo.c:5:
    /work/linux/arch/mips/include/asm/page.h:36:1: warning: "HPAGE_SIZE" redefined
    In file included from /work/linux/fs/proc/meminfo.c:2:
    /work/linux/include/linux/hugetlb.h:107:1: warning: this is the location of the previous definition
    
    Signed-off-by: Atsushi Nemoto <anemo at mba.ocn.ne.jp>
    Acked-by: David Daney <ddaney at caviumnetworks.com>
    Signed-off-by: Ralf Baechle <ralf at linux-mips.org>

commit e412cd257e0d51e0ecbb89f50953835b5a0681b2
Author: Ingo Molnar <mingo at elte.hu>
Date:   Mon Aug 17 10:19:00 2009 +0200

    x86, mce: Don't initialize MCEs on unknown CPUs
    
    An older test-box started hanging at the following point during
    bootup:
    
     [    0.022996] Mount-cache hash table entries: 512
     [    0.024996] Initializing cgroup subsys debug
     [    0.025996] Initializing cgroup subsys cpuacct
     [    0.026995] Initializing cgroup subsys devices
     [    0.027995] Initializing cgroup subsys freezer
     [    0.028995] mce: CPU supports 5 MCE banks
    
    I've bisected it down to commit 4efc0670 ("x86, mce: use 64bit
    machine check code on 32bit"), which utilizes the MCE code on
    32-bit systems too.
    
    The problem is caused by this detail in my config:
    
      # CONFIG_CPU_SUP_INTEL is not set
    
    This disables the quirks in mce_cpu_quirks() but still enables
    MCE support - which then hangs due to the missing quirk
    workaround needed on this CPU:
    
    	if (c->x86 == 6 && c->x86_model < 0x1A && banks > 0)
    		mce_banks[0].init = 0;
    
    The safe solution is to not initialize MCEs if we dont know on
    what CPU we are running (or if that CPU's support code got
    disabled in the config).
    
    Also be a bit more defensive on 32-bit systems: dont do a
    boot-time dump of pending MCEs not just on the specific system
    that we found a problem with (Pentium-M), but earlier ones as
    well.
    
    Now this problem is probably not common and disabling CPU
    support is rare - but still being more defensive in something
    we turned on for a wide range of CPUs is prudent.
    
    Cc: Hidetoshi Seto <seto.hidetoshi at jp.fujitsu.com>
    LKML-Reference: Message-ID: <4A88E3E4.40506 at jp.fujitsu.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit de809347aeef0a68c04576c464414d0e4dce59fc
Author: Amerigo Wang <amwang at redhat.com>
Date:   Mon Aug 17 05:43:01 2009 -0400

    timers: Drop write permission on /proc/timer_list
    
    /proc/timer_list and /proc/slabinfo are not supposed to be
    written, so there should be no write permissions on it.
    
    Signed-off-by: WANG Cong <amwang at redhat.com>
    Cc: Pekka Enberg <penberg at cs.helsinki.fi>
    Cc: Vegard Nossum <vegard.nossum at gmail.com>
    Cc: Eduard - Gabriel Munteanu <eduard.munteanu at linux360.ro>
    Cc: linux-mm at kvack.org
    Cc: Christoph Lameter <cl at linux-foundation.org>
    Cc: David Rientjes <rientjes at google.com>
    Cc: Amerigo Wang <amwang at redhat.com>
    Cc: Matt Mackall <mpm at selenic.com>
    Cc: Arjan van de Ven <arjan at linux.intel.com>
    LKML-Reference: <20090817094525.6355.88682.sendpatchset at localhost.localdomain>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit e1ac3614ff606ae03677f47459113f98a19af63c
Author: Paul Mackerras <paulus at samba.org>
Date:   Fri Aug 14 15:39:10 2009 +1000

    perf_counter: Check task on counter read IPI
    
    In general, code in perf_counter.c that is called through an
    IPI checks, for per-task counters, that the counter's task is
    still the current task.  This is to handle the race condition
    where the cpu switches from the task we want to another task in
    the interval between sending the IPI and the IPI arriving and
    being handled on the target CPU.
    
    For some reason, __perf_counter_read is missing this check, yet
    there is no reason why the race condition can't occur.  This
    adds a check that the current task is the one we want.  If it
    isn't, we just return.  In that case the counter->count value
    should be up to date, since it will have been updated when the
    counter was scheduled out, which must have happened since the
    IPI was sent.
    
    I don't have an example of an actual failure due to this race,
    but it seems obvious that it could occur and we need to guard
    against it.
    
    Signed-off-by: Paul Mackerras <paulus at samba.org>
    Acked-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    LKML-Reference: <19076.63614.277861.368125 at drongo.ozlabs.ibm.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 2932cffc89e9a1476b28a59896fa4f81e0d4f131
Author: Carlos R. Mafra <crmafra at gmail.com>
Date:   Mon Aug 17 00:36:21 2009 +0200

    perf: Rename perf-examples.txt to examples.txt
    
    Rename it to examples.txt to avoid the perf-*.txt pattern in
    the Makefile, otherwise 'make doc' fails because
    perf-examples.txt is not formatted to be a man page:
    
     ERROR: perf-examples.txt: line 1: manpage document title is mandatory
    
    Signed-off-by: Carlos R. Mafra <crmafra at gmail.com>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Paul Mackerras <paulus at samba.org>
    LKML-Reference: <new-submission>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit c7f6fa44115d401e89db730f357629d39f8e4ba6
Author: Bartlomiej Zolnierkiewicz <bzolnier at gmail.com>
Date:   Tue Jul 28 23:52:54 2009 +0200

    x86, mce: don't log boot MCEs on Pentium M (model == 13) CPUs
    
    On my legacy Pentium M laptop (Acer Extensa 2900) I get bogus MCE on a cold
    boot with CONFIG_X86_NEW_MCE enabled, i.e. (after decoding it with mcelog):
    
    MCE 0
    HARDWARE ERROR. This is *NOT* a software problem!
    Please contact your hardware vendor
    CPU 0 BANK 1 MCG status:
    MCi status:
    Error overflow
    Uncorrected error
    Error enabled
    Processor context corrupt
    MCA: Data CACHE Level-1 UNKNOWN Error
    STATUS f200000000000195 MCGSTATUS 0
    
    [ The other STATUS values observed: f2000000000001b5 (... UNKNOWN error)
      and f200000000000115 (... READ Error).
    
      To verify that this is not a CONFIG_X86_NEW_MCE bug I also modified
      the CONFIG_X86_OLD_MCE code (which doesn't log any MCEs) to dump
      content of STATUS MSR before it is cleared during initialization. ]
    
    Since the bogus MCE results in a kernel taint (which in turn disables
    lockdep support) don't log boot MCEs on Pentium M (model == 13) CPUs
    by default ("mce=bootlog" boot parameter can be be used to get the old
    behavior).
    
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier at gmail.com>
    Reviewed-by: Andi Kleen <andi at firstfloor.org>
    Signed-off-by: H. Peter Anvin <hpa at zytor.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit bc990f5cb424cdca9dda866785d088e2c2110ecc
Author: Christoph Hellwig <hch at infradead.org>
Date:   Sun Aug 16 20:36:34 2009 -0400

    xfs: fix locking in xfs_iget_cache_hit
    
    The locking in xfs_iget_cache_hit currently has numerous problems:
    
     - we clear the reclaim tag without i_flags_lock which protects
       modifications to it
     - we call inode_init_always which can sleep with pag_ici_lock
       held (this is oss.sgi.com BZ #819)
     - we acquire and drop i_flags_lock a lot and thus provide no
       consistency between the various flags we set/clear under it
    
    This patch fixes all that with a major revamp of the locking in
    the function.  The new version acquires i_flags_lock early and
    only drops it once we need to call into inode_init_always or before
    calling xfs_ilock.
    
    This patch fixes a bug seen in the wild where we race modifying the
    reclaim tag.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Felix Blyakher <felixb at sgi.com>
    Reviewed-by: Eric Sandeen <sandeen at sandeen.net>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit 1d9959734a1949ea4f2427bd2d8b21ede6b2441c
Author: Eric Paris <eparis at redhat.com>
Date:   Fri Aug 7 14:53:57 2009 -0400

    security: define round_hint_to_min in !CONFIG_SECURITY
    
    Fix the header files to define round_hint_to_min() and to define
    mmap_min_addr_handler() in the !CONFIG_SECURITY case.
    
    Built and tested with !CONFIG_SECURITY
    
    Signed-off-by: Eric Paris <eparis at redhat.com>
    Signed-off-by: James Morris <jmorris at namei.org>

commit 788084aba2ab7348257597496befcbccabdc98a3
Author: Eric Paris <eparis at redhat.com>
Date:   Fri Jul 31 12:54:11 2009 -0400

    Security/SELinux: seperate lsm specific mmap_min_addr
    
    Currently SELinux enforcement of controls on the ability to map low memory
    is determined by the mmap_min_addr tunable.  This patch causes SELinux to
    ignore the tunable and instead use a seperate Kconfig option specific to how
    much space the LSM should protect.
    
    The tunable will now only control the need for CAP_SYS_RAWIO and SELinux
    permissions will always protect the amount of low memory designated by
    CONFIG_LSM_MMAP_MIN_ADDR.
    
    This allows users who need to disable the mmap_min_addr controls (usual reason
    being they run WINE as a non-root user) to do so and still have SELinux
    controls preventing confined domains (like a web server) from being able to
    map some area of low memory.
    
    Signed-off-by: Eric Paris <eparis at redhat.com>
    Signed-off-by: James Morris <jmorris at namei.org>

commit 8cf948e744e0218af604c32edecde10006dc8e9e
Author: Eric Paris <eparis at redhat.com>
Date:   Fri Jul 31 12:54:05 2009 -0400

    SELinux: call cap_file_mmap in selinux_file_mmap
    
    Currently SELinux does not check CAP_SYS_RAWIO in the file_mmap hook.  This
    means there is no DAC check on the ability to mmap low addresses in the
    memory space.  This function adds the DAC check for CAP_SYS_RAWIO while
    maintaining the selinux check on mmap_zero.  This means that processes
    which need to mmap low memory will need CAP_SYS_RAWIO and mmap_zero but will
    NOT need the SELinux sys_rawio capability.
    
    Signed-off-by: Eric Paris <eparis at redhat.com>
    Signed-off-by: James Morris <jmorris at namei.org>

commit 9c0d90103c7e0eb6e638e5b649e9f6d8d9c1b4b3
Author: Eric Paris <eparis at redhat.com>
Date:   Fri Jul 31 12:53:58 2009 -0400

    Capabilities: move cap_file_mmap to commoncap.c
    
    Currently we duplicate the mmap_min_addr test in cap_file_mmap and in
    security_file_mmap if !CONFIG_SECURITY.  This patch moves cap_file_mmap
    into commoncap.c and then calls that function directly from
    security_file_mmap ifndef CONFIG_SECURITY like all of the other capability
    checks are done.
    
    Signed-off-by: Eric Paris <eparis at redhat.com>
    Acked-by: Serge Hallyn <serue at us.ibm.com>
    Signed-off-by: James Morris <jmorris at namei.org>

commit cefb87efc9aa0288849149484870d5ab989fbd59
Author: Dave Airlie <airlied at redhat.com>
Date:   Sun Aug 16 21:05:45 2009 +1000

    drm/radeon/kms: implement bo busy check + current domain
    
    This implements the busy ioctl along with a current domain check.
    returns 0 or -EBUSY
    puts the current domain no matter what the answer.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 52459ab91363343af8ae252766e9da762344a2e7
Author: Leonardo Potenza <lpotenza at inwind.it>
Date:   Sun Aug 16 18:55:48 2009 +0200

    x86: Annotate section mismatch warnings in kernel/apic/x2apic_uv_x.c
    
    The function uv_acpi_madt_oem_check() has been marked __init,
    the struct apic_x2apic_uv_x has been marked __refdata.
    
    The aim is to address the following section mismatch messages:
    
    WARNING: arch/x86/kernel/apic/built-in.o(.data+0x1368): Section mismatch in reference from the variable apic_x2apic_uv_x to the function .cpuinit.text:uv_wakeup_secondary()
    The variable apic_x2apic_uv_x references
    the function __cpuinit uv_wakeup_secondary()
    If the reference is valid then annotate the
    variable with __init* or __refdata (see linux/init.h) or name the variable:
    *driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console,
    
    WARNING: arch/x86/kernel/built-in.o(.data+0x68e8): Section mismatch in reference from the variable apic_x2apic_uv_x to the function .cpuinit.text:uv_wakeup_secondary()
    The variable apic_x2apic_uv_x references
    the function __cpuinit uv_wakeup_secondary()
    If the reference is valid then annotate the
    variable with __init* or __refdata (see linux/init.h) or name the variable:
    *driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console,
    
    WARNING: arch/x86/built-in.o(.text+0x7b36f): Section mismatch in reference from the function uv_acpi_madt_oem_check() to the function .init.text:early_ioremap()
    The function uv_acpi_madt_oem_check() references
    the function __init early_ioremap().
    This is often because uv_acpi_madt_oem_check lacks a __init
    annotation or the annotation of early_ioremap is wrong.
    
    WARNING: arch/x86/built-in.o(.text+0x7b38d): Section mismatch in reference from the function uv_acpi_madt_oem_check() to the function .init.text:early_iounmap()
    The function uv_acpi_madt_oem_check() references
    the function __init early_iounmap().
    This is often because uv_acpi_madt_oem_check lacks a __init
    annotation or the annotation of early_iounmap is wrong.
    
    WARNING: arch/x86/built-in.o(.data+0x8668): Section mismatch in reference from the variable apic_x2apic_uv_x to the function .cpuinit.text:uv_wakeup_secondary()
    The variable apic_x2apic_uv_x references
    the function __cpuinit uv_wakeup_secondary()
    If the reference is valid then annotate the
    variable with __init* or __refdata (see linux/init.h) or name the variable:
    *driver, *_template, *_timer, *_sht, *_ops, *_probe, *_probe_one, *_console,
    
    Signed-off-by: Leonardo Potenza <lpotenza at inwind.it>
    LKML-Reference: <200908161855.48302.lpotenza at inwind.it>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 894ef820b10d77e2d6d717342fc408bdd9825139
Author: Randy Dunlap <randy.dunlap at oracle.com>
Date:   Sun Aug 16 07:33:30 2009 -0700

    dm-log-userspace: fix printk format warning
    
    drivers/md/dm-log-userspace-transfer.c:110: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'size_t'
    
    Previously posted and acked, but apparently lost.
    http://lkml.indiana.edu/hypermail/linux/kernel/0906.2/02074.html
    
    Signed-off-by: Randy Dunlap <randy.dunlap at oracle.com>
    Cc: dm-devel at redhat.com
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 4e5c25d405e18a2f279ca2bfc855508ec3a0186b
Author: Hugh Dickins <hugh.dickins at tiscali.co.uk>
Date:   Sun Aug 16 15:54:37 2009 +0100

    x86, mce: therm_throt: Don't log redundant normality
    
    0d01f31439c1e4d602bf9fdc924ab66f407f5e38 "x86, mce: therm_throt
    - change when we print messages" removed redundant
    announcements of "Temperature/speed normal".
    
    They're not worth logging and remove their accompanying
    "Machine check events logged" messages as well from the
    console.
    
    Signed-off-by: Hugh Dickins <hugh.dickins at tiscali.co.uk>
    Cc: Hidetoshi Seto <seto.hidetoshi at jp.fujitsu.com>
    Cc: Andi Kleen <andi at firstfloor.org>
    Cc: Dmitry Torokhov <dtor at mail.ru>
    LKML-Reference: <Pine.LNX.4.64.0908161544100.7929 at sister.anvils>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 68eac4602b9104cdaa6c18b3edd914cececa6a1e
Author: Xiaotian Feng <dfeng at redhat.com>
Date:   Fri Aug 14 14:35:52 2009 +0000

    e1000e: fix use of pci_enable_pcie_error_reporting
    
    commit 111b9dc5 ("e1000e: add aer support") introduces pcie aer
    support for e1000e, but it is not reasonable to disable it in
    e1000_remove but enable it in e1000_resume.  This patch enables aer
    support in e1000_probe.
    
    Signed-off-by: Xiaotian Feng <dfeng at redhat.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher at intel.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 82776a4bcd7aa5fbcd2e6339b3ce88b727dd40ab
Author: Bruce Allan <bruce.w.allan at intel.com>
Date:   Fri Aug 14 14:35:33 2009 +0000

    e1000e: WoL does not work on 82577/82578 with manageability enabled
    
    With manageability (Intel AMT) enabled via BIOS, PHY wakeup does not get
    configured on newer parts which use PHY wakeup vs. MAC wakeup which causes
    WoL to not work.  The driver should configure PHY wakeup whether or not
    manageability is enabled.
    
    Signed-off-by: Bruce Allan <bruce.w.allan at intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher at intel.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 7fc1ece40704b150477e548a7a98d285cc418790
Author: Michael Chan <mchan at broadcom.com>
Date:   Fri Aug 14 15:49:47 2009 +0000

    cnic: Fix locking in init/exit calls.
    
    The slow path ulp_init and ulp_exit calls to the bnx2i driver
    are sleepable calls and therefore should not be protected using
    rcu_read_lock.  Fix it by using mutex and refcount during these
    calls.  cnic_unregister_driver() will now wait for the refcount
    to go to zero before completing the call.
    
    Signed-off-by: Michael Chan <mchan at broadcom.com>
    Reviewed-by: Benjamin Li <benli at broadcom.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 681dbd710779e8b8d5bae926f6b11f30df70638b
Author: Michael Chan <mchan at broadcom.com>
Date:   Fri Aug 14 15:49:46 2009 +0000

    cnic: Fix locking in start/stop calls.
    
    The slow path ulp_start and ulp_stop calls to the bnx2i driver
    are sleepable calls and therefore should not be protected using
    rcu_read_lock.  Fix it by using mutex and setting a bit during
    these calls.  cnic_unregister_device() will now wait for the bit
    to clear before completing the call.
    
    Signed-off-by: Michael Chan <mchan at broadcom.com>
    Reviewed-by: Benjamin Li <benli at broadcom.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit c5a889508203446c1abc1d670599b3a816841813
Author: Michael Chan <mchan at broadcom.com>
Date:   Fri Aug 14 15:49:45 2009 +0000

    bnx2: Use mutex on slow path cnic calls.
    
    The slow path calls to the cnic driver are sleepable calls so we
    cannot use rcu_read_lock().  Use mutex for these slow path calls
    instead.
    
    Signed-off-by: Michael Chan <mchan at broadcom.com>
    Reviewed-by: Benjamin Li <benli at broadcom.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit a3059b12adae868c42629ecf058a94195ef1e958
Author: Michael Chan <mchan at broadcom.com>
Date:   Fri Aug 14 15:49:44 2009 +0000

    cnic: Refine registration with bnx2.
    
    Register and unregister with bnx2 during NETDEV_UP and NETDEV_DOWN
    events.  This simplifies the sequence of events and allows locking
    fixes in the next patch.
    
    Signed-off-by: Michael Chan <mchan at broadcom.com>
    Reviewed-by: Benjamin Li <benli at broadcom.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 64c6460875957502541a4ba30835ac625a0bee79
Author: Michael Chan <mchan at broadcom.com>
Date:   Fri Aug 14 15:49:43 2009 +0000

    cnic: Fix symbol_put_addr() panic on ia64.
    
    When the cnic driver tries to grab a symbol from bnx2 when bnx2 is
    running init code, symbol_get() will succeed but symbol_put_addr()
    will hit BUG() a moment later.  module_text_address() fails because
    bnx2 is still in init code.
    
    This is fixed by using symbol_put() instead which does the exact
    opposite of symbol_get().
    
    Signed-off-by: Michael Chan <mchan at broadcom.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit b2add73dbf93fd50f00564d7abc3e2b9aa9dd20c
Author: Guillaume Knispel <gknispel at proformatique.com>
Date:   Sat Aug 15 19:30:24 2009 +0200

    poll/select: initialize triggered field of struct poll_wqueues
    
    The triggered field of struct poll_wqueues introduced in commit
    5f820f648c92a5ecc771a96b3c29aa6e90013bba ("poll: allow f_op->poll to
    sleep").
    
    It was first set to 1 in pollwake() (now __pollwake() ), tested and
    later set to 0 in poll_schedule_timeout(), but not initialized before.
    
    As a result when the process needs to sleep, triggered was likely to be
    non-zero even if pollwake() is not called before the first
    poll_schedule_timeout(), meaning schedule_hrtimeout_range() would not be
    called and an extra loop calling all ->poll() would be done.
    
    This patch initialize triggered to 0 in poll_initwait() so the ->poll()
    are not called twice before the process goes to sleep when it needs to.
    
    Signed-off-by: Guillaume Knispel <gknispel at proformatique.com>
    Acked-by: Thomas Gleixner <tglx at linutronix.de>
    Acked-by: Tejun Heo <tj at kernel.org>
    Cc: stable at kernel.org
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit de1b28989edff519d0548ebaa3f94fd3d1524cf2
Author: Dave Airlie <airlied at redhat.com>
Date:   Wed Aug 12 18:43:14 2009 +1000

    drm/radeon/kms: cut down indirects in register accesses.
    
    We really don't want to be doing all these indirects, updating
    the GPU gart table is something we do often so the less overhead the
    better.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 7ed220d738cf16adff6bc3b31ad25b8848a2fa9c
Author: Michel Dänzer <daenzer at vmware.com>
Date:   Thu Aug 13 11:10:51 2009 +0200

    drm/radeon/kms: Fix up vertical blank interrupt support.
    
    Fixes 3D apps timing out in the WAIT_VBLANK ioctl.
    
    AVIVO bits compile-tested only.
    
    Signed-off-by: Michel Dänzer <daenzer at vmware.com>
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 3f8befec95d5c1bbc6e247e1a5dafa82519530f9
Author: Dave Airlie <airlied at redhat.com>
Date:   Sat Aug 15 20:54:13 2009 +1000

    drm/radeon/kms: add rv530 R300_SU_REG_DEST + reloc for ZPASS_ADDR
    
    These are needed for Occulsion Query support.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit a2bb9f4d6a5a589b481595207ac3588cc08d1b60
Author: Linus Walleij <linus.walleij at stericsson.com>
Date:   Thu Aug 13 21:57:22 2009 +0100

    ARM: 5673/1: U300 fix initsection compile warning
    
    The u300_init_check_chip() function was not properly tagged with
    the __init macro and provided a initsection mismatch on
    compilation.
    
    Signed-off-by: Linus Walleij <linus.walleij at stericsson.com>
    Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>

commit c5e7f5a38a7ebf3697281bc7cb494e676f287ac0
Author: Florian Fainelli <florian at openwrt.org>
Date:   Wed Jun 3 13:05:48 2009 +0200

    [WATCHDOG] ar7_wdt: fix path to ar7-specific headers
    
    AR7 is currently being resubmitted for mainline inclusion
    and we changed the path to the ar7-specific headers
    from ar7 to mach-ar7 to reflect the other MIPS-based
    boards header hierarchy. This patch will avoid any future
    compilation failure due to missing headers.
    
    Signed-off-by: Florian Fainelli <florian at openwrt.org>
    Signed-off-by: Wim Van Sebroeck <wim at iguana.be>

commit 824df399a31fe92d88eb8caf86768cc8c7c72a06
Merge: 8b6120789598d55f6aa2b4e9ac7e70a205d857da 48ec45e725aa385d72bced73b267dfaf13351876
Author: Russell King <rmk at dyn-67.arm.linux.org.uk>
Date:   Sat Aug 15 12:43:13 2009 +0100

    Merge branch 's3c-fixes' of git://aeryn.fluff.org.uk/bjdooks/linux

commit 8b6120789598d55f6aa2b4e9ac7e70a205d857da
Merge: dde5828f56cb2c1aa70365c476e6830482127258 563abb4be1a79e7b64784d43beb9d0cacb1bad6f
Author: Russell King <rmk at dyn-67.arm.linux.org.uk>
Date:   Sat Aug 15 12:42:46 2009 +0100

    Merge branch 'for-rmk-rc' of git://git.pengutronix.de/git/imx/linux-2.6

commit dde5828f56cb2c1aa70365c476e6830482127258
Author: Russell King <rmk at dyn-67.arm.linux.org.uk>
Date:   Sat Aug 15 12:36:00 2009 +0100

    ARM: Fix broken highmem support
    
    Currently, highmem is selectable, and you can request an increased
    vmalloc area.  However, none of this has any effect on the memory
    layout since a patch in the highmem series was accidentally dropped.
    Moreover, even if you did want highmem, all memory would still be
    registered as lowmem, possibly resulting in overflow of the available
    virtual mapping space.
    
    The highmem boundary is determined by the highest allowed beginning
    of the vmalloc area, which depends on its configurable minimum size
    (see commit 60296c71f6c5063e3c1f1d2619ca0b60940162e7 for details on
    this).
    
    We should create mappings and initialize bootmem only for low memory,
    while the zone allocator must still be told about highmem.
    
    Currently, memory nodes which are completely located in high memory
    are not supported.  This is not a huge limitation since systems
    relying on highmem support are unlikely to have discontiguous memory
    with large holes.
    
    [ A similar patch was meant to be merged before commit 5f0fbf9ecaf3
      and be available  in Linux v2.6.30, however some git rebase screw-up
      of mine dropped the first commit of the series, and that goofage
      escaped testing somehow as well. -- Nico ]
    
    Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>
    Reviewed-by: Nicolas Pitre <nico at marvell.com>

commit 39e6dd73502f64e2ae3236b304e160ae30de9384
Author: Arnaldo Carvalho de Melo <acme at redhat.com>
Date:   Fri Aug 14 15:26:32 2009 -0300

    perf record: Fix typo in pid_synthesize_comm_event
    
    We were using 'fd' locally, but there was a global 'fd' too, so
    when converting from open to fopen the test made against fd
    should be made against 'fp', but since we have that global
    it didnt get discovered ...
    
    Reported-by: Ulrich Drepper <drepper at redhat.com>
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    LKML-Reference: <20090814182632.GF3490 at ghostprotocols.net>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 3ef12c3c97603bad405d30c989718cc9405e2759
Author: Cliff Wickman <cpw at sgi.com>
Date:   Fri Aug 14 13:56:37 2009 -0500

    x86: Fix UV BAU destination subnode id
    
    The SGI UV Broadcast Assist Unit is used to send TLB shootdown
    messages to remote nodes of the system.  The header of the
    message must contain the subnode id of the block in the
    receiving hub that handles such messages.  It should always be
    0x10, the id of the "LB" block.
    
    It had previously been documented as a "must be zero" field.
    
    Signed-off-by: Cliff Wickman <cpw at sgi.com>
    Acked-by: Jack Steiner <steiner at sgi.com>
    LKML-Reference: <E1Mc1x7-0005Ce-6t at eag09.americas.sgi.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 237674e050ae8ea40a432412df6c15d60b7ae8a6
Author: Magnus Damm <damm at igel.co.jp>
Date:   Sat Aug 15 02:53:42 2009 +0000

    sh: sh7724 ddr self-refresh changes
    
    This patch updates the SuperH Mobile sleep assembly code with
    support for DBSC memory controller found in the sh7724 processor.
    
    Without this fix the memory hooked up to the sh7724 processor
    will never enter self-refresh mode before suspending to ram. The
    effect of this is that the memory contents most likeley will be
    lost upon resume which may or may not be what you want.
    
    Signed-off-by: Magnus Damm <damm at igel.co.jp>
    Signed-off-by: Paul Mundt <lethal at linux-sh.org>

commit 9747e78b304b44d6fb73e2c8071406d55aa8bb75
Author: Magnus Damm <damm at igel.co.jp>
Date:   Sat Aug 15 02:53:34 2009 +0000

    sh: use in-soc KEYSC on se7724
    
    This patch updates the Solution Engine 7724 board code to use
    in-SoC KEYSC resources for the keyboard platform device. Using
    the in-SoC key scan controller fixes a crash-during-resume issue.
    
    Without this patch the KEYSC hardware block located in the board
    specific FPGA is used together with an external IRQ which is
    routed through the FPGA and handled by some board specific demux
    code. This board specific FPGA interrupt code does not implement
    desc->set_wake() so the enable_irq_wake() call in the sh_keysc
    driver will fail at suspend-to-ram time and the disable_irq_wake()
    will bomb out when resuming.
    
    Changing the platform data to use the in-SoC KEYSC hardware makes
    the se7724 board support code less special which is a good thing.
    Also, the board specific KEYSC pin setup code selects in-SoC pin
    functions already which makes the current FPGA platform device data
    look like a typo.
    
    Signed-off-by: Magnus Damm <damm at igel.co.jp>
    Signed-off-by: Paul Mundt <lethal at linux-sh.org>

commit f6431732f128a241b149c0aa85dfec852455ebf9
Author: Magnus Damm <damm at igel.co.jp>
Date:   Sat Aug 15 02:53:25 2009 +0000

    sh: CMT suspend/resume
    
    This patch updates the SuperH CMT driver with suspend and resume
    callbacks for the suspend-to-ram case. This patch stops the CMT
    channel at suspend time to avoid unwanted wake up events.
    
    Signed-off-by: Magnus Damm <damm at igel.co.jp>
    Signed-off-by: Paul Mundt <lethal at linux-sh.org>

commit 21bc1f024d0d4ea43fc0f2a43504e759261c7b18
Author: Magnus Damm <damm at igel.co.jp>
Date:   Sat Aug 15 02:53:16 2009 +0000

    sh: skip disabled LCDC channels
    
    This patch updates the SuperH Mobile LCDC driver to skip
    over disabled channels. Without this patch suspend-to-ram
    operation will crash if deferred io is enabled.
    
    Signed-off-by: Magnus Damm <damm at igel.co.jp>
    Signed-off-by: Paul Mundt <lethal at linux-sh.org>

commit ebb177d2afb8532a8a316489aed545ed0c170802
Author: Dave Airlie <airlied at redhat.com>
Date:   Sat Aug 15 12:25:08 2009 +1000

    drm/edid: fixup detailed timings like the X server.
    
    this syncs the versioning check with the code the X server uses.
    
    Reported-by: Anssi Hannula <anssi.hannula at iki.fi>
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 616b8434688aa08bd6f019cc60c8dfe121e9e5ae
Author: Jerome Glisse <jglisse at redhat.com>
Date:   Thu Aug 6 17:47:24 2009 +0200

    drm/radeon/kms: Add specific rs690 authorized register table
    
    rs690 is r3xx 3D engine with AVIVO modesetting so we need to allow
    AVIVO register for vline synchronization. This add a specific table
    to rs690 to handle that. Thanks to Marc (marvin24) for debugging
    this and kudos to Andre (taiu1) for spotting the origin of the bugs.
    
    Signed-off-by: Jerome Glisse <jglisse at redhat.com>
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 8cdb045632e5ee22854538619ac6f150eb0a4894
Author: Tom Goff <thomas.goff at boeing.com>
Date:   Fri Aug 14 16:33:56 2009 -0700

    gre: Fix MTU calculation for bound GRE tunnels
    
    The GRE header length should be subtracted when the tunnel MTU is
    calculated.  This just corrects for the associativity change
    introduced by commit 42aa916265d740d66ac1f17290366e9494c884c2
    ("gre: Move MTU setting out of ipgre_tunnel_bind_dev").
    
    Signed-off-by: Tom Goff <thomas.goff at boeing.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 7c1d15d736687057f4dc6e51fbf44b6f6e4320cb
Author: Petko Manolov <petkan at nucleusys.com>
Date:   Fri Aug 14 06:40:48 2009 +0000

    pegasus: Add new device ID.
    
    Add new definition to 'pegasus.h' for support Japanese IO DATA
    "ETX-US2" USB Ethernet Adapter.
    
    PEGASUS_DEV( “IO DATA USB ETX-US2”, VENDOR_IODATA, 0x092a,
    DEFAULT_GPIO_RESET | PEGASUS_II )
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 22580f894ac190c46beebb5c3172e450a2318f79
Author: Dongdong Deng <dongdong.deng at windriver.com>
Date:   Thu Aug 13 19:12:31 2009 +0000

    drivers/net: fixed drivers that support netpoll use ndo_start_xmit()
    
    The NETPOLL API requires that interrupts remain disabled in
    netpoll_send_skb(). The use of spin_lock_irq() and spin_unlock_irq()
    in the NETPOLL API callbacks causes the interrupts to get enabled and
    can lead to kernel instability.
    
    The solution is to use spin_lock_irqsave() and spin_unlock_restore()
    to prevent the irqs from getting enabled while in netpoll_send_skb().
    
    Call trace:
    netpoll_send_skb()
    {
       -> local_irq_save(flags)
         ---> dev->ndo_start_xmit(skb, dev)
             ---> spin_lock_irq()
             ---> spin_unlock_irq() *******here would enable the interrupt.
                  ...
       -> local_irq_restore(flags)
    }
    
    Signed-off-by: Dongdong Deng <dongdong.deng at windriver.com>
    Signed-off-by: Jason Wessel <jason.wessel at windriver.com>
    Acked-by: Bruce Ashfield <bruce.ashfield at windriver.com>
    Acked-by: Matt Mackall <mpm at selenic.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 0527a1a8440a20b3d0fd1d0c9e75a6f38a9d5315
Author: roel kluin <roel.kluin at gmail.com>
Date:   Fri Aug 14 02:09:56 2009 +0000

    via-velocity: Fix test of mii_status bit VELOCITY_DUPLEX_FULL
    
    Test whether VELOCITY_DUPLEX_FULL bit is set in mii_status.
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit c9a2bfd1f08973115c2fc3da9372e0e81ac42a19
Author: Wolfram Sang <w.sang at pengutronix.de>
Date:   Fri Aug 14 13:09:32 2009 -0700

    pcmcia: add CNF-CDROM-ID for ide
    
    Fixes this report:
    http://article.gmane.org/gmane.linux.kernel.pcmcia.devel/2228/
    
    Reported-by: John McGrath <john at john-mcgrath.com>
    Signed-off-by: Wolfram Sang <w.sang at pengutronix.de>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 88512935a24305fea7aecc9ba4d675869e97fc2a
Merge: 8a62babfb87aa5911e87e0ce38381bdfdc4a2b83 6b26dead3ce97d016b57724b01974d5ca5c84bd5
Author: David S. Miller <davem at davemloft.net>
Date:   Fri Aug 14 12:27:19 2009 -0700

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

commit 5d12dc1fd6b0ba31d3166e42ed01996df6dad34e
Merge: 3011c7f0d421ed85c75683addf3b31eaa1ab6cec d7e623da1a757fbd8c117fa29190ca8bef14dab3
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 14 09:34:25 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-2.6-fixes:
      GFS2: Fix permissions on "recover" file

commit 3011c7f0d421ed85c75683addf3b31eaa1ab6cec
Merge: 64f1607ffbbc772685733ea63e6f7f4183df1b16 08b39642b1e375afd014c50f6013ec4a292ca3b2
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 14 08:25:19 2009 -0700

    Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6
    
    * 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (38 commits)
      V4L/DVB (12441): siano: read buffer overflow
      V4L/DVB (12440): Use kzalloc for frontend states to have struct dvb_frontend properly
      V4L/DVB (12438): Read buffer overflow
      V4L/DVB (12437): dvb: siano uses/depends on INPUT
      V4L/DVB (12436): stk-webcam: read buffer overflow
      V4L/DVB (12432): em28xx: fix regression in Empire DualTV digital tuning
      V4L/DVB (12429): v4l2-ioctl: fix G_STD and G_PARM default handlers
      V4L/DVB (12428): hdpvr: add missing initialization of current_norm
      V4L/DVB (12424): soc-camera: fix recursive locking in .buf_queue()
      V4L/DVB (12422): media/zr364xx: fix build errors
      V4L/DVB (12405): em28xx-cards: move register 0x13 setting to the proper place
      V4L/DVB (12411): em28xx: Fix artifacts with Silvercrest webcam
      V4L/DVB (12410): em28xx: Move the non-board dependent part to be outside em28xx_pre_card_setup()
      V4L/DVB (12407): em28xx: Adjust Silvercrest xtal frequency
      V4L/DVB (12406): em28xx: fix: don't do image interlacing on webcams
      V4L/DVB (12403): em28xx: properly reports some em2710 chips
      V4L/DVB (12402): em28xx: fix: some em2710 chips use a different vendor ID
      V4L/DVB (12401): m9v011: add vflip/hflip controls to control mirror/upside down
      V4L/DVB (12400): em28xx: Allow changing fps on webcams
      V4L/DVB (12399): mt9v011: Add support for controlling frame rates
      ...

commit 388ce4beb7135722c584b0af18f215e3ec657adf
Author: Kashyap, Desai <kashyap.desai at lsi.com>
Date:   Fri Aug 14 15:01:35 2009 +0530

    [SCSI] mpt2sas: fix config request and diag reset deadlock
    
    Moving the setting and clearing of the mutex's to
    _config_request. There was a mutex deadlock when diag reset is called from
    inside _config_request, so diag reset was moved to outside the mutexs.
    
    Signed-off-by: James Bottomley <James.Bottomley at suse.de>

commit 6b26dead3ce97d016b57724b01974d5ca5c84bd5
Author: Pavel Roskin <proski at gnu.org>
Date:   Tue Aug 4 17:48:16 2009 -0400

    rt2x00: fix memory corruption in rf cache, add a sanity check
    
    Change rt2x00_rf_read() and rt2x00_rf_write() to subtract 1 from the rf
    register number.  This is needed because the rf registers are enumerated
    starting with one.  The size of the rf register cache is just enough to
    hold all registers, so writing to the highest register was corrupting
    memory.  Add a check to make sure that the rf register number is valid.
    
    Signed-off-by: Pavel Roskin <proski at gnu.org>
    Cc: stable at kernel.org
    Acked-by: Ivo van Doorn <IvDoorn at gmail.com>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit d7e623da1a757fbd8c117fa29190ca8bef14dab3
Author: Steven Whitehouse <swhiteho at redhat.com>
Date:   Tue Aug 11 11:20:11 2009 +0100

    GFS2: Fix permissions on "recover" file
    
    Although this file is only ever written and not read by
    userspace, it seems that the utils are opening this
    file O_RDWR, so we need to allow that.
    
    Also fixes the whitespace which seemed to be broken.
    
    Signed-off-by: Steven Whitehouse <swhiteho at redhat.com>
    Cc: David Teigland <teigland at redhat.com>

commit 563abb4be1a79e7b64784d43beb9d0cacb1bad6f
Author: Valentin Longchamp <valentin.longchamp at epfl.ch>
Date:   Tue Aug 11 17:29:21 2009 +0200

    mx31moboard: invert sdhc ro signal sense
    
    Small confusion with our hardware engineer, the WP signal (RO) is
    active low on our boards, the signal has to inverted.
    
    This is a pretty straightforward patch, it could even go to -rc,
    but if not, then push it for 2.6.32.
    
    Signed-off-by: Valentin Longchamp <valentin.longchamp at epfl.ch>
    Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>

commit 142d44b0dd6741a64a7bdbe029110e7c1dcf1d23
Author: Amerigo Wang <amwang at redhat.com>
Date:   Thu Aug 13 02:00:13 2009 -0400

    percpu: use the right flag for get_vm_area()
    
    get_vm_area() only accepts VM_* flags, not GFP_*.
    
    And according to the doc of get_vm_area(), here should be
    VM_ALLOC.
    
    Signed-off-by: WANG Cong <amwang at redhat.com>
    Acked-by: Tejun Heo <tj at kernel.org>
    Cc: Ingo Molnar <mingo at elte.hu>

commit 74d46d6b2d23d44d72c37df4c6a5d2e782f7b088
Author: Tejun Heo <tj at kernel.org>
Date:   Tue Jul 21 17:11:50 2009 +0900

    percpu, sparc64: fix sparse possible cpu map handling
    
    percpu code has been assuming num_possible_cpus() == nr_cpu_ids which
    is incorrect if cpu_possible_map contains holes.  This causes percpu
    code to access beyond allocated memories and vmalloc areas.  On a
    sparc64 machine with cpus 0 and 2 (u60), this triggers the following
    warning or fails boot.
    
     WARNING: at /devel/tj/os/work/mm/vmalloc.c:106 vmap_page_range_noflush+0x1f0/0x240()
     Modules linked in:
     Call Trace:
      [00000000004b17d0] vmap_page_range_noflush+0x1f0/0x240
      [00000000004b1840] map_vm_area+0x20/0x60
      [00000000004b1950] __vmalloc_area_node+0xd0/0x160
      [0000000000593434] deflate_init+0x14/0xe0
      [0000000000583b94] __crypto_alloc_tfm+0xd4/0x1e0
      [00000000005844f0] crypto_alloc_base+0x50/0xa0
      [000000000058b898] alg_test_comp+0x18/0x80
      [000000000058dad4] alg_test+0x54/0x180
      [000000000058af00] cryptomgr_test+0x40/0x60
      [0000000000473098] kthread+0x58/0x80
      [000000000042b590] kernel_thread+0x30/0x60
      [0000000000472fd0] kthreadd+0xf0/0x160
     ---[ end trace 429b268a213317ba ]---
    
    This patch fixes generic percpu functions and sparc64
    setup_per_cpu_areas() so that they handle sparse cpu_possible_map
    properly.
    
    Please note that on x86, cpu_possible_map() doesn't contain holes and
    thus num_possible_cpus() == nr_cpu_ids and this patch doesn't cause
    any behavior difference.
    
    Signed-off-by: Tejun Heo <tj at kernel.org>
    Acked-by: David S. Miller <davem at davemloft.net>
    Cc: Ingo Molnar <mingo at elte.hu>

commit d6647bdf98a0de19963de8d5d9698d469ed72097
Author: Tejun Heo <tj at kernel.org>
Date:   Tue Jul 21 17:11:50 2009 +0900

    init: set nr_cpu_ids before setup_per_cpu_areas()
    
    nr_cpu_ids is dependent only on cpu_possible_map and
    setup_per_cpu_areas() already depends on cpu_possible_map and will use
    nr_cpu_ids.  Initialize nr_cpu_ids before setting up percpu areas.
    
    Signed-off-by: Tejun Heo <tj at kernel.org>

commit 8a62babfb87aa5911e87e0ce38381bdfdc4a2b83
Author: Lucy Liu <lucy.liu at intel.com>
Date:   Thu Aug 13 14:09:38 2009 +0000

    ixgbe: Fix receive on real device when VLANs are configured
    
    Traffic received with a priority tag (VID = 0) and non-zero priority value was
    incorrectly handled by the VLAN packet code path due to a check on zero for
    the whole VLAN tag instead of just the VID.
    
    This patch masked out the priority field when checking the vlan tag for
    received VLAN packets.
    
    Signed-off-by: Lucy Liu <lucy.liu at intel.com>
    Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr at intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher at intel.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 17e78b0655da20f2fc2bbde3b8252dac07c82914
Author: Yi Zou <yi.zou at intel.com>
Date:   Thu Aug 13 14:09:58 2009 +0000

    ixgbe: Do not return 0 in ixgbe_fcoe_ddp() upon FCP_RSP in DDP completion
    
    We return the ddp->len in ixgbe_fcoe_ddp() to indicate the length of data that
    have been DDPed. However, it is possible that the length is 0, e.g., for SCSI
    READ, the FCP_RSP may come back w/ SCSI status 0x28 as Task Set Full with no FCP
    data for DDP. In ixgbe_fcoe_ddp(), we return 0 to indicate not passing DDPed
    packets to upper layer. Therefore in the case of ddp->len being 0 upon FCP_RSP,
    we do not want to return the 0 ddp->len as we want FCP_RSP to be always
    delivered to the upper layer. This patch fixes this bug by setting rc only if
    ddp->len is non-zero.
    
    Signed-off-by: Yi Zou <yi.zou at intel.com>
    Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr at intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher at intel.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 48ec45e725aa385d72bced73b267dfaf13351876
Author: Davide Rizzo <elpa.rizzo at gmail.com>
Date:   Thu Aug 13 11:53:53 2009 +0200

    ARM: S3C24XX: Fix clkout mpx error
    
    Bug correction: CLK Outputs cannot have XTAL as parent
    
    Signed-off-by: Davide Rizzo <elpa.rizzo at gmail.com>
    [ben-linux at fluff.org: updated patch subject]
    Signed-off-by: Ben Dooks <ben-linux at fluff.org>

commit a219dc4d4463809b1be473038e7d9f3437ca452d
Author: Ramax Lo <ramaxlo at gmail.com>
Date:   Wed Aug 12 23:55:56 2009 +0800

    ARM: S3C64XX: serial: Fix a typo in Kconfig
    
    The typo causes drivers/serial/s3c6400.c not being built for s3c6400 platform.
    
    Signed-off-by: Ramax Lo <ramaxlo at gmail.com>
    Signed-off-by: Ben Dooks <ben-linux at fluff.org>

commit 08b39642b1e375afd014c50f6013ec4a292ca3b2
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Mon Aug 10 22:59:33 2009 -0300

    V4L/DVB (12441): siano: read buffer overflow
    
    With mode DEVICE_MODE_RAW_TUNER a read occurs past the end of smscore_fw_lkup[].
    Subsequently an attempt is made to load the firmware from the resulting
    filename.
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 084e24acc906c162c92de7df807190856ae60928
Author: Matthias Schwarzott <zzam at gentoo.org>
Date:   Mon Aug 10 22:51:01 2009 -0300

    V4L/DVB (12440): Use kzalloc for frontend states to have struct dvb_frontend properly
    
    This patch changes most frontend drivers to allocate their state structure via
    kzalloc and not kmalloc. This is done to properly initialize the
    embedded "struct dvb_frontend frontend" field, that they all have.
    
    The visible effect of this struct being uninitalized is, that the member "id"
    that is used to set the name of kernel thread is totally random.
    
    Some board drivers (for example cx88-dvb) set this "id" via
    videobuf_dvb_alloc_frontend but most do not.
    
    So I at least get random id values for saa7134, flexcop and ttpci based cards.
    It looks like this in dmesg:
    DVB: registering adapter 1 frontend -10551321 (ST STV0299 DVB-S)
    
    The related kernel thread then also gets a strange name
    like "kdvb-ad-1-fe--1".
    
    Cc: Michael Krufky <mkrufky at linuxtv.org>
    Cc: Steven Toth <stoth at linuxtv.org>
    Cc: Timothy Lee <timothy.lee at siriushk.com>
    Cc: Igor M. Liplianin <liplianin at me.by>
    Signed-off-by: Matthias Schwarzott <zzam at gentoo.org>
    Acked-by: Andreas Oberritter <obi at linuxtv.org>
    Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit bb2b4542b6415044894cd7c147ff54840dd8ed3f
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Mon Aug 10 22:07:54 2009 -0300

    V4L/DVB (12438): Read buffer overflow
    
    parport[n] is checked before n < MAX_CAMS
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 27059b35397fc7cf2cbf5b4b99d912bbc06aff4d
Author: Randy Dunlap <randy.dunlap at oracle.com>
Date:   Mon Aug 10 21:59:16 2009 -0300

    V4L/DVB (12437): dvb: siano uses/depends on INPUT
    
    siano uses input_*() functions so it should depend on INPUT
    to prevent build errors:
    
    ERROR: "input_event" [drivers/media/dvb/siano/sms1xxx.ko] undefined!
    ERROR: "input_register_device" [drivers/media/dvb/siano/sms1xxx.ko] undefined!
    ERROR: "input_free_device" [drivers/media/dvb/siano/sms1xxx.ko] undefined!
    ERROR: "input_unregister_device" [drivers/media/dvb/siano/sms1xxx.ko] undefined!
    ERROR: "input_allocate_device" [drivers/media/dvb/siano/sms1xxx.ko] undefined!
    
    Cc: Michael Krufky <mkrufky at linuxtv.org>
    Cc: Uri Shkolnik <uris at siano-ms.com>
    Signed-off-by: Randy Dunlap <randy.dunlap at oracle.com>
    Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 77f2c2db1146154fb054e9ce955928a66d8c959f
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Mon Aug 10 22:17:25 2009 -0300

    V4L/DVB (12436): stk-webcam: read buffer overflow
    
    It tested the value of stk_sizes[i].m before checking whether i was in range.
    
    Cc: Hans Verkuil <hverkuil at xs4all.nl>
    Cc: Trent Piepho <xyzzy at speakeasy.org>
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 01a5fd6ff3fbae9a599d3334a8cca0f00865e360
Author: Devin Heitmueller <dheitmueller at kernellabs.com>
Date:   Fri Aug 7 09:25:06 2009 -0300

    V4L/DVB (12432): em28xx: fix regression in Empire DualTV digital tuning
    
    Restore support for digital tuning caused by regression during introduction
    of disable_i2c_gate parameter to zl10353 driver.
    
    Thanks to user "Xwang" for reporting the problem and testing the fix
    
    Cc: Xwang <xwang1976 at email.it>
    Signed-off-by: Devin Heitmueller <dheitmueller at kernellabs.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 9bedc7f7fe803c17d26b5fcf5786b50a7cf40def
Author: Hans Verkuil <hverkuil at xs4all.nl>
Date:   Fri Aug 7 07:28:16 2009 -0300

    V4L/DVB (12429): v4l2-ioctl: fix G_STD and G_PARM default handlers
    
    The v4l core supplies default handlers for G_STD and G_PARM. However, both
    default handlers are buggy.
    
    This patch fixes the following:
    
    1) If no g_std is supplied and current_norm == 0, then this driver does not
       support TV video standards (e.g. a radio or webcam driver). Return
       -EINVAL. This ensures that there is no bogus VIDIOC_G_STD support for
       such drivers.
    
    2) The default VIDIOC_G_PARM handler used current_norm instead of first
       checking if the driver supported g_std and calling that to get the norm.
       It also didn't check if current_norm was 0, since in that case the driver
       does not support TV standards (or no standard was set at all) and the
       default handler should return -EINVAL.
    
    Note that I am very unhappy with these default handlers: I think they
    basically behave like some very strange and unexpected side-effect.
    
    Signed-off-by: Hans Verkuil <hverkuil at xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 99362e1ece9f9651af1b849a01d91b9df1e0db2c
Author: Hans Verkuil <hverkuil at xs4all.nl>
Date:   Fri Aug 7 07:10:52 2009 -0300

    V4L/DVB (12428): hdpvr: add missing initialization of current_norm
    
    Drivers should either set current_norm or supply a g_std callback.
    
    The hdpvr driver does neither. Since it initializes to a 60 Hz format
    I've initialized the current_norm to NTSC | PAL_M | PAL_60 which is the
    60 Hz subset of tvnorms.
    
    Cc: Janne Grunau <j at jannau.net>
    Signed-off-by: Hans Verkuil <hverkuil at xs4all.nl>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 2dd54a54c19d0e5b50f4e1c591653772ead9d4a1
Author: Guennadi Liakhovetski <g.liakhovetski at gmx.de>
Date:   Wed Aug 5 20:06:31 2009 -0300

    V4L/DVB (12424): soc-camera: fix recursive locking in .buf_queue()
    
    The .buf_queue() V4L2 driver method is called under
    spinlock_irqsave(q->irqlock,...), don't take the lock again inside the
    function.
    
    Reported-by: Antonio Ospite <ospite at studenti.unina.it>
    Signed-off-by: Guennadi Liakhovetski <g.liakhovetski at gmx.de>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 7d2e2e35fb50f381c9398e481aac1e1729765ae3
Author: Randy Dunlap <randy.dunlap at oracle.com>
Date:   Wed Aug 5 12:58:47 2009 -0300

    V4L/DVB (12422): media/zr364xx: fix build errors
    
    Fix build errors in zr364xx by adding selects:
    
    zr364xx.c:(.text+0x195ed7): undefined reference to `videobuf_streamon'
    zr364xx.c:(.text+0x196030): undefined reference to `videobuf_dqbuf'
    zr364xx.c:(.text+0x1960c4): undefined reference to `videobuf_qbuf'
    zr364xx.c:(.text+0x196123): undefined reference to `videobuf_querybuf'
    zr364xx.c:(.text+0x196182): undefined reference to `videobuf_reqbufs'
    zr364xx.c:(.text+0x196224): undefined reference to `videobuf_queue_is_busy'
    zr364xx.c:(.text+0x196390): undefined reference to `videobuf_vmalloc_free'
    zr364xx.c:(.text+0x196571): undefined reference to `videobuf_iolock'
    zr364xx.c:(.text+0x196678): undefined reference to `videobuf_mmap_mapper'
    zr364xx.c:(.text+0x196760): undefined reference to `videobuf_poll_stream'
    zr364xx.c:(.text+0x19689a): undefined reference to `videobuf_read_one'
    zr364xx.c:(.text+0x1969ec): undefined reference to `videobuf_mmap_free'
    zr364xx.c:(.text+0x197862): undefined reference to `videobuf_queue_vmalloc_init'
    zr364xx.c:(.text+0x197a28): undefined reference to `videobuf_streamoff'
    zr364xx.c:(.text+0x198203): undefined reference to `videobuf_to_vmalloc'
    zr364xx.c:(.text+0x198603): undefined reference to `videobuf_streamoff'
    drivers/built-in.o: In function `free_buffer':
    zr364xx.c:(.text+0x19930c): undefined reference to `videobuf_vmalloc_free'
    drivers/built-in.o: In function `zr364xx_open':
    zr364xx.c:(.text+0x19a7de): undefined reference to `videobuf_queue_vmalloc_init'
    drivers/built-in.o: In function `read_pipe_completion':
    zr364xx.c:(.text+0x19b17f): undefined reference to `videobuf_to_vmalloc'
    
    Signed-off-by: Randy Dunlap <randy.dunlap at oracle.com>
    Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit d7612c86d099939503c2f849a523dbca753d1935
Author: Mauro Carvalho Chehab <mchehab at redhat.com>
Date:   Fri Aug 7 18:43:00 2009 -0300

    V4L/DVB (12405): em28xx-cards: move register 0x13 setting to the proper place
    
    Register 0x13 seems to be a sort of image control, maybe gamma, white
    level or black level. Lower values produce better images, while higher
    values increases the contrast and shifts colors to green. 0xff produces
    a black image. This register is not Silvercrest-specific, so its code
    should be moved to a better place.
    
    If this register is left alone, a random value can be found at the
    register, producing weird results.
    
    While here, let's remove register 0x0d, as it had no noticed effect at
    the image.
    
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 3d3215c4e4cfca74e5805a8506d50a6752172e81
Author: Mauro Carvalho Chehab <mchehab at redhat.com>
Date:   Mon Aug 10 10:29:27 2009 -0300

    V4L/DVB (12411): em28xx: Fix artifacts with Silvercrest webcam
    
    Silvercrest mt9v011 sensor produces a 640x480 image. However,
    previously, the code were getting only half of the lines and merging two
    consecutive frames to "produce" a 640x480 image.
    
    With the addition of progressive mode, now em28xx is working with a full
    image. However, when the number of lines is bigger than 240, the
    beginning of some odd lines are filled with blank.
    
    After lots of testing, and physically checking the device for a Xtal, it
    was noticed experimentally that mt9v011 is using em28xx XCLK as its
    clock. Due to that, changing XCLK value changes the maximum speed of the
    stream.
    
    At the tests, it were possible to produce up to 32 fps, using a 30 MHz
    XCLK. However, at that rate, the artifacts happen even at 320x240. Lower
    values of XCLK produces artifacts only at 640x480.
    
    At some values of xclk (for example XCLKK = 6 MHz, 640x480), it is
    possible to see an invalid sucession of artifacts with this pattern:
    
    .xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    ..xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    ...xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    ....xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    .xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    ..xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    ...xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    ....xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
    
    (where the dots represent the blanked pixels)
    
    So, it seems that a waveform in the format of a ramp is interferring at
    the image.
    
    The cause of this interference is currently unknown. Some possibilities
    are:
    	- electrical interference (maybe this device is broken?);
    	- some issue at mt9v011 programming;
    	- some bug at em28xx chip.
    
    So, for now, let's be conservative and use a value of XCLK that we know
    for sure that it won't cause artifacts.
    
    As I'm waiting for more of such devices with different em28xx chipset
    revisions, I'll have the opportunity to double check the issue with
    other pieces of hardware.
    
    Later patches can vary XCLK depending on the vertical resolutions, if a
    proper fix is not discovered.
    
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit fcd20e3c369caf7a3fec300c9c183b25a06e21b2
Author: Mauro Carvalho Chehab <mchehab at redhat.com>
Date:   Mon Aug 10 02:57:57 2009 -0300

    V4L/DVB (12410): em28xx: Move the non-board dependent part to be outside em28xx_pre_card_setup()
    
    em28xx_pre_card_setup() is meant to contain board-specific initialization. Also,
    as autodetection sometimes occur only after having i2c bus enabled, this
    function may need to be called later.
    
    Moving those setups to happen outside the function avoids calling it twice without
    need and without duplicating output lines at dmesg.
    
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 970cff36c0850e8193ac1162e42c7c11001b872d
Author: Mauro Carvalho Chehab <mchehab at redhat.com>
Date:   Sat Aug 8 03:28:41 2009 -0300

    V4L/DVB (12407): em28xx: Adjust Silvercrest xtal frequency
    
    We don't know the xtal frequency of Silvercrest, but we need to have
    some value in order to allow controlling the frame rate frequency. The
    value is probably still wrong, since the manufacturer announces this
    device as being capable of 30fps, but the maximum we can get is
    13.5 fps.
    
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit c2a6b54a9cf08d4ffeb75d70603c4a5d03ac97ad
Author: Mauro Carvalho Chehab <mchehab at redhat.com>
Date:   Sat Aug 8 03:14:55 2009 -0300

    V4L/DVB (12406): em28xx: fix: don't do image interlacing on webcams
    
    Due to historical reasons, em28xx driver gets two consecutive frames and
    fold them into an unique framing, doing interlacing. While this works
    fine for TV images, this produces two bad effects with webcams:
    
    1) webcam images are progressive. Merging two consecutive images produce
    interlacing artifacts on the image;
    
    2) since the driver needs to get two frames, it reduces the maximum
    frame rate by two.
    
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit d594317bdc716ccd8c8cf711e3827f9b6e0b766b
Author: Mauro Carvalho Chehab <mchehab at redhat.com>
Date:   Fri Aug 7 12:13:31 2009 -0300

    V4L/DVB (12403): em28xx: properly reports some em2710 chips
    
    As reported by hermann pitton <hermann-pitton at arcor.de>, some devices
    has a different chip id for em2710 (likely the older ones):
    
    em28xx: New device @ 480 Mbps (eb1a:2710, interface 0, class 0)
    em28xx #0: Identified as EM2710/EM2750/EM2751 webcam grabber (card=22)
    em28xx #0: em28xx chip ID = 17
    
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 9b4e845c6cbca2bcbfdb87e4d005260604226f45
Author: Mauro Carvalho Chehab <mchehab at redhat.com>
Date:   Fri Aug 7 12:08:02 2009 -0300

    V4L/DVB (12402): em28xx: fix: some em2710 chips use a different vendor ID
    
    Thanks to hermann pitton <hermann-pitton at arcor.de> for pointing this new
    variation.
    
    Tested-by: hermann pitton <hermann-pitton at arcor.de>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 2526ea6e46e41322eb98ac0e9c616273402bd661
Author: Mauro Carvalho Chehab <mchehab at redhat.com>
Date:   Fri Aug 7 01:09:54 2009 -0300

    V4L/DVB (12401): m9v011: add vflip/hflip controls to control mirror/upside down
    
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit d96ecda63f41350dc93c17ccb72ea24511f207a9
Author: Mauro Carvalho Chehab <mchehab at redhat.com>
Date:   Thu Aug 6 21:53:59 2009 -0300

    V4L/DVB (12400): em28xx: Allow changing fps on webcams
    
    em28xx doesn't have temporal scaling. However, on webcams, sensors are
    capable of changing the output rate. So, VIDIOC_[G|S]_PARM ioctls should
    be passed to the sensor for it to properly set frame rate.
    
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 83053f7fe3eb0b6b1634d24ede87f1daa01ae60c
Author: Mauro Carvalho Chehab <mchehab at redhat.com>
Date:   Thu Aug 6 21:03:35 2009 -0300

    V4L/DVB (12399): mt9v011: Add support for controlling frame rates
    
    Implement g_parm/s_parm ioctls. Those are used to check the current
    frame rate (in fps) and to set it to a value. In practice, there are
    only 15 possible different speeds, due to chip limits.
    
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 93b999239c418cf5c668fd966ac2c5c27b8180dd
Author: Devin Heitmueller <dheitmueller at kernellabs.com>
Date:   Mon Aug 3 22:52:59 2009 -0300

    V4L/DVB (12394): cx88: Disable xc3028 power management for Geniatech x8000
    
    A user discovered that the Geniatech x8000 encountered a regression when
    the xc3028 power management was introduced.  The xc3028 never recovers after
    setting the powerdown register, which is probably because the xc3028 reset
    GPIO is not properly configured.  Since I do not have access to the hardware
    and thus cannot determine the correct GPIO configuration, just disable xc3028
    power management on this board, which fixes the regression.
    
    Thanks to user "ritec" for reporting the issue and testing the fix.
    
    Cc: rictec <rictec at netcabo.pt>
    Signed-off-by: Devin Heitmueller <dheitmueller at kernellabs.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 11db906983fc6e996fcd10073843bd6f1b9a96c3
Author: Devin Heitmueller <dheitmueller at kernellabs.com>
Date:   Mon Aug 3 22:40:16 2009 -0300

    V4L/DVB (12393): cx88: fix regression in tuning for Geniatech X8000 MT
    
    The introduction of the zl10353 i2c gate control broke support for the
    Geniatech board (which is not behind an i2 gate).  Add the needed parameter.
    
    Signed-off-by: Devin Heitmueller <dheitmueller at kernellabs.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 0e316ecfc851c8dd955d9fa6e0d3a46e451a46f4
Author: Michael Krufky <mkrufky at kernellabs.com>
Date:   Mon Aug 3 16:51:33 2009 -0300

    V4L/DVB (12391): saa7134: Use correct product name for Hauppauge WinTV-HVR1120 DVB-T/Hybrid
    
    Signed-off-by: Michael Krufky <mkrufky at kernellabs.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit b5f05064b556da5183adc383e5f8d50af0392849
Author: Michael Krufky <mkrufky at kernellabs.com>
Date:   Mon Aug 3 16:51:33 2009 -0300

    V4L/DVB (12390): saa7134: Use correct product name for Hauppauge WinTV-HVR1150 ATSC/QAM-Hybrid
    
    Signed-off-by: Michael Krufky <mkrufky at kernellabs.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 79a6382551507ce196c3b4296e32b5386cdfbf15
Author: Michael Krufky <mkrufky at kernellabs.com>
Date:   Sun Aug 2 12:37:34 2009 -0300

    V4L/DVB (12386): sms1xxx: fix build warning: unused variable 'board'
    
    Remove the following build warning:
    
    sms-cards.c: In function 'sms_board_event':
    sms-cards.c:120: warning: unused variable 'board'
    
    Thanks to Hans Verkuil for pointing this out.
    
    The problem code has been #if 0'd for now, this will likely be
    used again in the future, once the event interface is complete.
    
    Cc: Hans Verkuil <hverkuil at xs4all.nl>
    Signed-off-by: Michael Krufky <mkrufky at kernellabs.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit bd0232c13419b7ce51e02942082ff6af231e0f84
Author: Laurent Pinchart <laurent.pinchart at skynet.be>
Date:   Sat Aug 1 18:14:24 2009 -0300

    V4L/DVB (12380): uvcvideo: Avoid flooding the kernel log with "unknown event type" messages
    
    The iSight sends non-UVC status events through the interrupt endpoint. Those
    invalid events are reported to the kernel log, resulting in a log flood.
    
    Only log the events when the UVC_TRACE_STATUS flag is set.
    
    Signed-off-by: Laurent Pinchart <laurent.pinchart at skynet.be>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit d79cd8393ae85ebaf53a8fc93491eea96522d68e
Author: Laurent Pinchart <laurent.pinchart at skynet.be>
Date:   Sun Jul 19 19:16:05 2009 -0300

    V4L/DVB (12328): uvcvideo: Don't apply the FIX_BANDWIDTH quirk to all ViMicro devices
    
    Commit 50144aeeb702ea105697ae5249f059ea3990b838 broke the Samsung NC10
    netbook webcam. Instead of applying the FIX_BANDWIDTH quirk to all ViMicro
    devices, list the devices explicitly.
    
    Signed-off-by: Laurent Pinchart <laurent.pinchart at skynet.be>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit d1ae4e1d05cc982b6b480c1a3d69b8bb231e3493
Author: Michael Krufky <mkrufky at kernellabs.com>
Date:   Sun Jul 12 18:25:45 2009 -0300

    V4L/DVB (12374): sms1xxx: fix broken Hauppauge devices
    
    The current GPIO configuration breaks all Hauppauge devices.
    
    The code being removed affects Hauppauge devices only,
    and is the cause of the breakage.
    
    Signed-off-by: Michael Krufky <mkrufky at kernellabs.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 261982f17051d10a1054a77ec8ae13517e0acee2
Author: Brian Johnson <brijohn at gmail.com>
Date:   Sun Jul 19 15:58:56 2009 -0300

    V4L/DVB (12373a): Add gspca sn9c20x subdriver entry to MAINTAINERS file
    
    MAINTAINERS |    8 ++++++++
    
    Signed-off-by: Brian Johnson <brijohn at gmail.com>
    Acked-by: Jean-Francois Moine <moinejf at free.fr>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit ba1bc64272f0af668690ba2bf859b13172db7230
Author: Nils Kassube <kassube at gmx.net>
Date:   Tue Jul 28 11:54:52 2009 -0300

    V4L/DVB (12371): af9015: Fix for crash in dvb-usb-af9015
    
    Moving BOOT fixes problem.
    
    Signed-off-by: Nils Kassube <kassube at gmx.net>
    Acked-by: Antti Palosaari <crope at iki.fi>
    Signed-off-by: Douglas Schilling Landgraf <dougsland at redhat.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 6655be0f4f377d7e249219c6031c4be3533604a2
Author: Michael Krufky <mkrufky at kernellabs.com>
Date:   Mon Jul 20 12:20:58 2009 -0300

    V4L/DVB (12362): cx23885-417: fix manipulation of tvnorms
    
    Currently, the VIDIOC_S_STD ioctl just returns -EINVAL regardless of
    the norm passed.  This patch sets cx23885_mpeg_template.tvnorms and
    cx23885_mpeg_template.current_norm so that the VIDIOC_S_STD will work.
    
    Thanks to Joseph Yasi for pointing this out, even though this particular
    fix was already pushed into a development repository, merge priority of
    this changeset has been escalated as a result of Joseph posting this
    identical patch.
    
    Signed-off-by: Michael Krufky <mkrufky at kernellabs.com>
    Signed-off-by: Joseph A. Yasi <joe.yasi at gmail.com>
    Reviewed-by: Steven Toth <stoth at kernellabs.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 337ab6d34f0be7cfbfb5ac8cb651276fc58aa20d
Author: Sohail Syyed <linuxtv at hubstar.net>
Date:   Sun Jul 26 11:06:20 2009 -0300

    V4L/DVB (12349): cx88: HVR1300 ensure switching from Encoder to DVB-T and back is reliable
    
    Current tip is broken and does not switch back to DVB-T correctly
    
    Signed-off-by: Sohail Syyed <linuxtv at hubstar.net>
    Signed-off-by: Steven Toth <stoth at kernellabs.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 0a6e44d1beb30813f62ad376a31694e637858328
Author: Mauro Carvalho Chehab <mchehab at redhat.com>
Date:   Wed Jul 29 01:39:12 2009 -0300

    V4L/DVB (12344): em28xx: fix support for Plextor ConvertX PX-TV100U
    
    This device uses msp34xx and uses 2.048 MHz frequency for I2S
    communication.
    
    Thanks to Angelo Cano <acano at fastmail.fm> for pointing the issues with
    this device and proposing an approach for fixing the issue.
    
    Tested-by: Angelo Cano <acano at fastmail.fm>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 458f9aa391efd34867f8cabac2e2f1af00cbc562
Author: Jan Nikitenko <jan.nikitenko at gmail.com>
Date:   Thu Jun 18 08:11:57 2009 -0300

    V4L/DVB (12341): zl10353 and qt1010: fix stack corruption bug
    
    Fixes stack corruption bug present in dump_regs function of zl10353 and
    qt1010 drivers: the buffer buf was one byte smaller than required -
    there are 4 chars for address prefix, 16 * 3 chars for dump of 16 eeprom
    bytes per line and 1 byte for zero ending the string required, i.e. 53
    bytes, but only 52 were provided.
    
    The one byte missing in stack based buffer buf can cause stack
    corruption possibly leading to kernel oops, as discovered originally
    with af9015 driver (af9015: fix stack corruption bug).
    
    Signed-off-by: Jan Nikitenko <jan.nikitenko at gmail.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 296544e15a7126373851abd40acc526b79b91432
Author: Mauro Carvalho Chehab <mchehab at redhat.com>
Date:   Mon Jul 27 08:24:29 2009 -0300

    V4L/DVB (12340): mtv9v011: Add a missing chip version to the driver
    
    Some mt9v011 webcams report 0x8332 chip version, instead of 0x8243. From
    the revision history at the mt9v011 datasheet, it seems that the chip
    version has changed from the first release of the chip.
    
    Thanks-to hermann pitton <hermann-pitton at arcor.de> for pointing this to
    me, on his tests with a Silvercrest webcam.
    
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 225aeb1c5863bc92c6bb1f921e9a6cf4d15dbb2a
Author: Andy Walls <awalls at radix.net>
Date:   Thu Jul 23 21:51:29 2009 -0300

    V4L/DVB (12338): cx18: Read buffer overflow
    
    This mistakenly tested against sizeof(freqs) instead of the array size. Due to
    the mask the only illegal value possible was 3.
    
    Reported-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: Andy Walls <awalls at radix.net>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit ed18d0c87ee0ab6e0985d83c19cd135b1bd54998
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Thu Jul 23 21:46:57 2009 -0300

    V4L/DVB (12337): ivtv: Read buffer overflow
    
    This mistakenly tests against sizeof(freqs) instead of the array size. Due to
    the mask the only illegal value possible was 3.
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: Andy Walls <awalls at radix.net>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 5b766182a110311fbf618f736bc8a8f2f7ce3f4c
Author: Antonio Ospite <ospite at studenti.unina.it>
Date:   Wed Jul 22 17:20:50 2009 -0300

    V4L/DVB (12330): pxa_camera: Fix Oops in pxa_camera_probe
    
    mclk_get_divisor uses pcdev->soc_host.dev, make sure it is initialized.
    
    Signed-off-by: Antonio Ospite <ospite at studenti.unina.it>
    Signed-off-by: Guennadi Liakhovetski <g.liakhovetski at gmx.de>
    Signed-off-by: Mauro Carvalho Chehab <mchehab at redhat.com>

commit 232e7d68d50c9ac3a55d716e5ae215ecd1e043b9
Author: Dhananjay Phadke <dhananjay at netxen.com>
Date:   Thu Aug 13 07:03:01 2009 +0000

    netxen: free napi resources during detach
    
    o Defer napi resouce allocation to device attach.
    
    o Free napi resources and delete napi during detach.
    
    This ensures right behavior across firmware reset.
    
    Signed-off-by: Dhananjay Phadke <dhananjay at netxen.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit e424fa9d6a0add1a9b812b07e3607daaa5b9e53d
Author: Amit Kumar Salecha <amit at qlogic.com>
Date:   Thu Aug 13 07:03:00 2009 +0000

    netxen: remove netxen workqueue
    
    o Remove private workqueue in the driver, move all
      scheduled tasks to keventd workqueues. This makes
      ports (interfaces) of same / different NIC boards
      independent, in terms of their link watchdog and
      reset tasks.
    
    o Move quick checks for link status and temperature
      in timer callback, schedule watchdog task only if
      link status changed or temperature reached critical
      threshold.
    
    This also fixes deadlock when thermal panic occurs,
    watchdog work was flushing workqueue that it was
    sitting on.
    
    Signed-off-by: Amit Kumar Salecha <amit at qlogic.com>
    Signed-off-by: Dhananjay Phadke <dhananjay at netxen.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 237057ad3fe5644fa471be474a160de2fc2e5870
Author: Don Skidmore <donald.c.skidmore at intel.com>
Date:   Tue Aug 11 13:18:14 2009 +0000

    ixgbe: fix issues setting rx-usecs with legacy interrupts
    
    Currently setting rx-usecs when the interface is in legacy interrupt
    mode it is not immediate.  We were only setting EITR for each MSIx
    vector and since this count would be zero for legacy mode it wasn't
    set until after a reset.  This patch corrects that by checking what
    mode we are in and then setting EITR accordingly.
    
    Signed-off-by: Don Skidmore <donald.skidmore at intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher at intel.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 993e6f2fd487e2acddd711f79cf48f3420731382
Author: Oliver Hartkopp <oliver at hartkopp.net>
Date:   Tue Aug 11 02:41:24 2009 +0000

    can: fix oops caused by wrong rtnl newlink usage
    
    For 'real' hardware CAN devices the netlink interface is used to set CAN
    specific communication parameters. Real CAN hardware can not be created with
    the ip tool ...
    
    The invocation of 'ip link add type can' lead to an oops as the standard rtnl
    newlink function was called:
    
    http://bugzilla.kernel.org/show_bug.cgi?id=13954
    
    This patch adds a private newlink function for the CAN device driver interface
    that unconditionally returns -EOPNOTSUPP.
    
    Signed-off-by: Oliver Hartkopp <oliver at hartkopp.net>
    Reported-by: Dmitry Eremin-Solenikov <dbaryshkov at gmail.com>
    CC: Patrick McHardy <kaber at trash.net>
    CC: Wolfgang Grandegger <wg at grandegger.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 64f1607ffbbc772685733ea63e6f7f4183df1b16
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 13 15:43:34 2009 -0700

    Linux 2.6.31-rc6

commit f9b14c9183b250cf128c7d2341e6b9bdbbcd8f35
Author: Kashyap, Desai <kashyap.desai at lsi.com>
Date:   Fri Aug 7 19:39:59 2009 +0530

    [SCSI] mpt2sas: Bump driver version 01.100.04.00
    
    Bump version to 01.100.04.00
    
    Signed-off-by: Kashyap Desai <kashyap.desai at lsi.com>
    Signed-off-by: James Bottomley <James.Bottomley at suse.de>

commit fcfe6392d18283df3c561b5ef59c330d485ff8ca
Author: Kashyap, Desai <kashyap.desai at lsi.com>
Date:   Fri Aug 7 19:38:48 2009 +0530

    [SCSI] mpt2sas: fix oops because drv data points to NULL on resume from hibernate
    
    Fix another ocurring when the system resumes.  This oops was due to driver
    setting the pci drvdata to NULL on the prior hibernation.  Becuase it was
    set to NULL, upon resmume we assume the pci drvdata is non-zero, and we oops.
    To fix the ooops, we don't set pci drvdata to NULL at hibernation time.
    
    Signed-off-by: Kashyap Desai <kashyap.desai at lsi.com>
    Signed-off-by: James Bottomley <James.Bottomley at suse.de>

commit e4750c989f732555fca86dd73d488c79972362db
Author: Kashyap, Desai <kashyap.desai at lsi.com>
Date:   Fri Aug 7 19:37:59 2009 +0530

    [SCSI] mpt2sas: fix crash due to Watchdog is active while OS in standby mode
    
    Fix oops ocurring at hibernation time.  This oops was due to the firmware fault
    watchdog timer still running after we freed resources. To fix the issue we need
    to terminate the watchdog timer at hibernation time.
    
    Signed-off-by: Kashyap Desai <kashyap.desai at lsi.com>
    Signed-off-by: James Bottomley <James.Bottomley at suse.de>

commit 6bd4e1e4d6023f4da069fd68729c502cc4e6dfd0
Author: Kashyap, Desai <kashyap.desai at lsi.com>
Date:   Fri Aug 7 19:37:14 2009 +0530

    [SCSI] mpt2sas: fix infinite loop inside config request
    
    This restriction is introduced just to avoid loop of
    config_request. Retry must be limited so we have restricted
    config request to maximum 2 times.
    
    Signed-off-by: Kashyap Desai <kashyap.desai at lsi.com>
    Signed-off-by: James Bottomley <James.Bottomley at suse.de>

commit be9e8cd75ce8d94ae4aab721fdcc337fa78a9090
Author: Kashyap, Desai <kashyap.desai at lsi.com>
Date:   Fri Aug 7 19:36:43 2009 +0530

    [SCSI] mpt2sas: Excessive log info causes sas iounit page time out
    
    Inhibit 0x3117 loginfos - during cable pull, there are too many printks going
    to the syslog, this is have impact on how fast the interrupt routine can handle
    keeping up with command completions; this was the root cause to the config
    pages timeouts.
    
    Signed-off-by: Kashyap Desai <kashyap.desai at lsi.com>
    Signed-off-by: James Bottomley <James.Bottomley at suse.de>

commit 62727a7ba43c0abf2673e3877079c136a9721792
Author: Kashyap, Desai <kashyap.desai at lsi.com>
Date:   Fri Aug 7 19:35:18 2009 +0530

    [SCSI] mpt2sas: Raid 10 Value is showing as Raid 1E in /va/log/messages
    
    When a volume is activated, the driver will recieve a pair of ir config change
    events to remove the foreign volume, then add the native.
    In the process of the removal event, the hidden raid componet is removed from
    the parent.When the disks is added back, the adding of the port fails becuase
    there is no instance of the device in its parent.
    To fix this issue, the driver needs to call mpt2sas_transport_update_links()
    prior to calling _scsih_add_device. In addition, we added sanity checks on
    volume add and removal to ignore events for foreign volumes.
    
    Signed-off-by: Kashyap Desai <kashyap.desai at lsi.com>
    Signed-off-by: James Bottomley <James.Bottomley at suse.de>

commit 20f5895d55d9281830bfb7819c5c5b70b05297a6
Author: Kashyap, Desai <kashyap.desai at lsi.com>
Date:   Fri Aug 7 19:34:26 2009 +0530

    [SCSI] mpt2sas: Expander fix oops saying "Already part of another port"
    
    Kernel panic is seen because driver did not tear down the port which should
    be dnoe using mpt2sas_transport_port_remove(). without this fix When expander
    is added back we would oops inside sas_port_add_phy.
    
    Signed-off-by: Kashyap Desai <kashyap.desai at lsi.com>
    Signed-off-by: James Bottomley <James.Bottomley at suse.de>

commit 15052c9e85bf0cdadcb69eb89623bf12bad8b4f8
Author: Kashyap, Desai <kashyap.desai at lsi.com>
Date:   Fri Aug 7 19:33:17 2009 +0530

    [SCSI] mpt2sas: Introduced check for enclosure_handle to avoid crash
    
    Kernel panic is seen because of enclosure_handle received from FW is zero.
    Check is introduced before calling mpt2sas_config_get_enclosure_pg0.
    
    Signed-off-by: Kashyap Desai <kashyap.desai at lsi.com>
    Signed-off-by: James Bottomley <James.Bottomley at suse.de>

commit 2d860ad76f4ee4d2eba0fe3797c8d7cdce432cc0
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 13 13:05:10 2009 -0700

    genirq: prevent wakeup of freed irq thread
    
    free_irq() can remove an irqaction while the corresponding interrupt
    is in progress, but free_irq() sets action->thread to NULL
    unconditionally, which might lead to a NULL pointer dereference in
    handle_IRQ_event() when the hard interrupt context tries to wake up
    the handler thread.
    
    Prevent this by moving the thread stop after synchronize_irq(). No
    need to set action->thread to NULL either as action is going to be
    freed anyway.
    
    This fixes a boot crash reported against preempt-rt which uses the
    mainline irq threads code to implement full irq threading.
    
    [ tglx: removed local irqthread variable ]
    
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
    Signed-off-by: Thomas Gleixner <tglx at linutronix.de>

commit 3493e84de60590d3012139187f631f2dfbf0887f
Merge: 919aa96a9cfc5071f037bf58718e05335562a6ac 94d5d1b2d891f1fd5205f978246b7864d998b25c
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 13 12:24:33 2009 -0700

    Merge branch 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      perf_counter: Report the cloning task as parent on perf_counter_fork()
      perf_counter: Fix an ipi-deadlock
      perf: Rework/fix the whole read vs group stuff
      perf_counter: Fix swcounter context invariance
      perf report: Don't show unresolved DSOs and symbols when -S/-d is used
      perf tools: Add a general option to enable raw sample records
      perf tools: Add a per tracepoint counter attribute to get raw sample
      perf_counter: Provide hw_perf_counter_setup_online() APIs
      perf list: Fix large list output by using the pager
      perf_counter, x86: Fix/improve apic fallback
      perf record: Add missing -C option support for specifying profile cpu
      perf tools: Fix dso__new handle() to handle deleted DSOs
      perf tools: Fix fallback to cplus_demangle() when bfd_demangle() is not available
      perf report: Show the tid too in -D
      perf record: Fix .tid and .pid fill-in when synthesizing events
      perf_counter, x86: Fix generic cache events on P6-mobile CPUs
      perf_counter, x86: Fix lapic printk message

commit 919aa96a9cfc5071f037bf58718e05335562a6ac
Merge: 1c2ffff407140adf75bb72ae375688480793a228 392741e0a4e17c82e3978b7fcbf04291294dc0a1
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 13 12:09:16 2009 -0700

    Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      futex: Fix handling of bad requeue syscall pairing
      futex: Fix compat_futex to be same as futex for REQUEUE_PI
      locking, sched: Give waitqueue spinlocks their own lockdep classes
      futex: Update futex_q lock_ptr on requeue proxy lock

commit 1c2ffff407140adf75bb72ae375688480793a228
Merge: bc7af9ba154f648598bf92b391e446e31b09330a e8055139d996e85722984968472868d6dccb1490
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 13 12:08:44 2009 -0700

    Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86: Fix oops in identify_cpu() on CPUs without CPUID
      x86: Clear incorrectly forced X86_FEATURE_LAHF_LM flag
      x86, mce: therm_throt - change when we print messages
      x86: Add reboot quirk for every 5 series MacBook/Pro

commit 416fbdff2137e8d8cc8f23f517bee3a26b11526f
Author: Luis R. Rodriguez <lrodriguez at atheros.com>
Date:   Tue Aug 11 13:10:33 2009 -0700

    mac80211: fix panic when splicing unprepared TIDs
    
    We splice skbs from the pending queue for a TID
    onto the local pending queue when tearing down a
    block ack request. This is not necessary unless we
    actually have received a request to start a block ack
    request (rate control, for example). If we never received
    that request we should not be splicing the tid pending
    queue as it would be null, causing a panic.
    
    Not sure yet how exactly we allowed through a call when the
    tid state does not have at least HT_ADDBA_REQUESTED_MSK set,
    that will require some further review as it is not quite
    obvious.
    
    For more information see the bug report:
    
    http://bugzilla.kernel.org/show_bug.cgi?id=13922
    
    This fixes this oops:
    
    BUG: unable to handle kernel NULL pointer dereference at 00000030
    IP: [<f8806c70>] ieee80211_agg_splice_packets+0x40/0xc0 [mac80211]
    *pdpt = 0000000002d1e001 *pde = 0000000000000000
    Thread overran stack, or stack corrupted
    Oops: 0000 [#1] SMP
    last sysfs file: /sys/module/aes_generic/initstate
    Modules linked in: <bleh>
    
    Pid: 0, comm: swapper Not tainted (2.6.31-rc5-wl #2) Dell DV051
    EIP: 0060:[<f8806c70>] EFLAGS: 00010292 CPU: 0
    EIP is at ieee80211_agg_splice_packets+0x40/0xc0 [mac80211]
    EAX: 00000030 EBX: 0000004c ECX: 00000003 EDX: 00000000
    ESI: c1c98000 EDI: f745a1c0 EBP: c076be58 ESP: c076be38
     DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
    Process swapper (pid: 0, ti=c076a000 task=c0709160 task.ti=c076a000)
    Stack: <bleh2>
    Call Trace:
     [<f8806edb>] ? ieee80211_stop_tx_ba_cb+0xab/0x150 [mac80211]
     [<f8802f1e>] ? ieee80211_tasklet_handler+0xce/0x110 [mac80211]
     [<c04862ff>] ? net_rx_action+0xef/0x1d0
     [<c0149378>] ? tasklet_action+0x58/0xc0
     [<c014a0f2>] ? __do_softirq+0xc2/0x190
     [<c018eb48>] ? handle_IRQ_event+0x58/0x140
     [<c01205fe>] ? ack_apic_level+0x7e/0x270
     [<c014a1fd>] ? do_softirq+0x3d/0x40
     [<c014a345>] ? irq_exit+0x65/0x90
     [<c010a6af>] ? do_IRQ+0x4f/0xc0
     [<c014a35d>] ? irq_exit+0x7d/0x90
     [<c011d547>] ? smp_apic_timer_interrupt+0x57/0x90
     [<c01094a9>] ? common_interrupt+0x29/0x30
     [<c010fd9e>] ? mwait_idle+0xbe/0x100
     [<c0107e42>] ? cpu_idle+0x52/0x90
     [<c054b1a5>] ? rest_init+0x55/0x60
     [<c077492d>] ? start_kernel+0x315/0x37d
     [<c07743ce>] ? unknown_bootoption+0x0/0x1f9
     [<c0774099>] ? i386_start_kernel+0x79/0x81
    Code: <bleh3>
    EIP: [<f8806c70>] ieee80211_agg_splice_packets+0x40/0xc0 [mac80211] SS:ESP 0068:c076be38
    CR2: 0000000000000030
    
    Cc: stable at kernel.org
    Testedy-by: Jack Lau <jackelectronics at hotmail.com>
    Signed-off-by: Luis R. Rodriguez <lrodriguez at atheros.com>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit bc7af9ba154f648598bf92b391e446e31b09330a
Merge: d58d2d1adec90e7bc0c56e09b3ac0e9a5a471e68 b409d7a0ab46fe530efe52734984b4ed5d46c3eb
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 13 11:17:40 2009 -0700

    Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2
    
    * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jlbec/ocfs2: (22 commits)
      ocfs2: Fix possible deadlock when extending quota file
      ocfs2: keep index within status_map[]
      ocfs2: Initialize the cluster we're writing to in a non-sparse extend
      ocfs2: Remove redundant BUG_ON in __dlm_queue_ast()
      ocfs2/quota: Release lock for error in ocfs2_quota_write.
      ocfs2: Define credit counts for quota operations
      ocfs2: Remove syncjiff field from quota info
      ocfs2: Fix initialization of blockcheck stats
      ocfs2: Zero out padding of on disk dquot structure
      ocfs2: Initialize blocks allocated to local quota file
      ocfs2: Mark buffer uptodate before calling ocfs2_journal_access_dq()
      ocfs2: Make global quota files blocksize aligned
      ocfs2: Use ocfs2_rec_clusters in ocfs2_adjust_adjacent_records.
      ocfs2: Fix deadlock on umount
      ocfs2: Add extra credits and access the modified bh in update_edge_lengths.
      ocfs2: Fail ocfs2_get_block() immediately when a block needs allocation
      ocfs2: Fix error return in ocfs2_write_cluster()
      ocfs2: Fix compilation warning for fs/ocfs2/xattr.c
      ocfs2: Initialize count in aio_write before generic_write_checks
      ocfs2: log the actual return value of ocfs2_file_aio_write()
      ...

commit d58d2d1adec90e7bc0c56e09b3ac0e9a5a471e68
Merge: 7334219c44826ae0ebe6f07555c6b97f978ce266 4d484a4a7a5126410eed5f8dd329a33f6eeed068
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 13 10:59:29 2009 -0700

    Merge branch 'for-linus' of git://neil.brown.name/md
    
    * 'for-linus' of git://neil.brown.name/md:
      md: allow upper limit for resync/reshape to be set when array is read-only
      md/raid5: Properly remove excess drives after shrinking a raid5/6
      md/raid5: make sure a reshape restarts at the correct address.
      md/raid5: allow new reshape modes to be restarted in the middle.
      md: never advance 'events' counter by more than 1.
      Remove deadlock potential in md_open

commit 7334219c44826ae0ebe6f07555c6b97f978ce266
Merge: e694958388c50148389b0e9b9e9e8945cf0f1b98 dbefd606a3b3634799b625f4900336e61c89e868
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 13 10:57:53 2009 -0700

    Merge branch 'sh/for-2.6.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6
    
    * 'sh/for-2.6.31' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
      sh: fix i2c init order on ap325rxa V2
      sh: fix i2c init order on Migo-R V2
      sh: convert processor device setup functions to arch_initcall()

commit e694958388c50148389b0e9b9e9e8945cf0f1b98
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 13 08:28:36 2009 -0700

    Make sock_sendpage() use kernel_sendpage()
    
    kernel_sendpage() does the proper default case handling for when the
    socket doesn't have a native sendpage implementation.
    
    Now, arguably this might be something that we could instead solve by
    just specifying that all protocols should do it themselves at the
    protocol level, but we really only care about the common protocols.
    Does anybody really care about sendpage on something like Appletalk? Not
    likely.
    
    Acked-by: David S. Miller <davem at davemloft.net>
    Acked-by: Julien TINNES <julien at cr0.org>
    Acked-by: Tavis Ormandy <taviso at sdf.lonestar.org>
    Cc: stable at kernel.org
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 94d5d1b2d891f1fd5205f978246b7864d998b25c
Author: Peter Zijlstra <peterz at infradead.org>
Date:   Thu Aug 13 16:14:42 2009 +0200

    perf_counter: Report the cloning task as parent on perf_counter_fork()
    
    A bug in (9f498cc: perf_counter: Full task tracing) makes
    profiling multi-threaded apps it go belly up.
    
    [ output as: (PID:TID):(PPID:PTID) ]
    
     # ./perf report -D | grep FORK
    0x4b0 [0x18]: PERF_EVENT_FORK: (3237:3237):(3236:3236)
    0xa10 [0x18]: PERF_EVENT_FORK: (3237:3238):(3236:3236)
    0xa70 [0x18]: PERF_EVENT_FORK: (3237:3239):(3236:3236)
    0xad0 [0x18]: PERF_EVENT_FORK: (3237:3240):(3236:3236)
    0xb18 [0x18]: PERF_EVENT_FORK: (3237:3241):(3236:3236)
    
    Shows us that the test (27d028d perf report: Update for the new
    FORK/EXIT events) in builtin-report.c:
    
            /*
             * A thread clone will have the same PID for both
             * parent and child.
             */
            if (thread == parent)
                    return 0;
    
    Will clearly fail.
    
    The problem is that perf_counter_fork() reports the actual
    parent, instead of the cloning thread.
    
    Fixing that (with the below patch), yields:
    
     # ./perf report -D | grep FORK
    0x4c8 [0x18]: PERF_EVENT_FORK: (1590:1590):(1589:1589)
    0xbd8 [0x18]: PERF_EVENT_FORK: (1590:1591):(1590:1590)
    0xc80 [0x18]: PERF_EVENT_FORK: (1590:1592):(1590:1590)
    0x3338 [0x18]: PERF_EVENT_FORK: (1590:1593):(1590:1590)
    0x66b0 [0x18]: PERF_EVENT_FORK: (1590:1594):(1590:1590)
    
    Which both makes more sense and doesn't confuse perf report
    anymore.
    
    Reported-by: Pekka Enberg <penberg at cs.helsinki.fi>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: paulus at samba.org
    Cc: Anton Blanchard <anton at samba.org>
    Cc: Arjan van de Ven <arjan at infradead.org>
    LKML-Reference: <1250172882.5241.62.camel at twins>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 970892a9031a5dc7217bd394fb9d89fa75a4a7bc
Author: Peter Zijlstra <a.p.zijlstra at chello.nl>
Date:   Thu Aug 13 11:47:54 2009 +0200

    perf_counter: Fix an ipi-deadlock
    
    perf_pending_counter() is called from IRQ context and will call
    perf_counter_disable(), however perf_counter_disable() uses
    smp_call_function_single() which doesn't fancy being used with
    IRQs disabled due to IPI deadlocks.
    
    Fix this by making it use the local __perf_counter_disable()
    call and teaching the counter_sched_out() code about pending
    disables as well.
    
    This should cover the case where a counter migrates before the
    pending queue gets processed.
    
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Corey J Ashford <cjashfor at us.ibm.com>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: stephane eranian <eranian at googlemail.com>
    LKML-Reference: <20090813103655.244097721 at chello.nl>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 3dab77fb1bf89664bb1c9544607159dcab6f7d57
Author: Peter Zijlstra <a.p.zijlstra at chello.nl>
Date:   Thu Aug 13 11:47:53 2009 +0200

    perf: Rework/fix the whole read vs group stuff
    
    Replace PERF_SAMPLE_GROUP with PERF_SAMPLE_READ and introduce
    PERF_FORMAT_GROUP to deal with group reads in a more generic
    way.
    
    This allows you to get group reads out of read() as well.
    
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Corey J Ashford <cjashfor at us.ibm.com>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: stephane eranian <eranian at googlemail.com>
    LKML-Reference: <20090813103655.117411814 at chello.nl>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit bcfc2602e8541ac13b1def38e2591dca072cff7a
Author: Peter Zijlstra <peterz at infradead.org>
Date:   Thu Aug 13 09:51:55 2009 +0200

    perf_counter: Fix swcounter context invariance
    
    perf_swcounter_is_counting() uses a lock, which means we cannot
    use swcounters from NMI or when holding that particular lock,
    this is unintended.
    
    The below removes the lock, this opens up race window, but not
    worse than the swcounters already experience due to RCU
    traversal of the context in perf_swcounter_ctx_event().
    
    This also fixes the hard lockups while opening a lockdep
    tracepoint counter.
    
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Acked-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: stephane eranian <eranian at googlemail.com>
    Cc: Corey J Ashford <cjashfor at us.ibm.com>
    LKML-Reference: <1250149915.10001.66.camel at twins>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 8fd101f20bdf771949a8f3a5a779877d09b2fb56
Author: Arnaldo Carvalho de Melo <acme at redhat.com>
Date:   Wed Aug 12 18:19:57 2009 -0300

    perf report: Don't show unresolved DSOs and symbols when -S/-d is used
    
    We're interested in just those symbols/DSOs, so filter out the
    unresolved ones.
    
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    LKML-Reference: <20090812211957.GE3495 at ghostprotocols.net>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 3b3119fc549c93df60316d28bdd77c2de3986588
Merge: 96a4d1e23439e2356a105791bda95cc08d375b97 dee2b904a1f93c275a015b67cd693038d74b18e8
Author: Russell King <rmk at dyn-67.arm.linux.org.uk>
Date:   Thu Aug 13 09:55:38 2009 +0100

    Merge branch 'ixp4xx-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/chris/linux-2.6

commit daac07b2e6b77f1bd44104aa2f0593e5505f27d4
Author: Frederic Weisbecker <fweisbec at gmail.com>
Date:   Thu Aug 13 10:27:19 2009 +0200

    perf tools: Add a general option to enable raw sample records
    
    While we can enable the perf sample records per tracepoint
    counter, we may also want to enable this option for every
    tracepoint counters to open, so that we don't need to add a
    :record flag for all of them.
    
    Add the -R, --raw-samples options for this purpose.
    
    Signed-off-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Mike Galbraith <efault at gmx.de>
    LKML-Reference: <1250152039-7284-2-git-send-email-fweisbec at gmail.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 3a9f131fb00b8ac5950a11ad1599e45edfb5ae44
Author: Frederic Weisbecker <fweisbec at gmail.com>
Date:   Thu Aug 13 10:27:18 2009 +0200

    perf tools: Add a per tracepoint counter attribute to get raw sample
    
    Add a new flag field while opening a tracepoint perf counter:
    
    	-e tracepoint_subsystem:tracepoint_name:flags
    
    This is intended to be generic although for now it only supports the
    r[e[c[o[r[d]]]]] flag:
    
    	./perf record -e workqueue:workqueue_insertion:record
    	./perf record -e workqueue:workqueue_insertion:r
    
    will have the same effect: enabling the raw samples record for
    the given tracepoint counter.
    
    In the future, we may want to support further flags, separated
    by commas.
    
    Signed-off-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Mike Galbraith <efault at gmx.de>
    LKML-Reference: <1250152039-7284-1-git-send-email-fweisbec at gmail.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 28402971d869e26271b25301011f667d3a5640c3
Author: Ingo Molnar <mingo at elte.hu>
Date:   Thu Aug 13 10:13:22 2009 +0200

    perf_counter: Provide hw_perf_counter_setup_online() APIs
    
    Provide weak aliases for hw_perf_counter_setup_online(). This is
    used by the BTS patches (for v2.6.32), but it interacts with
    fixes so propagate this upstream. (it has no effect as of yet)
    
    Also export perf_counter_output() to architecture code.
    
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    LKML-Reference: <new-submission>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 8f7a0dc51674ad0dd06155291b0aed60d655943c
Author: Arnaldo Carvalho de Melo <acme at redhat.com>
Date:   Wed Aug 12 14:44:59 2009 -0300

    perf list: Fix large list output by using the pager
    
    When /sys/kernel/debug is mounted the list can be imense, so
    use the pager like the other tools.
    
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>
    Acked-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    LKML-Reference: <20090812174459.GB3495 at ghostprotocols.net>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 839d1624b9dcf31fdc02e47359043bb7bd71d6ca
Author: Francois Romieu <romieu at fr.zoreil.com>
Date:   Wed Aug 12 22:18:14 2009 -0700

    8139cp: balance dma_map_single vs dma_unmap_single pair
    
    The driver always:
    1. allocate cp->rx_buf_sz + NET_IP_ALIGN
    2. map cp->rx_buf_sz
    
    Signed-off-by: Francois Romieu <romieu at fr.zoreil.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit dbefd606a3b3634799b625f4900336e61c89e868
Author: Magnus Damm <damm at igel.co.jp>
Date:   Fri Aug 7 03:52:18 2009 +0000

    sh: fix i2c init order on ap325rxa V2
    
    Convert the AP325RXA board code to register devices at
    arch_initcall() time instead of device_initcall(). This
    fix unbreaks pcf8563 RTC driver support.
    
    Signed-off-by: Magnus Damm <damm at igel.co.jp>
    Signed-off-by: Paul Mundt <lethal at linux-sh.org>

commit ba3a17019181af5d6ab898760620c4e9916396c2
Author: Magnus Damm <damm at igel.co.jp>
Date:   Thu Aug 13 11:39:02 2009 +0900

    sh: fix i2c init order on Migo-R V2
    
    Convert the Migo-R board code to register devices at
    arch_initcall() time instead of __initcall(). This fix
    unbreaks migor_ts touch screen driver support.
    
    Signed-off-by: Magnus Damm <damm at igel.co.jp>
    Signed-off-by: Paul Mundt <lethal at linux-sh.org>

commit ba9a633787eed1e90d587282642580ad3d44f7fd
Author: Magnus Damm <damm at igel.co.jp>
Date:   Wed Jul 22 15:14:29 2009 +0000

    sh: convert processor device setup functions to arch_initcall()
    
    Convert the processor platform device setup
    functions from __initcall() and sometimes
    device_initcall() to arch_initcall().
    
    This makes sure that the platform devices are
    registered a bit earlier so the devices are
    available when drivers register using initcall
    levels earlier than device_initcall().
    
    A good example is platform devices needed by
    i2c-sh_mobile.c which registers a bit earlier
    using subsys_initcall().
    
    Signed-off-by: Magnus Damm <damm at igel.co.jp>
    Signed-off-by: Paul Mundt <lethal at linux-sh.org>

commit 4d484a4a7a5126410eed5f8dd329a33f6eeed068
Author: NeilBrown <neilb at suse.de>
Date:   Thu Aug 13 10:41:50 2009 +1000

    md: allow upper limit for resync/reshape to be set when array is read-only
    
    Normally we only allow the upper limit for a reshape to be decreased
    when the array not performing a sync/recovery/reshape, otherwise there
    could be races.  But if an array is part-way through a reshape when it
    is assembled the reshape is started immediately leaving no window
    to set an upper bound.
    
    If the array is started read-only, the reshape will be suspended until
    the array becomes writable, so that provides a window during which it
    is perfectly safe to reduce the upper limit of a reshape.
    
    So: allow the upper limit (sync_max) to be reduced even if the reshape
    thread is running, as long as the array is still read-only.
    
    Signed-off-by: NeilBrown <neilb at suse.de>

commit 1a67dde0abba36421a1257d01ba9de2f6d1c160a
Author: NeilBrown <neilb at suse.de>
Date:   Thu Aug 13 10:41:49 2009 +1000

    md/raid5: Properly remove excess drives after shrinking a raid5/6
    
    We were removing the drives, from the array, but not
    removing symlinks from /sys/.... and not marking the device
    as having been removed.
    
    Signed-off-by: NeilBrown <neilb at suse.de>

commit 9799218ae36910af50f002a5db1802d576fffb43
Author: David S. Miller <davem at davemloft.net>
Date:   Wed Aug 12 17:37:52 2009 -0700

    Revert "libertas: Read buffer overflow"
    
    This reverts commit 57921c312e8cef72ba35a4cfe870b376da0b1b87.
    
    On request from John Linville:
    
    	It has been shown to create a new problem.  There is work
    	towards a solution to that one, but it isn't a simple
    	clean-up.
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit a639755cf885e437b2fe4168d35157fa90d530ab
Author: NeilBrown <neilb at suse.de>
Date:   Thu Aug 13 10:13:00 2009 +1000

    md/raid5: make sure a reshape restarts at the correct address.
    
    This "if" don't allow for the possibility that the number of devices
    doesn't change, and so sector_nr isn't set correctly in that case.
    So change '>' to '>='.
    
    Signed-off-by: NeilBrown <neilb at suse.de>

commit 67ac6011db5d2b0c853d573ff474b25c85dfb644
Author: NeilBrown <neilb at suse.de>
Date:   Thu Aug 13 10:06:24 2009 +1000

    md/raid5: allow new reshape modes to be restarted in the middle.
    
    md/raid5 doesn't allow a reshape to restart if it involves writing
    over the same part of disk that it would be reading from.
    This happens at the beginning of a reshape that increases the number
    of devices, at the end of a reshape that decreases the number of
    devices, and continuously for a reshape that does not change the
    number of devices.
    
    The current code is correct for the "increase number of devices"
    case as the critical section at the start is handled by userspace
    performing a backup.
    
    It does not work for reducing the number of devices, or the
    no-change case.
    For 'reducing', we need to invert the test.  For no-change we cannot
    really be sure things will be safe, so simply require the array
    to be read-only, which is how the user-space code which carefully
    starts such arrays works.
    
    Signed-off-by: NeilBrown <neilb at suse.de>

commit 51d5668cb2e3fd1827a55184e48606fff054c5be
Author: NeilBrown <neilb at suse.de>
Date:   Thu Aug 13 09:54:02 2009 +1000

    md: never advance 'events' counter by more than 1.
    
    When assembling arrays, md allows two devices to have different event
    counts as long as the difference is only '1'.  This is to cope with
    a system failure between updating the metadata on two difference
    devices.
    
    However there are currently times when we update the event count by
    2.  This was done to keep the event count even when the array is clean
    and odd when it is dirty, which allows us to avoid writing common
    update to spare devices and so allow those spares to go to sleep.
    
    This is bad for the above reason.  So change it to never increase by
    two.  This means that the alignment between 'odd/even' and
    'clean/dirty' might take a little longer to attain, but that is only a
    small cost.  The spares will get a few more updates but that will
    still be spared (;-) most updates and can still go to sleep.
    
    Prior to this patch there was a small chance that after a crash an
    array would fail to assemble due to the overly large event count
    mismatch.
    
    Signed-off-by: NeilBrown <neilb at suse.de>

commit a3620f7545344f932873bf98fbdf416b49409c8e
Merge: 78efd1ddd95d2fac1ed8d5fadd9dab885ea70e55 39cbb602b543e477df71dca84b5b2e36f8bd29fc
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Aug 12 09:55:46 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block
    
    * 'for-linus' of git://git.kernel.dk/linux-2.6-block:
      Remove double removal of blktrace directory

commit 39cbb602b543e477df71dca84b5b2e36f8bd29fc
Author: Alan D. Brunelle <alan.brunelle at hp.com>
Date:   Fri Aug 7 12:01:08 2009 -0400

    Remove double removal of blktrace directory
    
    commit fd51d251e4cdb21f68e9dbc4336514d64a105a79
    Author: Stefan Raspl <raspl at linux.vnet.ibm.com>
    Date:   Tue May 19 09:59:08 2009 +0200
    
        blktrace: remove debugfs entries on bad path
    
    added in an explicit invocation of debugfs_remove for bt->dir, in
    blk_remove_buf_file_callback we are also getting the directory removed. On
    occasion I am seeing memory corruption that I have bisected down to
    this commit. [The testing involves a (long) series of I/O benchmarks
    with blktrace invoked around the actual runs.] I believe that this
    committed patch is correct, but the problem actually lies in the code
    in blk_remove_buf_file_callback.
    
    With this patch I am able to consistently get complete runs whereas
    previously I could not get a single run to complete.
    
    The first part of the patch simply moves the debugfs_remove below the
    relay_close: the relay_close call will remove files under bt->dir, and
    so we should not remove the directory until all the files we created
    have been removed. (Note: This is not sufficient to fix the problem -
    the file system code has ref counts on the directoy, so our invocation
    does not cause the directory to actually be removed. Nonetheless, we
    should not rely upon that feature.)
    
    Signed-off-by: Alan D. Brunelle <alan.brunelle at hp.com>
    Signed-off-by: Jens Axboe <jens.axboe at oracle.com>

commit 78efd1ddd95d2fac1ed8d5fadd9dab885ea70e55
Merge: b637dc0dba6a243da2c74f5d02b42ba5eeb9425e a8914f3a6d72c97328597a556a99daaf5cc288ae
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Aug 12 08:49:35 2009 -0700

    Merge branch 'for-linus' of git://oss.sgi.com/xfs/xfs
    
    * 'for-linus' of git://oss.sgi.com/xfs/xfs:
      xfs: fix spin_is_locked assert on uni-processor builds
      xfs: check for dinode realtime flag corruption
      use XFS_CORRUPTION_ERROR in xfs_btree_check_sblock
      xfs: switch to NOFS allocation under i_lock in xfs_attr_rmtval_get
      xfs: switch to NOFS allocation under i_lock in xfs_readlink_bmap
      xfs: switch to NOFS allocation under i_lock in xfs_attr_rmtval_set
      xfs: switch to NOFS allocation under i_lock in xfs_buf_associate_memory
      xfs: switch to NOFS allocation under i_lock in xfs_dir_cilookup_result
      xfs: switch to NOFS allocation under i_lock in xfs_da_buf_make
      xfs: switch to NOFS allocation under i_lock in xfs_da_state_alloc
      xfs: switch to NOFS allocation under i_lock in xfs_getbmap
      xfs: avoid memory allocation under m_peraglock in growfs code

commit b637dc0dba6a243da2c74f5d02b42ba5eeb9425e
Merge: 42c5c8435e8b7da4684607587d2c882d464cfc7d 8884be98bcfa656febd24bd18fe8bececbf81251
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Aug 12 08:32:47 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
      ALSA: hda - Don't override ADC definitions for ALC codecs
      ALSA: hda - Add missing vmaster initialization for ALC269
      ASoC: Add missing DRV_NAME definitions for fsl/* drivers

commit 42c5c8435e8b7da4684607587d2c882d464cfc7d
Merge: 9256a2d0b1a36906656405adf564f03ab2d2f3e9 67fe0688082509c52bd451d10a61b3565169c23e
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Aug 12 08:29:32 2009 -0700

    Merge branch 'zerolen' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/misc-2.6
    
    * 'zerolen' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/misc-2.6:
      Remove zero-length file drivers/mtd/maps/sbc8240.c

commit 9256a2d0b1a36906656405adf564f03ab2d2f3e9
Merge: 1ae88b2e446261c038f2c0c3150ffae142b227a2 5594639aab8b5614cb27a3e5b2b627505cbcd137
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Wed Aug 12 08:24:17 2009 -0700

    Merge branch 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev
    
    * 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
      ahci: add workaround for on-board 5723s on some gigabyte boards
      ahci: Soften up the dmesg on SB600 PMP softreset failure recovery
      Documentation/kernel-parameters.txt: document libata's ignore_hpa option
      sata_nv: MSI support, disabled by default
      libata: OCZ Vertex can't do HPA
      pata_atiixp: fix second channel support
      pata_at91: fix resource release

commit 1ae88b2e446261c038f2c0c3150ffae142b227a2
Author: Trond Myklebust <Trond.Myklebust at netapp.com>
Date:   Wed Aug 12 09:12:30 2009 -0400

    NFS: Fix an O_DIRECT Oops...
    
    We can't call nfs_readdata_release()/nfs_writedata_release() without
    first initialising and referencing args.context. Doing so inside
    nfs_direct_read_schedule_segment()/nfs_direct_write_schedule_segment()
    causes an Oops.
    
    We should rather be calling nfs_readdata_free()/nfs_writedata_free() in
    those cases.
    
    Looking at the O_DIRECT code, the "struct nfs_direct_req" is already
    referencing the nfs_open_context for us. Since the readdata and writedata
    structures carry a reference to that, we can simplify things by getting rid
    of the extra nfs_open_context references, so that we can replace all
    instances of nfs_readdata_release()/nfs_writedata_release().
    
    Reported-by: Catalin Marinas <catalin.marinas at arm.com>
    Signed-off-by: Trond Myklebust <Trond.Myklebust at netapp.com>
    Tested-by: Catalin Marinas <catalin.marinas at arm.com>
    Cc: stable at kernel.org
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 04da8a43da804723a550f00dd158fd5b5e25ae35
Author: Ingo Molnar <mingo at elte.hu>
Date:   Tue Aug 11 10:40:08 2009 +0200

    perf_counter, x86: Fix/improve apic fallback
    
    Johannes Stezenbach reported that his Pentium-M based
    laptop does not have the local APIC enabled by default,
    and hence perfcounters do not get initialized.
    
    Add a fallback for this case: allow non-sampled counters
    and return with an error on sampled counters. This allows
    'perf stat' to work out of box - and allows 'perf top'
    and 'perf record' to fall back on a hrtimer based sampling
    method.
    
    ( Passing 'lapic' on the boot line will allow hardware
      sampling to occur - but if the APIC is disabled
      permanently by the hardware then this fallback still
      allows more systems to use perfcounters. )
    
    Also decouple perfcounter support from X86_LOCAL_APIC.
    
    -v2: fix typo breaking counters on all other systems ...
    
    Reported-by: Johannes Stezenbach <js at sig21.net>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    LKML-Reference: <new-submission>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 0a5ac84650fb7a7f226814103d95724e34b012ae
Author: Jens Axboe <jens.axboe at oracle.com>
Date:   Wed Aug 12 11:18:01 2009 +0200

    perf record: Add missing -C option support for specifying profile cpu
    
    perf top supports a -C for setting the profile CPU, but perf
    record does not. This adds the same option for perf record,
    allowing the user to specify a specific target profile CPU.
    
    Signed-off-by: Jens Axboe <jens.axboe at oracle.com>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    LKML-Reference: <20090812091801.GC12579 at kernel.dk>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 1340e6bbaff7ff7f6f75eb4a5c34933efce84a84
Author: Arnaldo Carvalho de Melo <acme at redhat.com>
Date:   Tue Aug 11 17:04:36 2009 -0300

    perf tools: Fix dso__new handle() to handle deleted DSOs
    
    It is better than showing the map addr, this way at least we
    know that we can't get the symtabs because the DSO was deleted
    (system update) while an app still used such DSO.
    
    Yeah, don't do that, but if you do, you'll figure it out
    quicker this way.
    
    [acme at doppio linux-2.6-tip]$ perf report | head -15
     # Samples: 3796
     #
     # Overhead  Command                                                        Shared Object  Symbol
     # ........  .......  ...................................................................  ......
     #
        23.55%   pidgin  /lib64/libglib-2.0.so.0.2000.4.#prelink#.Pd98lu (deleted)            [.] 0x00000000038844
        21.55%   pidgin  /lib64/libpthread-2.10.1.so.#prelink#.AFwK8Q (deleted)               [.] 0x0000000000a42d
        10.85%   pidgin  [kernel]                                                             [.] vread_hpet
         7.85%   pidgin  /lib64/libgobject-2.0.so.0.2000.4.#prelink#.o1vpU7 (deleted)         [.] 0x00000000014de8
         3.35%   pidgin  /lib64/libc-2.10.1.so (deleted)                                      [.] 0x0000000007a875
         3.19%   pidgin  /lib64/libdbus-1.so.3.4.0.#prelink#.6mwgZP (deleted)                 [.] 0x0000000001d254
         3.06%   pidgin  /usr/lib64/libgtk-x11-2.0.so.0.1600.5.#prelink#.511hAl (deleted)     [.] 0x000000002334e7
         2.90%   pidgin  /usr/lib64/libgdk-x11-2.0.so.0.1600.5.#prelink#.5qlMo1 (deleted)     [.] 0x00000000037b2d
         1.84%   pidgin  [kernel]                                                             [k] do_sys_poll
         1.45%   pidgin  /usr/lib64/libX11.so.6.2.0.#prelink#.iR59Rx (deleted)                [.] 0x0000000004c751
    [acme at doppio linux-2.6-tip]$
    
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Luis Claudio R. Gonçalves <lclaudio at redhat.com>
    Cc: Clark Williams <williams at redhat.com>
    Cc: H. Peter Anvin <hpa at zytor.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Frédéric Weisbecker <fweisbec at gmail.com>
    LKML-Reference: <20090811200436.GA3478 at ghostprotocols.net>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 247648e3742ded01e42a4b14c2da330b13cbb47f
Author: Arnaldo Carvalho de Melo <acme at redhat.com>
Date:   Tue Aug 11 16:22:11 2009 -0300

    perf tools: Fix fallback to cplus_demangle() when bfd_demangle() is not available
    
    In old binutils we can't access bfd_demangle(), use
    cplus_demangle() just like oprofile.
    
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Luis Claudio R. Gonçalves <lclaudio at redhat.com>
    Cc: H. Peter Anvin <hpa at zytor.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Frédéric Weisbecker <fweisbec at gmail.com>
    LKML-Reference: <20090811192211.GG18061 at ghostprotocols.net>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 94a24752fe95ca1e7f98b197052d44e6a207740d
Author: Arnaldo Carvalho de Melo <acme at redhat.com>
Date:   Tue Aug 11 16:21:38 2009 -0300

    perf report: Show the tid too in -D
    
    This made it easier to find the firefox threading related
    bug.
    
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: "H. Peter Anvin" <hpa at zytor.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Frédéric Weisbecker <fweisbec at gmail.com>
    LKML-Reference: <20090811192138.GE18061 at ghostprotocols.net>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 2a8083f063472f27c253545dd64e1a7bbbb1ab61
Author: Arnaldo Carvalho de Melo <acme at redhat.com>
Date:   Tue Aug 11 16:22:00 2009 -0300

    perf record: Fix .tid and .pid fill-in when synthesizing events
    
    Noticed when trying to record events for a firefox thread. We
    were synthesizing both .tid and .pid with the pid passed via
    --pid.
    
    Fix it by reading /proc/PID/status and getting the tgid
    to use in .pid, .tid gets the specified "pid".
    
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: "H. Peter Anvin" <hpa at zytor.com>
    Cc: Frédéric Weisbecker <fweisbec at gmail.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Mike Galbraith <efault at gmx.de>
    LKML-Reference: <20090811192200.GF18061 at ghostprotocols.net>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 67fe0688082509c52bd451d10a61b3565169c23e
Author: Jeff Garzik <jeff at garzik.org>
Date:   Wed Aug 12 06:29:57 2009 -0400

    Remove zero-length file drivers/mtd/maps/sbc8240.c
    
    It was "deleted" in commit 2bf961b7ccd69e108ac435c67e2b0522b403c578
    
    Signed-off-by: Jeff Garzik <jgarzik at redhat.com>

commit 5594639aab8b5614cb27a3e5b2b627505cbcd137
Author: Tejun Heo <tj at kernel.org>
Date:   Tue Aug 4 14:30:08 2009 +0900

    ahci: add workaround for on-board 5723s on some gigabyte boards
    
    Some gigabytes have on-board SIMG5723s connected to JMB ahcis.  These
    are used to implement hardware raid.  Unfortunately some firmware
    revisions on these 5723s don't bring the link down when all the
    downstream ports are unoccupied while not responding to reset protocol
    which makes libata think that there's device attached to the port but
    is not responding and retry.  This results in painfully wrong boot
    detection time for these ports when they're empty.
    
    This patch quirks those boards such that ahci gives up after the
    initial timeout.  Combined with parallel probing, this gives quick
    enough probing and also is safe because SIMG5723 will respond to the
    first try if any of the downstream ports is occupied.
    
    Signed-off-by: Tejun Heo <tj at kernel.org>
    Reported-by: Marc Bowes <marcbowes at gmail.com>
    Reported-by: Nicolas Mailhot <Nicolas.Mailhot at LaPoste.net>
    Signed-off-by: Jeff Garzik <jgarzik at redhat.com>

commit b6931c1fbaf7fda9ea7f120228a96600d7090049
Author: Shane Huang <shane.huang at amd.com>
Date:   Wed Aug 5 10:10:41 2009 +0800

    ahci: Soften up the dmesg on SB600 PMP softreset failure recovery
    
    Too strong words led to spurious bug reports: Novell bugzilla #527748,
    RedHat bugzilla #468800. This patch is used to soften up the dmesg on
    SB600 PMP softreset failure recovery, so as to remove the scariness and
    concern from community.
    
    Reported-by: pgnet Dev <pgnet.dev at gmail.com>
    Signed-off-by: Shane Huang <shane.huang at amd.com>
    Cc: Tejun Heo <tj at kernel.org>
    Signed-off-by: Jeff Garzik <jgarzik at redhat.com>

commit 20308871588518b5e209c403de2a3ad9a2eba9af
Author: Michael Prokop <mika at grml.org>
Date:   Thu Aug 6 00:14:10 2009 +0200

    Documentation/kernel-parameters.txt: document libata's ignore_hpa option
    
    By default the kernel honors the HPA (host protected area) of hard
    drives.  Using libata's ignore_hpa module option it's possible to
    change this behaviour.
    
    Document usage and options of libata.ignore_hpa in
    Documentation/kernel-parameters.txt.
    
    Signed-off-by: Michael Prokop <mika at grml.org>
    Signed-off-by: Jeff Garzik <jgarzik at redhat.com>

commit 51c8949950647afeeb897e08dd75ad99078adb50
Author: Tony Vroon <tony at linx.net>
Date:   Thu Aug 6 00:50:09 2009 +0100

    sata_nv: MSI support, disabled by default
    
    At least the nVidia MCP55 controller quite happily supports MSI.
    This adds an option to use it. It is disabled by default.
    As per feedback by Robert Hancock, it will honour the user
    request as the kernel will not enable MSI where the controller
    or the specific system configuration do not support it.
    
    Signed-off-by: Tony Vroon <tony at linx.net>
    Cc: Robert Hancock <hancockrwd at gmail.com>
    Signed-off-by: Jeff Garzik <jgarzik at redhat.com>

commit 7831387bda72af3059be48d39846d3eb6d8ce2f6
Author: Tejun Heo <tj at kernel.org>
Date:   Fri Aug 7 01:59:15 2009 +0900

    libata: OCZ Vertex can't do HPA
    
    OCZ Vertex SSD can't do HPA and not in a usual way.  It reports HPA,
    allows unlocking but then fails all IOs which fall in the unlocked
    area.  Quirk it so that HPA unlocking is not used for the device.
    
    Reported by Daniel Perup in bnc#522414.
    
     https://bugzilla.novell.com/show_bug.cgi?id=522414
    
    Signed-off-by: Tejun Heo <tj at kernel.org>
    Reported-by: Daniel Perup <probe at spray.se>
    Signed-off-by: Jeff Garzik <jgarzik at redhat.com>

commit 1fd4bbec8c0d6db96b02141f324066afa2e77e89
Author: Bartlomiej Zolnierkiewicz <bzolnier at gmail.com>
Date:   Thu Aug 6 17:47:05 2009 +0200

    pata_atiixp: fix second channel support
    
    PIO and MWDMA timings are never programmed for the second channel
    because timing registers are treated as 16-bit long ones.
    
    The bug is an attixp -> pata_atiixp regression and goes back to:
    
    	commit 669a5db411d85a14f86cd92bc16bf7ab5b8aa235
    	Author: Jeff Garzik <jeff at garzik.org>
    	Date:   Tue Aug 29 18:12:40 2006 -0400
    
    	    [libata] Add a bunch of PATA drivers.
    
    Cc: Krystian Juskowiak <jusko at tlen.pl>
    Cc: Andrew Morton <akpm at linux-foundation.org>
    Cc: Borislav Petkov <bbpetkov at yahoo.de>
    Cc: Robert Hancock <hancockrwd at gmail.com>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier at gmail.com>
    Signed-off-by: Jeff Garzik <jgarzik at redhat.com>

commit df9eba8c9febf53782ef896518e7177999d98188
Author: Tejun Heo <tj at kernel.org>
Date:   Fri Aug 7 11:15:20 2009 +0900

    pata_at91: fix resource release
    
    Julias Lawall discovered that pata_at91 wasn't freeing a memory region
    allocated with kzalloc() on init failure paths.  Upon review,
    pata_at91 also seems to be doing unnecessary explicit resource
    releases for managed resources too.  Convert memory allocation to
    managed one and drop unnecessary explicit resource releases.
    
    Signed-off-by: Tejun Heo <tj at kernel.org>
    Cc: Julia Lawall <julia at diku.dk>
    Cc: Sergey Matyukevich <geomatsi at gmail.com>
    Signed-off-by: Jeff Garzik <jgarzik at redhat.com>

commit e8055139d996e85722984968472868d6dccb1490
Author: Ondrej Zary <linux at rainbow-software.org>
Date:   Tue Aug 11 20:00:11 2009 +0200

    x86: Fix oops in identify_cpu() on CPUs without CPUID
    
    Kernel is broken for x86 CPUs without CPUID since 2.6.28. It
    crashes with NULL pointer dereference in identify_cpu():
    
    766        generic_identify(c);
    767
    768-->     if (this_cpu->c_identify)
    769               this_cpu->c_identify(c);
    
    this_cpu is NULL. This is because it's only initialized in
    get_cpu_vendor() function, which is not called if the CPU has
    no CPUID instruction.
    
    Signed-off-by: Ondrej Zary <linux at rainbow-software.org>
    LKML-Reference: <200908112000.15993.linux at rainbow-software.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit ec8b4b7085605e801a7740a2c3c33256aebe249c
Author: Stephen Kitt <steve at sk2.org>
Date:   Wed Aug 12 01:12:08 2009 -0700

    Input: joydev - decouple axis and button map ioctls from input constants
    
    The KEY_MAX change in 2.6.28 changed the values of the JSIOCSBTNMAP and
    JSIOCGBTNMAP constants; software compiled with the old values no longer
    works with kernels following 2.6.28, because the ioctl switch statement
    no longer matches the values given by the software. This patch handles
    these ioctls independently of the length of data specified, and applies the
    same treatment to JSIOCSAXMAP and JSIOCGAXMAP which currently depend on
    ABS_MAX.
    
    Signed-off-by: Stephen Kitt <steve at sk2.org>
    Signed-off-by: Dmitry Torokhov <dtor at mail.ru>

commit a8914f3a6d72c97328597a556a99daaf5cc288ae
Author: Christoph Hellwig <hch at lst.de>
Date:   Mon Aug 10 11:32:44 2009 -0300

    xfs: fix spin_is_locked assert on uni-processor builds
    
    Without SMP or preemption spin_is_locked always returns false,
    so we can't do an assert with it.  Instead use assert_spin_locked,
    which does the right thing on all builds.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Eric Sandeen <sandeen at sandeen.net>
    Reported-by: Johannes Engel <jcnengel at googlemail.com>
    Tested-by: Johannes Engel <jcnengel at googlemail.com>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit b89d4208de3de442c9025919c4261be0b38e79a4
Author: Christoph Hellwig <hch at lst.de>
Date:   Mon Aug 10 11:32:18 2009 -0300

    xfs: check for dinode realtime flag corruption
    
    Ramon tested XFS with a modified version of fsfuzzer and hit a NULL
    pointer dereference in __xfs_get_blocks due to the RT device target
    pointer being NULL.
    
    To fix this reject inode with the realtime bit set on a a filesystem
    without an RT subvolume during inode read.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Eric Sandeen <sandeen at sandeen.net>
    Reviewed-by: Felix Blyakher <felixb at sgi.com>
    Reported-by: Ramon de Carvalho Valle <ramon at risesecurity.org>
    Tested-by: Ramon de Carvalho Valle <ramon at risesecurity.org>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit e0c222c411e22f086e929cd69fdcc89336164ec1
Author: Eric Sandeen <sandeen at sandeen.net>
Date:   Mon Jul 20 10:52:15 2009 -0500

    use XFS_CORRUPTION_ERROR in xfs_btree_check_sblock
    
    In Red Hat Bug 512552
     - Can't write to XFS mount during raid5 resync
    
    a user ran into corruption while resyncing a raid, and we failed
    a consistency test, but didn't get much more info; it'd be nice
    to call XFS_CORRUPTION_ERROR here so we can see the buffer
    contents.
    
    Signed-off-by: Eric Sandeen <sandeen at sandeen.net>
    Reviewed-by: Christoph Hellwig <hch at lst.de>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit ddd3a14e0f030f0f7b900621f67532285b8657ef
Author: Christoph Hellwig <hch at infradead.org>
Date:   Sat Jul 18 18:15:01 2009 -0400

    xfs: switch to NOFS allocation under i_lock in xfs_attr_rmtval_get
    
    xfs_attr_rmtval_get is always called with i_lock held, but i_lock is taken
    in reclaim context so all allocations under it must avoid recursions into
    the filesystem.
    
    Reported by the new reclaim context tracing in lockdep.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Felix Blyakher <felixb at sgi.com>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit 7b02ecb3031b192823bc732ae717febc0a59aa92
Author: Christoph Hellwig <hch at infradead.org>
Date:   Sat Jul 18 18:15:00 2009 -0400

    xfs: switch to NOFS allocation under i_lock in xfs_readlink_bmap
    
    xfs_readlink_bmap is called with i_lock held, but i_lock is taken in
    reclaim context so all allocations under it must avoid recursions into
    the filesystem.
    
    Reported by the new reclaim context tracing in lockdep.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Felix Blyakher <felixb at sgi.com>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit 10746e47e722b5688fcd6eba9fbf9b2e64a248a7
Author: Christoph Hellwig <hch at infradead.org>
Date:   Sat Jul 18 18:14:59 2009 -0400

    xfs: switch to NOFS allocation under i_lock in xfs_attr_rmtval_set
    
    xfs_attr_rmtval_set is always called with i_lock held, and i_lock is taken
    in reclaim context so all allocations under it must avoid recursions into
    the filesystem.
    
    Reported by the new reclaim context tracing in lockdep.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Felix Blyakher <felixb at sgi.com>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit 36fae17a648e0aee5d9560514d08477ef48dc87f
Author: Christoph Hellwig <hch at infradead.org>
Date:   Sat Jul 18 18:14:58 2009 -0400

    xfs: switch to NOFS allocation under i_lock in xfs_buf_associate_memory
    
    xfs_buf_associate_memory is used for setting up the spare buffer for the
    log wrap case in xlog_sync which can happen under i_lock when called from
    xfs_fsync. The i_lock mutex is taken in reclaim context so all allocations
    under it must avoid recursions into the filesystem.  There are a couple
    more uses of xfs_buf_associate_memory in the log recovery code that are
    also affected by this, but I'd rather keep the code simple than passing on
    a gfp_mask argument.  Longer term we should just stop requiring the memoery
    allocation in xlog_sync by some smaller rework of the buffer layer.
    
    Reported by the new reclaim context tracing in lockdep.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Felix Blyakher <felixb at sgi.com>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit 3f52c2f0a07c23771909cc53f2e9451a7f1bf253
Author: Christoph Hellwig <hch at infradead.org>
Date:   Sat Jul 18 18:14:57 2009 -0400

    xfs: switch to NOFS allocation under i_lock in xfs_dir_cilookup_result
    
    xfs_dir_cilookup_result is always called with i_lock held, but i_lock is taken
    in reclaim context so all allocations under it must avoid recursions into the
    filesystem.
    
    Reported by the new reclaim context tracing in lockdep.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Felix Blyakher <felixb at sgi.com>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit 73195ed7864ae4a1fb0bea2ed9df59d19b4fde90
Author: Christoph Hellwig <hch at infradead.org>
Date:   Sat Jul 18 18:14:56 2009 -0400

    xfs: switch to NOFS allocation under i_lock in xfs_da_buf_make
    
    i_lock is taken in the reclaim context so all allocations under it
    must avoid recursions into the filesystem.
    
    Reported by the new reclaim context tracing in lockdep.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Felix Blyakher <felixb at sgi.com>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit f41d7fb9da05b604f8a69fb6cac2a0563c8ede4e
Author: Christoph Hellwig <hch at infradead.org>
Date:   Sat Jul 18 18:14:55 2009 -0400

    xfs: switch to NOFS allocation under i_lock in xfs_da_state_alloc
    
    xfs_da_state_alloc is always called with i_lock held, but i_lock is taken in
    reclaim context so all allocations under it must avoid recursions into the
    filesystem.
    
    Reported by the new reclaim context tracing in lockdep.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Felix Blyakher <felixb at sgi.com>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit ca35dcd6cae7d4a780c484c53f45548c4719f82c
Author: Christoph Hellwig <hch at infradead.org>
Date:   Sat Jul 18 18:14:54 2009 -0400

    xfs: switch to NOFS allocation under i_lock in xfs_getbmap
    
    xfs_getbmap allocates memory with i_lock held, but i_lock is taken in
    reclaim context so all allocations under it must avoid recursions into
    the filesystem.
    
    Reported by the new reclaim context tracing in lockdep.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Felix Blyakher <felixb at sgi.com>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit 0cc6eee130b0c062feec8446d9cecdb17d2cfad3
Author: Christoph Hellwig <hch at infradead.org>
Date:   Sat Jul 18 18:14:53 2009 -0400

    xfs: avoid memory allocation under m_peraglock in growfs code
    
    Allocate the memory for the larger m_perag array before taking the
    per-AG lock as the per-AG lock can be taken under the i_lock which
    can be taken from reclaim context.
    
    Reported by the new reclaim context tracing in lockdep.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Felix Blyakher <felixb at sgi.com>
    Signed-off-by: Felix Blyakher <felixb at sgi.com>

commit 8884be98bcfa656febd24bd18fe8bececbf81251
Merge: 909a2607a5c923bf40a07ab0bfaa78bee775bf55 dd704698f56c1451fc9c5daadcd6e3a089de2c40
Author: Takashi Iwai <tiwai at suse.de>
Date:   Wed Aug 12 08:05:20 2009 +0200

    Merge branch 'fix/hda' into for-linus
    
    * fix/hda:
      ALSA: hda - Don't override ADC definitions for ALC codecs
      ALSA: hda - Add missing vmaster initialization for ALC269

commit 909a2607a5c923bf40a07ab0bfaa78bee775bf55
Merge: 90bc1a658a53f8832ee799685703977a450e5af9 afc5e65245255a268ab22a20477ed2c9f2cdfcd3
Author: Takashi Iwai <tiwai at suse.de>
Date:   Wed Aug 12 08:05:19 2009 +0200

    Merge branch 'fix/asoc' into for-linus
    
    * fix/asoc:
      ASoC: Add missing DRV_NAME definitions for fsl/* drivers

commit 7cb7beb31aa3d941833b6a6e553687422c31e4b6
Merge: 4d9c73f60efe7a76f086bc93f7ef22be9d78bed6 e7369e01eb85550ed60dd1b0e120b69dfb03dc23
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 11 17:06:16 2009 -0700

    Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/fyu/linux-2.6
    
    * 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/fyu/linux-2.6:
      arch/ia64/kernel/iosapic: missing test after ioremap()
      ia64/topology.c: exit cache_add_dev when kobject_init_and_add fails
      arch/ia64/Makefile: Remove -mtune=merced in IA64 kernel build
      IA64: includecheck fix: ia64, pgtable.h
      IA64: includecheck fix: ia64, ia64_ksyms.c
      ia64: boolean __test_and_clear_bit
      Bug Fix arch/ia64/kernel/pci-dma.c: fix recursive dma_supported() call in iommu_dma_supported()

commit e7369e01eb85550ed60dd1b0e120b69dfb03dc23
Author: Roel Kluin <[roel.kluin at gmail.com]>
Date:   Tue Aug 11 14:52:11 2009 -0700

    arch/ia64/kernel/iosapic: missing test after ioremap()
    
    Missing test after ioremap()
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Acked-by: Fenghua Yu <fenghua.yu at intel.com>

commit 5359dffd4396f281c5b77de1acbee6fb1b333b23
Author: Fenghua Yu <fenghua.yu at intel.com>
Date:   Tue Aug 11 14:52:11 2009 -0700

    ia64/topology.c: exit cache_add_dev when kobject_init_and_add fails
    
    Make cache_add_dev exit sysfs when kobject_init_and_add returns an error.
    
    Signed-off-by: Xiaotian Feng <dfeng at redhat.com>
    Signed-off-by: Fenghua Yu <fenghua.yu at intel.com>

commit bf2a4c7270b9a22243a91ab5efcc47aaf997c66b
Author: Fenghua Yu <[fenghua.yu at intel.com]>
Date:   Tue Aug 11 14:52:11 2009 -0700

    arch/ia64/Makefile: Remove -mtune=merced in IA64 kernel build
    
    Between GCC version 3.4.0 and 4.3.3 (including 3.4.0 and 4.3.3), -mtune=merced
    is implemented in GCC. Starting from 4.4.0, -mtune=merced is deprecated.
    
    Even implemented in versions between 3.4.0 and 4.3.3, the -mtune=merced
    feature has been broken in some of the versions. For example, GCC 4.1.2 reports
    interanl tuning function errors during kernel building with -mtune=merced. Or
    GCC Bugzilla 16130 reports another -mtune=merced issue on GCC 3.4.1.
    
    So I would remove the -mtune=merced from IA64 kernel build. Without this option,
    kernel on Merced will remain the same except losing an unstable and out-of-date
    performance tunning feature.
    
    Since GCC version 3.4.0, -mtune=mckinley has been implemented. The
    -mtune=mckinley option functions the same as mtune=itanium2. And mtune=itanium2
    is the default option. So we don't need to add mtune=mckinley either since its
    been the default option in any GCC version which implements this option.
    
    Signed-off-by: Fenghua Yu <fenghua.yu at intel.com>

commit b5a8879347bbe68bd24c8870503bf6a0362da26b
Author: Jaswinder Singh Rajput <[jaswinder at kernel.org]>
Date:   Tue Aug 11 14:52:11 2009 -0700

    IA64: includecheck fix: ia64, pgtable.h
    
    fix the following 'make includecheck' warning:
    
      arch/ia64/include/asm/pgtable.h: asm/processor.h is included more than once.
    
    Signed-off-by: Jaswinder Singh Rajput <jaswinderrajput at gmail.com>
    Acked-by: Fenghua Yu <fenghua.yu at intel.com>

commit cfa5f809e399c699974ba6018eefa022bbc2e16e
Author: Jaswinder Singh Rajput <[jaswinder at kernel.org]>
Date:   Tue Aug 11 14:52:10 2009 -0700

    IA64: includecheck fix: ia64, ia64_ksyms.c
    
    fix the following 'make includecheck' warning:
    
      arch/ia64/kernel/ia64_ksyms.c: asm/page.h is included more than once.
    
    Signed-off-by: Jaswinder Singh Rajput <jaswinderrajput at gmail.com>
    Acked-by: Fenghua Yu <fenghua.yu at intel.com>

commit 8d6f9af91959256244878cd801c1c969e66cd093
Author: Johannes Weiner <[hannes at cmpxchg.org]>
Date:   Tue Aug 11 14:52:10 2009 -0700

    ia64: boolean __test_and_clear_bit
    
    __test_and_clear_bit() returns a bitfield with the tested-for bit set.
    Make it consistent with the other bitops - of ia64 but also every
    other architecture - and return a boolean value.
    
    Signed-off-by: Johannes Weiner <hannes at cmpxchg.org>
    Acked-by: Fenghua Yu <fenghua.yu at intel.com>

commit 51b89f7a6615eca184aa0b85db5781d931e9c8d1
Author: Fenghua Yu <[fenghua.yu at intel.com]>
Date:   Tue Aug 11 14:52:10 2009 -0700

    Bug Fix arch/ia64/kernel/pci-dma.c: fix recursive dma_supported() call in iommu_dma_supported()
    
    In commit 160c1d8e40866edfeae7d68816b7005d70acf391,
    dma_ops->dma_supported = iommu_dma_supported;
    
    This dma_ops->dma_supported is first called in platform_dma_init() during kernel
    boot. Then dma_ops->dma_supported will be called recursively in
    iommu_dma_supported.
    
    Kernel can not boot because kernel can not get out of iommu_dma_supported until
    it runs out of stack memory.
    
    Signed-off-by: Fenghua Yu <fenghua.yu at intel.com>

commit dee2b904a1f93c275a015b67cd693038d74b18e8
Author: Mikael Pettersson <mikpe at it.uu.se>
Date:   Sun Aug 9 21:21:57 2009 +0200

    IXP4xx: Fix IO_SPACE_LIMIT for 2.6.31-rc core PCI changes
    
    2.6.31-rc kernels don't boot on my ixp4xx box (ds101), because the libata
    driver doesn't find the PCI IDE controller any more. 2.6.30 was fine.
    I traced this to a PCI update (1f82de10d6b1d845155363c895c552e61b36b51a)
    in 2.6.30-git19. Diffing the kernel boot logs from 2.6.30-git18 and
    2.6.30-git19 illustrates the breakage:
    
    > --- dmesg-2.6.30-git18	2009-08-04 01:45:22.000000000 +0200
    > +++ dmesg-2.6.30-git19	2009-08-04 01:45:46.000000000 +0200
    > @@ -26,6 +26,13 @@
    >  pci 0000:00:02.2: PME# supported from D0 D1 D2 D3hot
    >  pci 0000:00:02.2: PME# disabled
    >  PCI: bus0: Fast back to back transfers disabled
    > +pci 0000:00:01.0: BAR 0: can't allocate I/O resource [0x10000-0xffff]
    > +pci 0000:00:01.0: BAR 1: can't allocate I/O resource [0x10000-0xffff]
    > +pci 0000:00:01.0: BAR 2: can't allocate I/O resource [0x10000-0xffff]
    > +pci 0000:00:01.0: BAR 3: can't allocate I/O resource [0x10000-0xffff]
    > +pci 0000:00:01.0: BAR 4: can't allocate I/O resource [0x10000-0xffff]
    > +pci 0000:00:02.0: BAR 4: can't allocate I/O resource [0x10000-0xffff]
    > +pci 0000:00:02.1: BAR 4: can't allocate I/O resource [0x10000-0xffff]
    >  bio: create slab <bio-0> at 0
    >  SCSI subsystem initialized
    >  NET: Registered protocol family 2
    > @@ -44,11 +51,7 @@
    >  console [ttyS0] enabled
    >  serial8250.0: ttyS1 at MMIO 0xc8001000 (irq = 13) is a XScale
    >  Driver 'sd' needs updating - please use bus_type methods
    > -PCI: enabling device 0000:00:01.0 (0140 -> 0141)
    > -scsi0 : pata_artop
    > -scsi1 : pata_artop
    > -ata1: PATA max UDMA/100 cmd 0x1050 ctl 0x1060 bmdma 0x1040 irq 28
    > -ata2: PATA max UDMA/100 cmd 0x1058 ctl 0x1064 bmdma 0x1048 irq 28
    > +pata_artop 0000:00:01.0: no available native port
    >  Using configured DiskOnChip probe address 0x50000000
    >  DiskOnChip found at 0x50000000
    >  NAND device: Manufacturer ID: 0x98, Chip ID: 0x73 (Toshiba NAND 16MiB 3,3V 8-bit)
    
    The specific change in 1f82de10d6b1d845155363c895c552e61b36b51a responsible
    for this failure turned out to be the following:
    
    > --- a/drivers/pci/probe.c
    > +++ b/drivers/pci/probe.c
    > @@ -193,7 +193,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
    >  		res->flags |= pci_calc_resource_flags(l) | IORESOURCE_SIZEALIGN;
    >  		if (type == pci_bar_io) {
    >  			l &= PCI_BASE_ADDRESS_IO_MASK;
    > -			mask = PCI_BASE_ADDRESS_IO_MASK & 0xffff;
    > +			mask = PCI_BASE_ADDRESS_IO_MASK & IO_SPACE_LIMIT;
    >  		} else {
    >  			l &= PCI_BASE_ADDRESS_MEM_MASK;
    >  			mask = (u32)PCI_BASE_ADDRESS_MEM_MASK;
    
    Every arch except arm's ixp4xx defines IO_SPACE_LIMIT as an all-bits-one
    bitmask, typically -1UL but sometimes only a 16-bit 0x0000ffff. But ixp4xx
    defines it as 0xffff0000, which is now causing the PCI failures.
    
    Russell King noted that ixp4xx has 64KB PCI IO space, so IO_SPACE_LIMIT
    should be 0x0000ffff. This patch makes that change, which fixes the PCI
    failures on my ixp4xx box.
    
    Signed-off-by: Mikael Pettersson <mikpe at it.uu.se>
    Signed-off-by: Krzysztof Hałasa <khc at pm.waw.pl>

commit fbd8b1819e80ac5a176d085fdddc3a34d1499318
Author: Kevin Winchester <kjwinchester at gmail.com>
Date:   Mon Aug 10 19:56:45 2009 -0300

    x86: Clear incorrectly forced X86_FEATURE_LAHF_LM flag
    
    Due to an erratum with certain AMD Athlon 64 processors, the
    BIOS may need to force enable the LAHF_LM capability.
    Unfortunately, in at least one case, the BIOS does this even
    for processors that do not support the functionality.
    
    Add a specific check that will clear the feature bit for
    processors known not to support the LAHF/SAHF instructions.
    
    Signed-off-by: Kevin Winchester <kjwinchester at gmail.com>
    Acked-by: Borislav Petkov <petkovbb at googlemail.com>
    LKML-Reference: <4A80A5AD.2000209 at gmail.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit f64ccccb8afa43abdd63fcbd230f818d6ea0883f
Author: Ingo Molnar <mingo at elte.hu>
Date:   Tue Aug 11 10:26:33 2009 +0200

    perf_counter, x86: Fix generic cache events on P6-mobile CPUs
    
    Johannes Stezenbach reported that 'perf stat' does not count
    cache-miss and cache-references events on his Pentium-M based
    laptop.
    
    This is because we left them blank in p6_perfmon_event_map[],
    fill them in.
    
    Reported-by: Johannes Stezenbach <js at sig21.net>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    LKML-Reference: <new-submission>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 3c581a7f94542341bf0da496a226b44ac63521a8
Author: Ingo Molnar <mingo at elte.hu>
Date:   Tue Aug 11 10:47:36 2009 +0200

    perf_counter, x86: Fix lapic printk message
    
    Instead of this garbled bootup on UP Pentium-M systems:
    
    [    0.015048] Performance Counters:
    [    0.016004] no Local APIC, try rebooting with lapicno PMU driver, software counters only.
    
    Print:
    
    [    0.015050] Performance Counters:
    [    0.016004] no APIC, boot with the "lapic" boot parameter to force-enable it.
    [    0.017003] no PMU driver, software counters only.
    
    Cf: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    LKML-Reference: <new-submission>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 0d01f31439c1e4d602bf9fdc924ab66f407f5e38
Author: Dmitry Torokhov <dmitry.torokhov at gmail.com>
Date:   Sun Aug 9 21:44:49 2009 -0700

    x86, mce: therm_throt - change when we print messages
    
    My Latitude d630 seems to be handling thermal events in SMI by
    lowering the max frequency of the CPU till it cools down but
    still leaks the "everything is normal" events.
    
    This spams the console and with high priority printks.
    
    Adjust therm_throt driver to only print messages about the fact
    that temperatire returned back to normal when leaving the
    throttling state.
    
    Also lower the severity of "back to normal" message from
    KERN_CRIT to KERN_INFO.
    
    Signed-off-by: Dmitry Torokhov <dtor at mail.ru>
    Acked-by: H. Peter Anvin <hpa at zytor.com>
    LKML-Reference: <20090810051513.0558F526EC9 at mailhub.coreip.homeip.net>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit dd704698f56c1451fc9c5daadcd6e3a089de2c40
Author: Takashi Iwai <tiwai at suse.de>
Date:   Tue Aug 11 08:45:11 2009 +0200

    ALSA: hda - Don't override ADC definitions for ALC codecs
    
    ALC269 and ALC861-VD parsers override the ADC definitions
    unconditionally without checking the spec definition.  This causes
    the problem when any inconsistent ADC is set up in the device quirk
    (like ALC272 with digital-mic).
    
    This patch avoids the overriding by adding the proper checks.
    
    Reference: Novell bnc#529467
    	https://bugzilla.novell.com/show_bug.cgi?id=529467
    
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

commit 4d9c73f60efe7a76f086bc93f7ef22be9d78bed6
Merge: 651b1f125c7e3806bbd635739d009433dc07372d 314dabb83a547ec4da819e8cbc78fac9cec605cd
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 10 19:25:00 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
      SELinux: fix memory leakage in /security/selinux/hooks.c

commit 314dabb83a547ec4da819e8cbc78fac9cec605cd
Author: James Morris <jmorris at namei.org>
Date:   Mon Aug 10 22:00:13 2009 +1000

    SELinux: fix memory leakage in /security/selinux/hooks.c
    
    Fix memory leakage in /security/selinux/hooks.c
    
    The buffer always needs to be freed here; we either error
    out or allocate more memory.
    
    Reported-by: iceberg <strakh at ispras.ru>
    Signed-off-by: James Morris <jmorris at namei.org>
    Acked-by:  Stephen Smalley <sds at tycho.nsa.gov>

commit 651b1f125c7e3806bbd635739d009433dc07372d
Author: Magnus Damm <damm at igel.co.jp>
Date:   Mon Aug 10 23:41:18 2009 +0200

    PM / Driver Core: Kill dev_pm_ops platform warning for now
    
    Commit 783ea7d4eeefe895f2731fe73ac951e94418927b
    (Driver Core: Rework platform suspend/resume, print warning)
    added a warning message printed for platform drivers that use the
    legacy PM callbacks rather than struct dev_pm_ops.  Unfortunately,
    this resulted in some confusion and made some people try to convert
    drivers by replacing the old callbacks with struct dev_pm_ops in
    automatic way, which generally is not a good idea.
    
    Remove the platform device runtime dev_pm_ops warning for now,
    because it's annoying to users and it's not really necessary right
    now.
    
    [rjw: Modified the changelog to be more informative.]
    
    Signed-off-by: Magnus Damm <damm at igel.co.jp>
    Acked-by: Greg Kroah-Hartman <gregkh at suse.de>
    Signed-off-by: Rafael J. Wysocki <rjw at sisk.pl>

commit e9d126cdfa60b575f1b5b02024c4faee27dccf07
Author: Dan Carpenter <error27 at gmail.com>
Date:   Sun Aug 9 14:24:09 2009 +0200

    ar9170: fix read & write outside array bounds
    
    queue == __AR9170_NUM_TXQ would cause a bug on the next line.
    
    found by Smatch ( http://repo.or.cz/w/smatch.git ).
    
    Cc: stable at kernel.org
    Reported-by: Dan Carpenter <error27 at gmail.com>
    Signed-off-by: Dan Carpenter <error27 at gmail.com>
    Signed-off-by: Christian Lamparter <chunkeey at web.de>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit 363ec5614f86110c6a6bdd72ac2147ebafd3ff5e
Author: Christian Lamparter <chunkeey at web.de>
Date:   Sat Aug 8 17:09:48 2009 +0200

    ar9170usb: fix spurious firmware related message
    
    When ar9170-2.fw was missing, the driver erroneously complained
    about missing the initialization values file ar9170-1.fw...
    
    Signed-off-by: Christian Lamparter <chunkeey at web.de>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit 85dfd81dc57e8183a277ddd7a56aa65c96f3f487
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 10 13:21:19 2009 -0700

    pty: fix data loss when stopped (^S/^Q)
    
    Commit d945cb9cc ("pty: Rework the pty layer to use the normal buffering
    logic") dropped the test for 'tty->stopped' in pty_write_room(), which
    then causes the n_tty line discipline thing to not throttle the data
    properly when the tty is stopped.
    
    So instead of pausing the write due to the tty being stopped, the ldisc
    layer would go ahead and push it down to the pty.  The pty write()
    routine would then refuse to take the data (because it _did_ check
    'stopped'), and the data wouldn't actually be written.
    
    This whole stopped test should eventually be moved into the tty ldisc
    layer rather than have low-level tty drivers care about these things,
    but right now the fix is to just re-instate the missing pty 'stopped'
    handling.
    
    Reported-and-tested-by: Artur Skawina <art.08.09 at gmail.com>
    Cc: Alan Cox <alan at lxorguk.ukuu.org.uk>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit b409d7a0ab46fe530efe52734984b4ed5d46c3eb
Author: Jan Kara <jack at suse.cz>
Date:   Thu Aug 6 23:29:34 2009 +0200

    ocfs2: Fix possible deadlock when extending quota file
    
    In OCFS2, allocator locks rank above transaction start. Thus we
    cannot extend quota file from inside a transaction less we could
    deadlock.
    
    We solve the problem by starting transaction not already in
    ocfs2_acquire_dquot() but only in ocfs2_local_read_dquot() and
    ocfs2_global_read_dquot() and we allocate blocks to quota files before starting
    the transaction.  In case we crash, quota files will just have a few blocks
    more but that's no problem since we just use them next time we extend the
    quota file.
    
    Signed-off-by: Jan Kara <jack at suse.cz>
    Signed-off-by: Joel Becker <joel.becker at oracle.com>

commit 3e03bbeac541856aaaf1ce1ab0250b6a490e4099
Author: Shunichi Fuji <palglowr at gmail.com>
Date:   Tue Aug 11 03:34:40 2009 +0900

    x86: Add reboot quirk for every 5 series MacBook/Pro
    
    Reboot does not work on my MacBook Pro 13 inch (MacBookPro5,5)
    too. It seems all unibody MacBook and MacBookPro require
    PCI reboot handling, i guess.
    
    Following model/machine ID list shows unibody MacBook/Pro have
    the 5 series of model number:
    
       http://www.everymac.com/systems/by_capability/macs-by-machine-model-machine-id.html
    
    Signed-off-by: Shunichi Fuji <palglowr at gmail.com>
    Cc: Ozan Çağlayan <ozan at pardus.org.tr>
    LKML-Reference: <30046e3b0908101134p6487ddbftd8776e4ddef204be at mail.gmail.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit d00aa6695b67a31be2ce5f7464da32c20cb50699
Merge: cec36911b5fa4ac342f6de856b12a9f71f84e6e5 1853db0e02ae4088f102b0d8e59e83dc98f93f03
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 10 11:48:51 2009 -0700

    Merge branch 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: (27 commits)
      perf_counter: Zero dead bytes from ftrace raw samples size alignment
      perf_counter: Subtract the buffer size field from the event record size
      perf_counter: Require CAP_SYS_ADMIN for raw tracepoint data
      perf_counter: Correct PERF_SAMPLE_RAW output
      perf tools: callchain: Fix bad rounding of minimum rate
      perf_counter tools: Fix libbfd detection for systems with libz dependency
      perf: "Longum est iter per praecepta, breve et efficax per exempla"
      perf_counter: Fix a race on perf_counter_ctx
      perf_counter: Fix tracepoint sampling to be part of generic sampling
      perf_counter: Work around gcc warning by initializing tracepoint record unconditionally
      perf tools: callchain: Fix sum of percentages to be 100% by displaying amount of ignored chains in fractal mode
      perf tools: callchain: Fix 'perf report' display to be callchain by default
      perf tools: callchain: Fix spurious 'perf report' warnings: ignore empty callchains
      perf record: Fix the -A UI for empty or non-existent perf.data
      perf util: Fix do_read() to fail on EOF instead of busy-looping
      perf list: Fix the output to not include tracepoints without an id
      perf_counter/powerpc: Fix oops on cpus without perf_counter hardware support
      perf stat: Fix tool option consistency: rename -S/--scale to -c/--scale
      perf report: Add debug help for the finding of symbol bugs - show the symtab origin (DSO, build-id, kernel, etc)
      perf report: Fix per task mult-counter stat reporting
      ...

commit 392741e0a4e17c82e3978b7fcbf04291294dc0a1
Author: Darren Hart <dvhltc at us.ibm.com>
Date:   Fri Aug 7 15:20:48 2009 -0700

    futex: Fix handling of bad requeue syscall pairing
    
    If futex_requeue(requeue_pi=1) finds a futex_q that was created by a call
    other the futex_wait_requeue_pi(), the q.rt_waiter may be null.  If so,
    this will result in an oops from the following call graph:
    
    futex_requeue()
      rt_mutex_start_proxy_lock()
        task_blocks_on_rt_mutex()
          waiter->task dereference
            OOPS
    
    We currently WARN_ON() if this is detected, clearly this is inadequate.
    If we detect a mispairing in futex_requeue(), bail out, seding -EINVAL to
    user-space.
    
    V2: Fix parenthesis warnings.
    
    Signed-off-by: Darren Hart <dvhltc at us.ibm.com>
    Acked-by: Peter Zijlstra <peterz at infradead.org>
    Cc: Steven Rostedt <rostedt at goodmis.org>
    Cc: John Kacur <jkacur at redhat.com>
    Cc: Eric Dumazet <eric.dumazet at gmail.com>
    Cc: Dinakar Guniguntala <dino at in.ibm.com>
    Cc: John Stultz <johnstul at linux.vnet.ibm.com>
    LKML-Reference: <4A7CA8C0.7010809 at us.ibm.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit cec36911b5fa4ac342f6de856b12a9f71f84e6e5
Merge: a3263969b02260f8733940f580c7af1c716d38ad ad7d6c7a0654a4bbda3e109f56af713267e96274
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 10 11:21:13 2009 -0700

    Merge branch 'irq-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'irq-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86/irq: Fix move_irq_desc() for nodes without ram

commit a3263969b02260f8733940f580c7af1c716d38ad
Merge: 9b8f013a8361b05edf511f04fe93b36310b73806 b6e61eef4f9f94714ac3ee4a5c96862d9bcd1836
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 10 11:11:40 2009 -0700

    Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86: Fix serialization in pit_expect_msb()

commit 9b8f013a8361b05edf511f04fe93b36310b73806
Merge: 9bcf73f48280ef8cd7f2e38e674da47c409b9906 94f81a47c4a7a2d7a16fcfdd6d81da381732c101
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 10 11:00:37 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jbarnes/pci-2.6:
      PCI hotplug: SGI hotplug: do not use hotplug_slot_attr
      PCI hotplug: SGI hotplug: fix build failure

commit b6e61eef4f9f94714ac3ee4a5c96862d9bcd1836
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Jul 31 12:45:41 2009 -0700

    x86: Fix serialization in pit_expect_msb()
    
    Wei Chong Tan reported a fast-PIT-calibration corner-case:
    
    | pit_expect_msb() is vulnerable to SMI disturbance corner case
    | in some platforms which causes /proc/cpuinfo to show wrong
    | CPU MHz value when quick_pit_calibrate() jumps to success
    | section.
    
    I think that the real issue isn't even an SMI - but the fact
    that in the very last iteration of the loop, there's no
    serializing instruction _after_ the last 'rdtsc'. So even in
    the absense of SMI's, we do have a situation where the cycle
    counter was read without proper serialization.
    
    The last check should be done outside the outer loop, since
    _inside_ the outer loop, we'll be testing that the PIT has
    the right MSB value has the right value in the next iteration.
    
    So only the _last_ iteration is special, because that's the one
    that will not check the PIT MSB value any more, and because the
    final 'get_cycles()' isn't serialized.
    
    In other words:
    
     - I'd like to move the PIT MSB check to after the last
       iteration, rather than in every iteration
    
     - I think we should comment on the fact that it's also a
       serializing instruction and so 'fences in' the TSC read.
    
    Here's a suggested replacement.
    
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
    Reported-by: "Tan, Wei Chong" <wei.chong.tan at intel.com>
    Tested-by: "Tan, Wei Chong" <wei.chong.tan at intel.com>
    LKML-Reference: <B28277FD4E0F9247A3D55704C440A140D5D683F3 at pgsmsx504.gar.corp.intel.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 9bcf73f48280ef8cd7f2e38e674da47c409b9906
Merge: 2c661a669b3e2e34311d7965271a628671191e45 704b836cbf19e885f8366bccb2e4b0474346c02d
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 10 09:00:47 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6:
      mm_for_maps: take ->cred_guard_mutex to fix the race with exec
      mm_for_maps: shift down_read(mmap_sem) to the caller
      mm_for_maps: simplify, use ptrace_may_access()

commit 2c661a669b3e2e34311d7965271a628671191e45
Merge: 04e35357e2e3ff4e0cabd6468354cf3dbfeb4f27 b2f2e8fee3d62f621e795f25b2fc0f51bbdb4af9
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Mon Aug 10 08:59:56 2009 -0700

    Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc
    
    * 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
      powerpc/dma: pci_set_dma_mask() shouldn't fail if mask fits in RAM

commit 04e35357e2e3ff4e0cabd6468354cf3dbfeb4f27
Author: Jaswinder Singh Rajput <jaswinder at kernel.org>
Date:   Mon Aug 10 16:45:42 2009 +0100

    MN10300: includecheck fix: mn10300, pci.h
    
    Fix the following 'make includecheck' warning:
    
      arch/mn10300/include/asm/pci.h: linux/mm.h is included more than once.
    
    Signed-off-by: Jaswinder Singh Rajput <jaswinderrajput at gmail.com>
    Signed-off-by: David Howells <dhowells at redhat.com>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 5e2f89b5d5d87a7c3ba19fc85ba0c29adb65f639
Author: Figo.zhang <figo1802 at gmail.com>
Date:   Sat Aug 8 21:01:22 2009 +0800

    mempool.c: clean up type-casting
    
    clean up type-casting twice.  "size_t" is typedef as "unsigned long" in
    64-bit system, and "unsigned int" in 32-bit system, and the intermediate
    cast to 'long' is pointless.
    
    Signed-off-by: Figo.zhang <figo1802 at gmail.com>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 1392e3b33319fd1a2527bebfc56631c2f2d3c7c5
Author: Ryusuke Konishi <konishi.ryusuke at lab.ntt.co.jp>
Date:   Sat Aug 8 17:52:50 2009 +0900

    documentation: register ioctl entry of nilfs2
    
    This will register the ioctl range used by nilfs2 file system to the
    table listed in Documentation/ioctl/ioctl-number.txt.
    
    Signed-off-by: Ryusuke Konishi <konishi.ryusuke at lab.ntt.co.jp>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 1853db0e02ae4088f102b0d8e59e83dc98f93f03
Author: Frederic Weisbecker <fweisbec at gmail.com>
Date:   Mon Aug 10 16:38:36 2009 +0200

    perf_counter: Zero dead bytes from ftrace raw samples size alignment
    
    After aligning the ftrace raw samples, there are dead bytes storing
    random data from the stack. We don't want to leak these to userspace,
    then zero these out.
    
    Before:
    
    	0x2de88 [0x50]: event: 9
    	.
    	. ... raw event: size 80 bytes
    	.  0000:  09 00 00 00 01 00 50 00 d0 c7 00 81 ff ff ff ff  ......P........
    	.  0010:  68 01 00 00 68 01 00 00 2c 00 00 00 00 00 00 00  h...h...,......
    	.  0020:  2c 00 00 00 2b 00 01 02 68 01 00 00 68 01 00 00  ,...+...h...h..
    	.  0030:  6b 6f 6e 64 65 6d 61 6e 64 2f 30 00 00 00 00 00  kondemand/0....
    	.  0040:  68 01 00 00 40 7f 46 81 ff ff ff ff 00 10 1b 7f  h... at .F........
                                                          ^  ^  ^  ^
                                                             Leak
    
    After:
    
    	0x2d318 [0x50]: event: 9
    	.
    	. ... raw event: size 80 bytes
    	.  0000:  09 00 00 00 01 00 50 00 d0 c7 00 81 ff ff ff ff  ......P........
    	.  0010:  68 01 00 00 68 01 00 00 68 14 00 00 00 00 00 00  h...h...h......
    	.  0020:  2c 00 00 00 2b 00 01 02 68 01 00 00 68 01 00 00  ,...+...h...h..
    	.  0030:  6b 6f 6e 64 65 6d 61 6e 64 2f 30 00 00 00 00 00  kondemand/0....
    	.  0040:  68 01 00 00 a0 80 46 81 ff ff ff ff 00 00 00 00  h.....F........
                                                          ^  ^  ^  ^
    							 Fixed
    
    Reported-by: Peter Zijlstra <peterz at infradead.org>
    Signed-off-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Mike Galbraith <efault at gmx.de>
    LKML-Reference: <1249915116-5210-1-git-send-email-fweisbec at gmail.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Mike Galbraith <efault at gmx.de>

commit 96a4d1e23439e2356a105791bda95cc08d375b97
Merge: f40aac940aa83645ec2218ccce90cc1c6881b74c 6fd210a9cc398ecbff7bcdbe220651b73b654f56
Author: Russell King <rmk at dyn-67.arm.linux.org.uk>
Date:   Mon Aug 10 15:50:27 2009 +0100

    Merge branch 'pm-upstream/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap-pm

commit 304703aba31a87903b8c0db8f5e6890cac2d596d
Author: Frederic Weisbecker <fweisbec at gmail.com>
Date:   Mon Aug 10 16:11:32 2009 +0200

    perf_counter: Subtract the buffer size field from the event record size
    
    We compute the perf raw sample size by aligning the raw ftrace
    event size plus the buffer size field itself. We do that
    instead of aligning only the perf raw sample size, so that we
    might economize some in some cases.
    
    But this buffer size field is not stored in the perf raw
    sample, we must then substract its size from the buffer once we
    computed the alignment unless we may get a useless u32 field in
    the buffer.
    
    Signed-off-by: Frederic Weisbecker <fweisbec at gmail.com>
    Acked-by: Peter Zijlstra <peterz at infradead.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Paul Mackerras <paulus at samba.org>
    LKML-Reference: <20090810141129.GA5124 at nowhere>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 4dc88029fd916b860ef063c40180aa604ce93494
Author: Dinakar Guniguntala <dino at in.ibm.com>
Date:   Mon Aug 10 18:31:42 2009 +0530

    futex: Fix compat_futex to be same as futex for REQUEUE_PI
    
    Need to add the REQUEUE_PI checks to the compat_sys_futex API
    as well to ensure 32 bit requeue's work fine on a 64 bit
    system. Patch is against latest tip
    
    Signed-off-by: Dinakar Guniguntala <dino at in.ibm.com>
    Cc: Darren Hart <dvhltc at us.ibm.com>
    LKML-Reference: <20090810130142.GA23619 at in.ibm.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit f40aac940aa83645ec2218ccce90cc1c6881b74c
Merge: 7063c88c726a704e648ba36ca78baa630f8b7b0a 3c82e229f09a6acc8d24dc27c5e0e60b1d7161c2
Author: Russell King <rmk at dyn-67.arm.linux.org.uk>
Date:   Mon Aug 10 14:24:18 2009 +0100

    Merge branch 'omap_fixes_31' of git://git.pwsan.com/linux-2.6

commit 7063c88c726a704e648ba36ca78baa630f8b7b0a
Merge: f4b9a988685da6386d7f9a72df3098bcc3270526 4177662ec9f5e50b69ef074369fdb429dd48d97e
Author: Russell King <rmk at dyn-67.arm.linux.org.uk>
Date:   Mon Aug 10 14:23:29 2009 +0100

    Merge branch 'omap-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6

commit 2fc391112fb6f3424435a3aa2fda887497b5f807
Author: Peter Zijlstra <peterz at infradead.org>
Date:   Mon Aug 10 12:33:05 2009 +0100

    locking, sched: Give waitqueue spinlocks their own lockdep classes
    
    Give waitqueue spinlocks their own lockdep classes when they
    are initialised from init_waitqueue_head().  This means that
    struct wait_queue::func functions can operate other waitqueues.
    
    This is used by CacheFiles to catch the page from a backing fs
    being unlocked and to wake up another thread to take a copy of
    it.
    
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Signed-off-by: David Howells <dhowells at redhat.com>
    Tested-by: Takashi Iwai <tiwai at suse.de>
    Cc: linux-cachefs at redhat.com
    Cc: torvalds at osdl.org
    Cc: akpm at linux-foundation.org
    LKML-Reference: <20090810113305.17284.81508.stgit at warthog.procyon.org.uk>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 4177662ec9f5e50b69ef074369fdb429dd48d97e
Author: Roger Quadros <ext-roger.quadros at nokia.com>
Date:   Mon Aug 10 14:49:52 2009 +0300

    OMAP3: RX51: Updated rx51_defconfig
    
    Added REGULATOR, MMC and updated default CMDLINE so RX51 now boots.
    
    Note that the regulator code should be moved from mmc-twl4030.c
    to omap_hsmmc.c so it can be a module.
    
    Signed-off-by: Roger Quadros <ext-roger.quadros at nokia.com>
    Signed-off-by: Tony Lindgren <tony at atomide.com>

commit 22833044fbe2764d44ae03f58508e671652ca186
Author: Roger Quadros <ext-roger.quadros at nokia.com>
Date:   Mon Aug 10 14:49:51 2009 +0300

    OMAP2/3: mmc-twl4030: Free up MMC regulators while cleaning up
    
    twl_mmc_cleanup() must free up the regulators that were
    allocated by twl_mmc_late_init().
    This eliminates the below error when 'omap_hsmmc' module is
    repeatedly loaded and unloaded.
    
    "sysfs: cannot create duplicate filename '/devices/platform
     /mmci-omap-hs.0/microamps_requested_vmmc'"
    
    Signed-off-by: Roger Quadros <ext-roger.quadros at nokia.com>
    Signed-off-by: Tony Lindgren <tony at atomide.com>

commit dfc27b34496923b5f552eb9cdf20468045114ada
Author: Roger Quadros <ext-roger.quadros at nokia.com>
Date:   Mon Aug 10 14:49:51 2009 +0300

    OMAP3: RX51: Define TWL4030 USB transceiver in board file
    
    Add OTG transceiver to RX51 platform data to prevent kernel NULL pointer
    dereference during MUSB initialisation.
    
    Signed-off-by: Roger Quadros <ext-roger.quadros at nokia.com>
    Signed-off-by: Felipe Balbi <felipe.balbi at nokia.com>
    Signed-off-by: Tony Lindgren <tony at atomide.com>

commit 5032902c331acc71956e47abd90d090181c5ef4a
Author: Sergio Aguirre <saaguirre at ti.com>
Date:   Mon Aug 10 14:49:50 2009 +0300

    OMAP3: Overo: Fix smsc911x platform device resource value
    
    Fixes a wrong setting of resource parameter list in
    SMSC911x platform driver data structure for Overo case.
    
    This fixes folowing warning when compiling for Overo board:
    
    	warning: initialization from incompatible pointer type
    
    Introduced since commit id:
    	commit 172ef275444efa12d834fb9d1b1acdac92db47f7
    	Author: Steve Sakoman <sakoman at gmail.com>
    	Date:   Mon Feb 2 06:27:49 2009 +0000
    
    	    ARM: Add SMSC911X support to Overo platform (V2)
    
    Signed-off-by: Sergio Aguirre <saaguirre at ti.com>
    Signed-off-by: Tony Lindgren <tony at atomide.com>

commit 370bc1fdefb8a30018d98aca2fdfd6b6701082e7
Author: Janboe Ye <yuan-bo.ye at motorola.com>
Date:   Mon Aug 10 14:49:50 2009 +0300

    OMAP3: Fix omap3 sram virtual addres overlap vmalloc space after increasing vmalloc size
    
    commit e85c205ac1427f2405021a36f083280ff0d0a35e increase vmalloc size.
    vmalloc space will overlap with OMAP3 sram virtual address.
    
    Signed-off-by: Li Hong Mei <hong-mei.li at motorola.com>
    Signed-off-by: Janboe Ye <yuan-bo.ye at motorola.com>
    Reviewed-by: Paul Walmsley <paul at pwsan.com>

commit 284119c48f4a0c469b3e0237b500e536b4bc7b6f
Author: Vikram Pandita <vikram.pandita at ti.com>
Date:   Mon Aug 10 14:49:50 2009 +0300

    OMAP2/3: DMA errata correction
    
    This errata is valid for:
    OMAP2420 Errata 1.85 Impacts all 2420 ES rev
    OMAP2430 Errata 1.10 Impacts only ES1.0
    Description: DMA may hang when several channels are used in parallel
    OMAP3430: Not impacted, so remove the errata fix for omap3
    
    Fixed issue reported on cpu_is_omap24xx check reported by Nishant Kamat
    
    Signed-off-by: Vikram Pandita <vikram.pandita at ti.com>
    Reviewed-by: Nishant Kamat <nskamat at ti.com>
    Signed-off-by: Tony Lindgren <tony at atomide.com>

commit cd92204924fafbd5c7241dfd12ca3176d542e0c5
Author: Tony Lindgren <tony at atomide.com>
Date:   Mon Aug 10 14:49:50 2009 +0300

    OMAP: Fix testing of cpu defines for mach-omap1
    
    There's no need to keep these defines limited in the ifdef block
    for mach-omap2. It will just cause problems testing for the CPU
    revision in the common code, like the next patch does for the DMA
    errata.
    
    Signed-off-by: Tony Lindgren <tony at atomide.com>

commit 704b836cbf19e885f8366bccb2e4b0474346c02d
Author: Oleg Nesterov <oleg at redhat.com>
Date:   Fri Jul 10 03:27:40 2009 +0200

    mm_for_maps: take ->cred_guard_mutex to fix the race with exec
    
    The problem is minor, but without ->cred_guard_mutex held we can race
    with exec() and get the new ->mm but check old creds.
    
    Now we do not need to re-check task->mm after ptrace_may_access(), it
    can't be changed to the new mm under us.
    
    Strictly speaking, this also fixes another very minor problem. Unless
    security check fails or the task exits mm_for_maps() should never
    return NULL, the caller should get either old or new ->mm.
    
    Signed-off-by: Oleg Nesterov <oleg at redhat.com>
    Acked-by: Serge Hallyn <serue at us.ibm.com>
    Signed-off-by: James Morris <jmorris at namei.org>

commit 00f89d218523b9bf6b522349c039d5ac80aa536d
Author: Oleg Nesterov <oleg at redhat.com>
Date:   Fri Jul 10 03:27:38 2009 +0200

    mm_for_maps: shift down_read(mmap_sem) to the caller
    
    mm_for_maps() takes ->mmap_sem after security checks, this looks
    strange and obfuscates the locking rules. Move this lock to its
    single caller, m_start().
    
    Signed-off-by: Oleg Nesterov <oleg at redhat.com>
    Acked-by: Serge Hallyn <serue at us.ibm.com>
    Signed-off-by: James Morris <jmorris at namei.org>

commit 13f0feafa6b8aead57a2a328e2fca6a5828bf286
Author: Oleg Nesterov <oleg at redhat.com>
Date:   Tue Jun 23 21:25:32 2009 +0200

    mm_for_maps: simplify, use ptrace_may_access()
    
    It would be nice to kill __ptrace_may_access(). It requires task_lock(),
    but this lock is only needed to read mm->flags in the middle.
    
    Convert mm_for_maps() to use ptrace_may_access(), this also simplifies
    the code a little bit.
    
    Also, we do not need to take ->mmap_sem in advance. In fact I think
    mm_for_maps() should not play with ->mmap_sem at all, the caller should
    take this lock.
    
    With or without this patch, without ->cred_guard_mutex held we can race
    with exec() and get the new ->mm but check old creds.
    
    Signed-off-by: Oleg Nesterov <oleg at redhat.com>
    Reviewed-by: Serge Hallyn <serue at us.ibm.com>
    Signed-off-by: James Morris <jmorris at namei.org>

commit 100d5eb36ba20dc0b99a17ea2b9800c567bfc3d1
Author: Takashi Iwai <tiwai at suse.de>
Date:   Mon Aug 10 11:55:51 2009 +0200

    ALSA: hda - Add missing vmaster initialization for ALC269
    
    Without the initialization of vmaster NID, the dB information got
    confused for ALC269 codec.
    
    Reference: Novell bnc#527361
    	https://bugzilla.novell.com/show_bug.cgi?id=527361
    
    Signed-off-by: Takashi Iwai <tiwai at suse.de>
    Cc: <stable at kernel.org>

commit a4e95fc2cbb31d70a65beffeaf8773f881328c34
Author: Peter Zijlstra <a.p.zijlstra at chello.nl>
Date:   Mon Aug 10 11:20:12 2009 +0200

    perf_counter: Require CAP_SYS_ADMIN for raw tracepoint data
    
    Raw tracepoint data contains various kernel internals and
    data from other users, so restrict this to CAP_SYS_ADMIN.
    
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Acked-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Paul Mackerras <paulus at samba.org>
    LKML-Reference: <1249896452.17467.75.camel at twins>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit a044560c3a1f0ad75ce685c1ed7604820b9ed319
Author: Peter Zijlstra <a.p.zijlstra at chello.nl>
Date:   Mon Aug 10 11:16:52 2009 +0200

    perf_counter: Correct PERF_SAMPLE_RAW output
    
    PERF_SAMPLE_* output switches should unconditionally output the
    correct format, as they are the only way to unambiguously parse
    the PERF_EVENT_SAMPLE data.
    
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Acked-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Paul Mackerras <paulus at samba.org>
    LKML-Reference: <1249896447.17467.74.camel at twins>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit beda2c7ea2c15ed01eef00a997d2b0496c3a502d
Author: Darren Hart <dvhltc at us.ibm.com>
Date:   Sun Aug 9 15:34:39 2009 -0700

    futex: Update futex_q lock_ptr on requeue proxy lock
    
    futex_requeue() can acquire the lock on behalf of a waiter
    early on or during the requeue loop if it is uncontended or in
    the event of a lock steal or owner died. On wakeup, the waiter
    (in futex_wait_requeue_pi()) cleans up the pi_state owner using
    the lock_ptr to protect against concurrent access to the
    pi_state. The pi_state is hung off futex_q's on the requeue
    target futex hash bucket so the lock_ptr needs to be updated
    accordingly.
    
    The problem manifested by triggering the WARN_ON in
    lookup_pi_state() about the pid != pi_state->owner->pid.  With
    this patch, the pi_state is properly guarded against concurrent
    access via the requeue target hb lock.
    
    The astute reviewer may notice that there is a window of time
    between when futex_requeue() unlocks the hb locks and when
    futex_wait_requeue_pi() will acquire hb2->lock.  During this
    time the pi_state and uval are not in sync with the underlying
    rtmutex owner (but the uval does indicate there are waiters, so
    no atomic changes will occur in userspace).  However, this is
    not a problem. Should a contending thread enter
    lookup_pi_state() and acquire hb2->lock before the ownership is
    fixed up, it will find the pi_state hung off a waiter's
    (possibly the pending owner's) futex_q and block on the
    rtmutex.  Once futex_wait_requeue_pi() fixes up the owner, it
    will also move the pi_state from the old owner's
    task->pi_state_list to its own.
    
    v3: Fix plist lock name for application to mainline (rather
        than -rt) Compile tested against tip/v2.6.31-rc5.
    
    Signed-off-by: Darren Hart <dvhltc at us.ibm.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Steven Rostedt <rostedt at goodmis.org>
    Cc: Eric Dumazet <eric.dumazet at gmail.com>
    Cc: Dinakar Guniguntala <dino at in.ibm.com>
    Cc: John Stultz <johnstul at linux.vnet.ibm.com>
    LKML-Reference: <4A7F4EFF.6090903 at us.ibm.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit b2f2e8fee3d62f621e795f25b2fc0f51bbdb4af9
Author: Benjamin Herrenschmidt <benh at kernel.crashing.org>
Date:   Mon Aug 10 16:36:38 2009 +1000

    powerpc/dma: pci_set_dma_mask() shouldn't fail if mask fits in RAM
    
    On an iMac G5, the b43 driver is failing to initialise because trying to
    set the dma mask to 30-bit fails. Even though there's only 512MiB of RAM
    in the machine anyway:
    	https://bugzilla.redhat.com/show_bug.cgi?id=514787
    
    We should probably let it succeed if the available RAM in the system
    doesn't exceed the requested limit.
    
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
    Signed-off-by: Benjamin Herrenschmidt <benh at kernel.crashing.org>

commit 973507cb8610d4c84f090d5f1f0ca54fa0559d27
Author: roel kluin <roel.kluin at gmail.com>
Date:   Sat Aug 8 23:54:21 2009 +0000

    mlx4_en: Fix read buffer overflow in mlx4_en_complete_rx_desc()
    
    If the length is less or equal to frag_prefix_size in the first iteration
    we write skb_frags_rx[-1] and read from priv->frag_info[-1]
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit be12159b24c532b4b48bdec5a543336438faa132
Author: roel kluin <roel.kluin at gmail.com>
Date:   Sun Aug 9 04:00:25 2009 +0000

    zorro8390: Fix read buffer overflow in zorro8390_init_one()
    
    Prevent read from cards[-1] when no card was found.
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 5e33b719c8fcccfedc1d25167826a0f93fe6c5a1
Author: roel kluin <roel.kluin at gmail.com>
Date:   Fri Aug 7 03:24:27 2009 +0000

    pcnet32: Read buffer overflow
    
    An `options[cards_found]' that equals `sizeof(options_mapping)' is already beyond
    the array.
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 418372b0ab7a3bbcc59d71e8e4d322ef18263dab
Author: Rafael Laufer <rlaufer at cisco.com>
Date:   Fri Aug 7 05:17:17 2009 +0000

    sctp: fix missing destroy of percpu counter variable in sctp_proc_exit()
    
    Commit 1748376b6626acf59c24e9592ac67b3fe2a0e026,
    	net: Use a percpu_counter for sockets_allocated
    
    added percpu_counter function calls to sctp_proc_init code path, but
    forgot to add them to sctp_proc_exit().  This resulted in a following
    Ooops when performing this test
    	# modprobe sctp
    	# rmmod -f sctp
    	# modprobe sctp
    
    [  573.862512] BUG: unable to handle kernel paging request at f8214a24
    [  573.862518] IP: [<c0308b8f>] __percpu_counter_init+0x3f/0x70
    [  573.862530] *pde = 37010067 *pte = 00000000
    [  573.862534] Oops: 0002 [#1] SMP
    [  573.862537] last sysfs file: /sys/module/libcrc32c/initstate
    [  573.862540] Modules linked in: sctp(+) crc32c libcrc32c binfmt_misc bridge
    stp bnep lp snd_hda_codec_analog snd_hda_intel snd_hda_codec snd_hwdep
    snd_pcm_oss snd_mixer_oss arc4 joydev snd_pcm ecb pcmcia snd_seq_dummy
    snd_seq_oss iwlagn iwlcore snd_seq_midi snd_rawmidi snd_seq_midi_event
    yenta_socket rsrc_nonstatic thinkpad_acpi snd_seq snd_timer snd_seq_device
    mac80211 psmouse sdhci_pci sdhci nvidia(P) ppdev video snd soundcore serio_raw
    pcspkr iTCO_wdt iTCO_vendor_support led_class ricoh_mmc pcmcia_core intel_agp
    nvram agpgart usbhid parport_pc parport output snd_page_alloc cfg80211 btusb
    ohci1394 ieee1394 e1000e [last unloaded: sctp]
    [  573.862589]
    [  573.862593] Pid: 5373, comm: modprobe Tainted: P  R        (2.6.31-rc3 #6)
    7663B15
    [  573.862596] EIP: 0060:[<c0308b8f>] EFLAGS: 00010286 CPU: 1
    [  573.862599] EIP is at __percpu_counter_init+0x3f/0x70
    [  573.862602] EAX: f8214a20 EBX: f80faa14 ECX: c48c0000 EDX: f80faa20
    [  573.862604] ESI: f80a7000 EDI: 00000000 EBP: f69d5ef0 ESP: f69d5eec
    [  573.862606]  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
    [  573.862610] Process modprobe (pid: 5373, ti=f69d4000 task=c2130c70
    task.ti=f69d4000)
    [  573.862612] Stack:
    [  573.862613]  00000000 f69d5f18 f80a70a8 f80fa9fc 00000000 fffffffc f69d5f30
    c018e2d4
    [  573.862619] <0> 00000000 f80a7000 00000000 f69d5f88 c010112b 00000000
    c07029c0 fffffffb
    [  573.862626] <0> 00000000 f69d5f38 c018f83f f69d5f54 c0557cad f80fa860
    00000001 c07010c0
    [  573.862634] Call Trace:
    [  573.862644]  [<f80a70a8>] ? sctp_init+0xa8/0x7d4 [sctp]
    [  573.862650]  [<c018e2d4>] ? marker_update_probe_range+0x184/0x260
    [  573.862659]  [<f80a7000>] ? sctp_init+0x0/0x7d4 [sctp]
    [  573.862662]  [<c010112b>] ? do_one_initcall+0x2b/0x160
    [  573.862666]  [<c018f83f>] ? tracepoint_module_notify+0x2f/0x40
    [  573.862671]  [<c0557cad>] ? notifier_call_chain+0x2d/0x70
    [  573.862678]  [<c01588fd>] ? __blocking_notifier_call_chain+0x4d/0x60
    [  573.862682]  [<c016b2f1>] ? sys_init_module+0xb1/0x1f0
    [  573.862686]  [<c0102ffc>] ? sysenter_do_call+0x12/0x28
    [  573.862688] Code: 89 48 08 b8 04 00 00 00 e8 df aa ec ff ba f4 ff ff ff 85
    c0 89 43 14 74 31 b8 b0 18 71 c0 e8 19 b9 24 00 a1 c4 18 71 c0 8d 53 0c <89> 50
    04 89 43 0c b8 b0 18 71 c0 c7 43 10 c4 18 71 c0 89 15 c4
    [  573.862725] EIP: [<c0308b8f>] __percpu_counter_init+0x3f/0x70 SS:ESP
    0068:f69d5eec
    [  573.862730] CR2: 00000000f8214a24
    [  573.862734] ---[ end trace 39c4e0b55e7cf54d ]---
    
    Signed-off-by: Rafael Laufer <rlaufer at cisco.com>
    Signed-off-by: Vlad Yasevich <vladislav.yasevich at hp.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 018d21ed80736eab21fabf45edbd74600a1f8330
Author: Joe Perches <joe at perches.com>
Date:   Fri Aug 7 06:43:01 2009 +0000

    MAINTAINERS: additional NETWORKING [GENERAL] and NETWORKING DRIVERS patterns
    
    Signed-off-by: Joe Perches <joe at perches.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 75c4885924f01aed1f887886a49dfa89960de240
Author: Yong Zhang <yong.zhang0 at gmail.com>
Date:   Fri Aug 7 16:36:52 2009 +0000

    gianfar: keep vlan related state when restart
    
    If vlan has been enabled. ifdown followed by ifup will lost hardware
    related state.
    
    Also remove duplicated operation in gfar_vlan_rx_register().
    
    Signed-off-by: Yong Zhang <yong.zhang0 at gmail.com>
    Acked-by: Dai Haruki <dai.haruki at freescale.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 148675a7b2061b5a5eb194530b7c4d8de1f2887e
Author: Bruce Allan <bruce.w.allan at intel.com>
Date:   Fri Aug 7 07:41:56 2009 +0000

    e1000e: fix potential NVM corruption on ICH9 with 8K bank size
    
    The bank offset was being incorrectly calculated on ICH9 parts with a bank
    size of 8K (instead of the more common 4K bank) which would cause any NVM
    writes to be done on the wrong address after switching from bank 1 to bank
    0.  Additionally, assume we are meant to use bank 0 if a valid bank is not
    detected, and remove the unnecessary acquisition of the SW/FW/HW semaphore
    when writing to the shadow ram version of the NVM image.
    
    Signed-off-by: Bruce Allan <bruce.w.allan at intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher at intel.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 373a88d78be540c1331ea5adcb76610dddcb008b
Author: Bruce Allan <bruce.w.allan at intel.com>
Date:   Fri Aug 7 07:41:37 2009 +0000

    e1000e: fix acquisition of SW/FW/HW semaphore for ICHx parts
    
    For ICHx parts, write the EXTCNF_CTRL.SWFLAG bit once when trying to
    acquire the SW/FW/HW semaphore instead of multiple times to prevent the
    hardware from having problems (especially for systems with manageability
    enabled), and extend the timeout for the hardware to set the SWFLAG bit.
    
    Signed-off-by: Bruce Allan <bruce.w.allan at intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher at intel.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 6e455b897bb6be3a4c0c6578f679e83d399e5b92
Author: Yi Zou <yi.zou at intel.com>
Date:   Thu Aug 6 13:05:44 2009 +0000

    ixgbe: Disable packet split only on FCoE queues in 82599
    
    For 82599, packet split has to be disabled for FCoE direct data placement.
    However, this is only required on received queues allocated for FCoE. This
    patch adds a per ring flags to indicate if packet split is disabled on a
    per queue basis, particularly for FCoE, as packet split must be disabled
    for large receive using direct data placement (DDP).
    
    Signed-off-by: Yi Zou <yi.zou at intel.com>
    Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr at intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher at intel.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit a6616b42fbc39c1ccc2373996f1441ce7707ea93
Author: Yi Zou <yi.zou at intel.com>
Date:   Thu Aug 6 13:05:23 2009 +0000

    ixgbe: Pass rx_ring directly in ixgbe_configure_srrctl()
    
    Instead of passing the register index of the corresponding rx_ring and find
    the way back to get to corresponding rx_ring in ixgbe_configure_srrctl(),
    simplify the function ixgbe_configure_srrctl() by passing the rx_ring into
    it. Then the register index for that rx_ring is already available from
    rx_ring->reg_idx.
    
    Signed-off-by: Yi Zou <yi.zou at intel.com>
    Acked-by: Peter P Waskiewicz Jr <peter.p.waskiewicz.jr at intel.com>
    Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher at intel.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 876bfd4d0f18cd1f698249870c7e7fb944de1c26
Author: Herbert Xu <herbert at gondor.apana.org.au>
Date:   Thu Aug 6 14:22:44 2009 +0000

    tun: Extend RTNL lock coverage over whole ioctl
    
    As it is, parts of the ioctl runs under the RTNL and parts of
    it do not.  The unlocked section is still protected by the BKL,
    but there can be subtle races.  For example, Eric Biederman and
    Paul Moore observed that if two threads tried to create two tun
    devices on the same file descriptor, then unexpected results
    may occur.
    
    As there isn't anything in the ioctl that is expected to sleep
    indefinitely, we can prevent this from occurring by extending
    the RTNL lock coverage.
    
    This also allows to get rid of the BKL.
    
    Finally, I changed tun_get_iff to take a tun device in order to
    avoid calling tun_put which would dead-lock as it also tries to
    take the RTNL lock.
    
    Signed-off-by: Herbert Xu <herbert at gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 9555b31e8c29d2000e1e1f569f6f242ebd596e47
Author: Greg Ungerer <gerg at snapgear.com>
Date:   Thu Aug 6 17:58:18 2009 +0000

    fec: fix FEC driver packet transmission breakage
    
    Commit f0b3fbeae11a526c3d308b691684589ee37c359b ("FEC Buffer rework")
    breaks transmission of packets where the skb data buffer is not memory
    aligned according to FEC_ALIGNMENT. It incorrectly passes to
    dma_sync_single() the buffer address directly from the skb, instead of
    the address calculated for use (which may be the skb address or one of
    the bounce buffers).
    
    It seems there is no use converting the cpu address of the buffer to
    a physical either, since dma_map_single() expects the cpu address and
    will return the dma address to use in the descriptor. So remove the use
    of __pa() on the buffer address as well.
    
    This patch is against 2.6.30-rc5. This breakage is a regression over
    2.6.30, which does not have this problem.
    
    Signed-off-by: Greg Ungerer <gerg at uclinux.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit e84b90ae5eb3c112d1f208964df1d8156a538289
Author: Eric Dumazet <eric.dumazet at gmail.com>
Date:   Thu Aug 6 20:27:04 2009 +0000

    can: Fix raw_getname() leak
    
    raw_getname() can leak 10 bytes of kernel memory to user
    
    (two bytes hole between can_family and can_ifindex,
    8 bytes at the end of sockaddr_can structure)
    
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    Acked-by: Oliver Hartkopp <oliver at hartkopp.net>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit b79a79471bd31d737c939a6ddc347417047b4320
Author: Jussi Mäki <joamaki at gmail.com>
Date:   Thu Aug 6 21:38:14 2009 +0000

    Fix xfrm hash collisions by changing __xfrm4_daddr_saddr_hash to hash addresses with addition
    
    This patch fixes hash collisions in cases where number
    of entries have incrementing IP source and destination addresses
    from single respective subnets (i.e. 192.168.0.1-172.16.0.1,
    192.168.0.2-172.16.0.2, and so on.).
    
    Signed-off-by: Jussi Maki <joamaki at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 082ba88a5e6b1425abed3fae4ad65e0e985ed081
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Thu Aug 6 13:06:56 2009 +0000

    atlx: strncpy does not null terminate string
    
    strlcpy() will always null terminate the string.
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Cc: Jay Cliburn <jcliburn at gmail.com>
    Cc: Chris Snook <csnook at redhat.com>
    Cc: Jie Yang <jie.yang at atheros.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 5d5ceb8bdde403529ad9849f300dc80b1884550f
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Thu Aug 6 13:06:03 2009 +0000

    irda: fix read buffer overflow
    
    io[i] is read before the bounds check on i, order should be reversed.
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Cc: Samuel Ortiz <samuel at sortiz.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit cb2f33e9596632979c140c243ac1e8e994f62180
Author: Chris Snook <chris.snook at gmail.com>
Date:   Thu Aug 6 12:19:31 2009 +0000

    MAINTAINERS: update atlx contact info
    
    Update MAINTAINERS to reflect my current (non-)affiliation.  Anyone
    hiring?
    
    Signed-off-by: Chris Snook <chris.snook at gmail.com>
    Cc: Jay Cliburn <jcliburn at gmail.com>
    Cc: Jie Yang <jie.yang at atheros.com>
    Cc: "David S. Miller" <davem at davemloft.net>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit f222e8b40f2177b1c4cac015b117744c1d3fa3e9
Merge: 819ae6a389d4acfab9a7bb874fa1977aa464d14b f4b9a988685da6386d7f9a72df3098bcc3270526
Author: David S. Miller <davem at davemloft.net>
Date:   Sun Aug 9 21:29:47 2009 -0700

    Merge branch 'master' of /home/davem/src/GIT/linux-2.6/

commit 819ae6a389d4acfab9a7bb874fa1977aa464d14b
Merge: 0d502d8267ebab9ae4b5b4c065d20196d6069f52 dd1f57ecaf9688efa69d982652ecfa3e64f1fa55
Author: David S. Miller <davem at davemloft.net>
Date:   Sun Aug 9 20:47:39 2009 -0700

    Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-2.6

commit c8c00a6915a2e3d10416e8bdd3138429beb96210
Author: NeilBrown <neilb at suse.de>
Date:   Mon Aug 10 12:50:52 2009 +1000

    Remove deadlock potential in md_open
    
    A recent commit:
      commit 449aad3e25358812c43afc60918c5ad3819488e7
    
    introduced the possibility of an A-B/B-A deadlock between
    bd_mutex and reconfig_mutex.
    
    __blkdev_get holds bd_mutex while calling md_open which takes
       reconfig_mutex,
    do_md_run is always called with reconfig_mutex held, and it now
       takes bd_mutex in the call the revalidate_disk.
    
    This potential deadlock was not caught by lockdep due to the
    use of mutex_lock_interruptible_nexted which was introduced
    by
       commit d63a5a74dee87883fda6b7d170244acaac5b05e8
    do avoid a warning of an impossible deadlock.
    
    It is quite possible to split reconfig_mutex in to two locks.
    One protects the array data structures while it is being
    reconfigured, the other ensures that an array is never even partially
    open while it is being deactivated.
    In particular, the second lock prevents an open from completing
    between the time when do_md_stop checks if there are any active opens,
    and the time when the array is either set read-only, or when ->pers is
    set to NULL.  So we can be certain that no IO is in flight as the
    array is being destroyed.
    
    So create a new lock, open_mutex, just to ensure exclusion between
    'open' and 'stop'.
    
    This avoids the deadlock and also avoids the lockdep warning mentioned
    in commit d63a5a74d
    
    Reported-by: "Mike Snitzer" <snitzer at gmail.com>
    Reported-by: "H. Peter Anvin" <hpa at zytor.com>
    Signed-off-by: NeilBrown <neilb at suse.de>

commit f4b9a988685da6386d7f9a72df3098bcc3270526
Merge: 17d11ba14990d2bbaaec9c09a200b803679a968e 32bc4820287a1a03982979515949e8ea56eac641
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Aug 9 14:58:34 2009 -0700

    Merge branch 'for-linus' of git://git.infradead.org/ubi-2.6
    
    * 'for-linus' of git://git.infradead.org/ubi-2.6:
      UBI: compatible fallback in absense of sequence numbers
      UBI: fix double free on error path

commit 17d11ba14990d2bbaaec9c09a200b803679a968e
Merge: fb1ee451e64a1c963a149aeccd9ef6a718f545e7 b4a2f5e723e4f7df46731106faf9e2405673c073
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Aug 9 14:58:21 2009 -0700

    Merge branch 'kvm-updates/2.6.31' of git://git.kernel.org/pub/scm/virt/kvm/kvm
    
    * 'kvm-updates/2.6.31' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
      KVM: Avoid redelivery of edge interrupt before next edge
      KVM: MMU: limit rmap chain length
      KVM: ia64: fix build failures due to ia64/unsigned long mismatches
      KVM: Make KVM_HPAGES_PER_HPAGE unsigned long to avoid build error on powerpc
      KVM: fix ack not being delivered when msi present
      KVM: s390: fix wait_queue handling
      KVM: VMX: Fix locking imbalance on emulation failure
      KVM: VMX: Fix locking order in handle_invalid_guest_state
      KVM: MMU: handle n_free_mmu_pages > n_alloc_mmu_pages in kvm_mmu_change_mmu_pages
      KVM: SVM: force new asid on vcpu migration
      KVM: x86: verify MTRR/PAT validity
      KVM: PIT: fix kpit_elapsed division by zero
      KVM: Fix KVM_GET_MSR_INDEX_LIST

commit fb1ee451e64a1c963a149aeccd9ef6a718f545e7
Merge: 2e9b11afdbfe17a9cc6356076179b7ea11972607 6cb504c29b1338925c83e4430e42a51eaa43781e
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Aug 9 14:58:09 2009 -0700

    Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6
    
    * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
      drm/i915: silence vblank warnings
      drm: silence pointless vblank warning.
      drm: When adding probed modes, preserve duplicate mode types

commit 2e9b11afdbfe17a9cc6356076179b7ea11972607
Merge: 95d0ad049cd6937634c0a75f9518f5166daabfce 17d42c1c497aa54952b9e58c1502a46f0df40315
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Aug 9 14:57:41 2009 -0700

    Merge branch 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'timers-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      posix_cpu_timers_exit_group(): Do not use thread_group_cputimer()

commit 95d0ad049cd6937634c0a75f9518f5166daabfce
Merge: 413dd8768ada25adbf53284696b71de7e7844969 f413cdb80ce00ec1a4d0ab949b5d96c81cae7f75
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Aug 9 14:57:26 2009 -0700

    Merge branch 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      perf_counter: Fix/complete ftrace event records sampling
      perf_counter, ftrace: Fix perf_counter integration
      tracing/filters: Always free pred on filter_add_subsystem_pred() failure
      tracing/filters: Don't use pred on alloc failure
      ring-buffer: Fix memleak in ring_buffer_free()
      tracing: Fix recordmcount.pl to handle sections with only weak functions
      ring-buffer: Fix advance of reader in rb_buffer_peek()
      tracing: do not use functions starting with .L in recordmcount.pl
      ring-buffer: do not disable ring buffer on oops_in_progress
      ring-buffer: fix check of try_to_discard result

commit 413dd8768ada25adbf53284696b71de7e7844969
Merge: 713e3e1875749f341247a0c922e6ddd38fbd991c fdb8a42742ac95606668f73481dfb2f760658fdd
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Aug 9 14:57:09 2009 -0700

    Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      x86: fix buffer overflow in efi_init()
      x86: Add quirk to make Apple MacBookPro5,1 use reboot=pci
      x86: Fix MSI-X initialization by using online_mask for x2apic target_cpus
      x86: Fix VMI && stack protector

commit 713e3e1875749f341247a0c922e6ddd38fbd991c
Merge: 7b2aa037e878c939676675969983284a02958ae3 0e692a94e378628b7d527260ad939894454bcca8
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Sun Aug 9 14:56:51 2009 -0700

    Merge branch 'core-fixes-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'core-fixes-for-linus-2' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      lockdep: Fix typos in documentation
      lockdep: Fix file mode of lock_stat
      rtmutex: Avoid deadlock in rt_mutex_start_proxy_lock()

commit c0a8865e32c8d1a562db38e06ef31ef23282f646
Author: Frederic Weisbecker <fweisbec at gmail.com>
Date:   Sun Aug 9 04:19:15 2009 +0200

    perf tools: callchain: Fix bad rounding of minimum rate
    
    Sometimes we get callchain branches that have a rate under the
    limit given by the user.
    
    Say you launched:
    
     perf record -f -g -a ./hackbench 10
     perf report -g fractal,10.0
    
    And you got:
    
    2.33%       hackbench  [kernel]                  [k] _spin_lock_irqsave
                    |
                    |--78.57%-- remove_wait_queue
                    |          poll_freewait
                    |          do_sys_poll
                    |          sys_poll
                    |          sysenter_dispatch
                    |          0xf7ffa430
                    |          0x1ffadea3c
                    |
                    |--7.14%-- __up_read
                    |          up_read
                    |          do_page_fault
                    |          page_fault
                    |          0xf7ffa430
                    |          0xa0df710000000a
                    ...
    
    It is abnormal to get a 7.14% branch whereas we passed a 10%
    filter.
    
    The problem is that we round down the minimum threshold. This
    happens mostly when we have very low number of events. If the
    total amount of your branch is 4 and you have a subranch of 3
    events, filtering to 90% will be computed like follows:
    
      limit = 4 * 0.9;
    
    The result is about 3.6, but the cast to integer will round
    down to 3. It means that our filter is actually of 75%
    
    We must then explicitly round up the minimum threshold.
    
    Reported-by: Ingo Molnar <mingo at elte.hu>
    Signed-off-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: acme at redhat.com
    Cc: peterz at infradead.org
    Cc: efault at gmx.de
    LKML-Reference: <20090809024235.GA10146 at nowhere>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 183f3b0887083d36c8a25cd5e3518906415d1889
Author: Mike Galbraith <efault at gmx.de>
Date:   Sat Aug 8 14:14:15 2009 +0200

    perf_counter tools: Fix libbfd detection for systems with libz dependency
    
    Due to a libz dependency in some distro's binutils package,
    C++ demangle support isn't compiled in despite the necessary
    libraries being available.
    
    Fix this by adding a -lz link test to the dependency detection
    rules.
    
    Signed-off-by: Mike Galbraith <efault at gmx.de>
    Acked-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    LKML-Reference: <1249733655.6929.5.camel at marge.simson.net>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit c24b513337f06712b8c81eb4f1413d44591dfee7
Author: Carlos R. Mafra <crmafra2 at gmail.com>
Date:   Wed Aug 5 20:53:34 2009 +0200

    perf: "Longum est iter per praecepta, breve et efficax per exempla"
    
    A few examples of how 'perf' can be used, from an e-mail by
    Ingo Molnar http://lkml.org/lkml/2009/8/4/346.
    
    Signed-off-by: Carlos R. Mafra <crmafra2 at gmail.com>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Valdis.Kletnieks at vt.edu
    LKML-Reference: <20090805185334.GA4535 at Pilar.aei.mpg.de>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 3a80b4a3539696f4b0574876326860323035a302
Author: Peter Zijlstra <a.p.zijlstra at chello.nl>
Date:   Fri Aug 7 19:49:01 2009 +0200

    perf_counter: Fix a race on perf_counter_ctx
    
    While extending perfcounters with BTS hw-tracing, Markus
    Metzger managed to trigger this warning:
    
       [  995.557128] WARNING: at kernel/perf_counter.c:1191 __perf_counter_task_sched_out+0x48/0x6b()
    
    triggers because commit
    9f498cc5be7e013d8d6e4c616980ed0ffc8680d2 (perf_counter: Full
    task tracing) removed clearing of tsk->perf_counter_ctxp out
    from under ctx->lock which introduced a race (against
    perf_lock_task_context).
    
    Move it back and deal with the exit notification by explicitly
    passing along the former task context.
    
    Reported-by: Markus T Metzger <markus.t.metzger at intel.com>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Paul Mackerras <paulus at samba.org>
    LKML-Reference: <1249667341.17467.5.camel at twins>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 3a43ce68ae1758fa6a839386025ef45acb6baa22
Author: Frederic Weisbecker <fweisbec at gmail.com>
Date:   Sat Aug 8 04:26:37 2009 +0200

    perf_counter: Fix tracepoint sampling to be part of generic sampling
    
    Based on Peter's comments, make tracepoint sampling generic
    just like all the other sampling bits are. This is a rename
    with no code changes:
    
    - PERF_SAMPLE_TP_RECORD to PERF_SAMPLE_RAW
    - struct perf_tracepoint_record to perf_raw_record
    
    We want the system in place that transport tracepoints raw
    samples events into the perf ring buffer to be generalized and
    usable by any type of counter.
    
    Reported-by; Peter Zijlstra <peterz at infradead.org>
    Signed-off-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Paul Mackerras <paulus at samba.org>
    LKML-Reference: <1249698400-5441-4-git-send-email-fweisbec at gmail.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 10b8e3066066708f304e0fc5cfe658e05abf943d
Author: Frederic Weisbecker <fweisbec at gmail.com>
Date:   Sat Aug 8 04:26:35 2009 +0200

    perf_counter: Work around gcc warning by initializing tracepoint record unconditionally
    
    Despite that the tracepoint record is always present when the
    PERF_SAMPLE_TP_RECORD flag is set, gcc raises a warning,
    thinking it might not be initialized:
    
      kernel/perf_counter.c: In function ‘perf_counter_output’:
      kernel/perf_counter.c:2650: warning: ‘tp’ may be used uninitialized in this function
    
    Then, initialize it to NULL and always check if it's not NULL
    before dereference it.
    
    Reported-by: Ingo Molnar <mingo at elte.hu>
    Signed-off-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Paul Mackerras <paulus at samba.org>
    LKML-Reference: <1249698400-5441-2-git-send-email-fweisbec at gmail.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 25446036cbfc2c89faacdb4fb4603943d2197dc6
Author: Frederic Weisbecker <fweisbec at gmail.com>
Date:   Sat Aug 8 02:16:25 2009 +0200

    perf tools: callchain: Fix sum of percentages to be 100% by displaying amount of ignored chains in fractal mode
    
    When we filter the callchains below a given percentage, we
    ignore them and the end result only shows entries that have an
    upper percentage than the filter threshold.
    
    It seems to users then that we have an imbalance in the
    percentage, as if the sum inside a profiled branch doesn't
    reach 100%.
    
    Since in the past there have been real perf report bugs that
    showed the same sypmtom, it would be nice to assure the user
    that the data is perfect and trustable and it all sums up to
    100.00%.
    
    So fix this by displaying the remaining hits that have been
    filtered but without more detail than their amount in each
    branches. Example while filtering below 50%:
    
    7.73%  [k] delay_tsc
                    |
                    |--98.22%-- __const_udelay
                    |          |
                    |          |--86.37%-- ath5k_hw_register_timeout
                    |          |          ath5k_hw_noise_floor_calibration
                    |          |          ath5k_hw_reset
                    |          |          ath5k_reset
                    |          |          ath5k_config
                    |          |          ieee80211_hw_config
                    |          |          |
                    |          |          |--88.53%-- ieee80211_scan_work
                    |          |          |          worker_thread
                    |          |          |          kthread
                    |          |          |          child_rip
                    |          |           --11.47%-- [...]
                    |           --13.63%-- [...]
                     --1.78%-- [...]
    
    Reported-by: Ingo Molnar <mingo at elte.hu>
    Signed-off-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Mike Galbraith <efault at gmx.de>
    LKML-Reference: <1249690585-9145-4-git-send-email-fweisbec at gmail.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit b1a88349c37624755b28ac3b3152b48f52c1f487
Author: Frederic Weisbecker <fweisbec at gmail.com>
Date:   Sat Aug 8 02:16:24 2009 +0200

    perf tools: callchain: Fix 'perf report' display to be callchain by default
    
    If we recorded with -g option to record the callchain, right now
    we require a -g option to perf report as well - and people reported
    this as unnecessary complication: the user already specified -g
    once, no need to require it a second time.
    
    So if the recording includes call-chains, display the callchain by
    default from perf report.
    
    ( The user can override this default using "-g none" option from
      perf report. )
    
    Reported-by: Ingo Molnar <mingo at elte.hu>
    Signed-off-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Mike Galbraith <efault at gmx.de>
    LKML-Reference: <1249690585-9145-3-git-send-email-fweisbec at gmail.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit b0efe213f84f7fd5ccfe07053e3d9fb827b7c188
Author: Frederic Weisbecker <fweisbec at gmail.com>
Date:   Sat Aug 8 02:16:23 2009 +0200

    perf tools: callchain: Fix spurious 'perf report' warnings: ignore empty callchains
    
    When the callchain tree comes to insert an empty backtrace, it
    raises a spurious warning about the fact we are inserting an
    empty. This is spurious because the radix tree assumes it did
    something wrong to reach this state. But it didn't, we just met
    an empty callchain that has to be ignored.
    
    This happens occasionally with certain types of call-chain
    recordings. If it happens it's a big nuisance as perf report
    output starts with thousands of warning lines.
    
    Reported-by: Ingo Molnar <mingo at elte.hu>
    Signed-off-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Mike Galbraith <efault at gmx.de>
    LKML-Reference: <1249690585-9145-2-git-send-email-fweisbec at gmail.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 266e0e219888420a1a7cafc82e82891cf7b5a979
Author: Pierre Habouzit <pierre.habouzit at intersec.com>
Date:   Fri Aug 7 14:16:01 2009 +0200

    perf record: Fix the -A UI for empty or non-existent perf.data
    
    1. Ignore the -A argument if there is no perf.data file
    2. Treat an empty file like a non existent file.
    
    Else, perf will try to read the perf.data header, and fail with
    an error.
    
    Treating an empty file like a non-existent file makes sense,
    since an interupted (as in SIGKILLed) perf could leave such
    files around, and you don't want to annoy the user with errors
    for files with no data in it.
    
    Signed-off-by: Pierre Habouzit <pierre.habouzit at intersec.com>
    Acked-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Paul Mackerras <paulus at samba.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 7eac7e9e726c1b136bd7e0ad6671ce315f48bb18
Author: Pierre Habouzit <pierre.habouzit at intersec.com>
Date:   Fri Aug 7 14:16:00 2009 +0200

    perf util: Fix do_read() to fail on EOF instead of busy-looping
    
    While toying with perf, I've noticed that perf record can
    easily enter a busy loop when doing something as silly as:
    
        $ perf record -A ls
    
    Yeah, do_read here really wants to read a known size, not being
    able to should die(), not busy-loop ;)
    
    That was the cause for the bug.
    
    Signed-off-by: Pierre Habouzit <pierre.habouzit at intersec.com>
    Acked-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Paul Mackerras <paulus at samba.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit ae07b63f4b6728e1f98aa5c5416cfc1280f59f51
Author: Peter Zijlstra <peterz at infradead.org>
Date:   Thu Aug 6 16:48:54 2009 +0200

    perf list: Fix the output to not include tracepoints without an id
    
    Stop perf list from displaying tracepoints without an id file,
    those are special tracepoints that are not interfaced to
    perfcounters so listing them is erroneous and passing them as
    events will produce no output.
    
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Acked-by: Jason Baron <jbaron at redhat.com>
    Cc: Steven Rostedt <rostedt at goodmis.org>
    Cc: Chris Mason <chris.mason at oracle.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit f36a1a133a947973efb8e6a1fbdcc23e4a011437
Author: Paul Mackerras <paulus at samba.org>
Date:   Fri Aug 7 16:59:45 2009 +1000

    perf_counter/powerpc: Fix oops on cpus without perf_counter hardware support
    
    If we have the powerpc perf_counter backend compiled in, but
    the cpu we are running on is one where we don't support the
    PMU, we currently oops in hw_perf_group_sched_in if we try to
    use any counters, because ppmu is NULL in that case, and we
    unconditionally dereference ppmu.
    
    This fixes the problem by adding a check if ppmu is NULL at the
    beginning of hw_perf_group_sched_in, and also at the beginning
    of the other functions that get called from the perf_counter
    core, i.e. hw_perf_disable, hw_perf_enable, and
    hw_perf_counter_setup.
    
    Signed-off-by: Paul Mackerras <paulus at samba.org>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: benh at kernel.crashing.org
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit b26bc5a7f81474937e427b0c855eabee5ad56f89
Author: Brice Goglin <Brice.Goglin at inria.fr>
Date:   Fri Aug 7 10:18:39 2009 +0200

    perf stat: Fix tool option consistency: rename -S/--scale to -c/--scale
    
    We want to use a coherent flag for -S/--stat across all tools,
    so free up -S in perf stat.
    
    Signed-off-by: Brice Goglin <Brice.Goglin at inria.fr>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: paulus at samba.org
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 94cb9e385d5b4d55a5ae389baa10ad2835ea39bb
Author: Arnaldo Carvalho de Melo <acme at redhat.com>
Date:   Thu Aug 6 14:43:17 2009 -0300

    perf report: Add debug help for the finding of symbol bugs - show the symtab origin (DSO, build-id, kernel, etc)
    
    Used with perf report --verbose:
    
    [acme at doppio linux-2.6-tip]$ perf report -v | head -16
         5.17%  firefox  /usr/lib64/xulrunner-1.9.1/libxul.so   0x00000000005d8eee f [.] imgContainer::DrawFrameTo(gfxIImageFrame*, gfxIImageFrame*, nsRect&)
         2.56%  firefox  /lib64/libpthread-2.10.1.so            0x0000000000008e02 d [.] __pthread_mutex_lock_internal
         1.94%  firefox  /usr/lib64/xulrunner-1.9.1/libxul.so   0x0000000000d0af8f f [.] SearchTable
         1.75%  firefox  [kernel]                               0xffffffffff60013b k [.] vread_hpet
         1.63%  firefox  /lib64/libpthread-2.10.1.so            0x000000000000a404 d [.] __pthread_mutex_unlock
         1.47%  firefox  /usr/lib64/xulrunner-1.9.1/libmozjs.so 0x00000000000482ea f [.] js_Interpret
         1.42%  firefox  /usr/lib64/xulrunner-1.9.1/libmozjs.so 0x000000000003eda3 f [.] JS_CallTracer
         1.24%  firefox  [kernel]                               0xffffffff8102ca4a k [k] read_hpet
         1.16%  firefox  [kernel]                               0xffffffff810f3dd4 k [k] fget_light
         1.11%  firefox  /usr/lib64/xulrunner-1.9.1/libmozjs.so 0x00000000000567ff f [.] js_TraceObject
         0.98%  firefox  /usr/lib64/firefox-3.5.2/firefox       0x000000000000dd23 b [.] arena_ralloc
    [acme at doppio linux-2.6-tip]$
    
    The new field is just after the symbol address. To help in
    figuring out symbol resolution bugs.
    
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>
    Acked-by: Peter Zijlstra <peterz at infradead.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 8f18aec535b5ca513dd13b531730177d35175ffa
Author: Peter Zijlstra <a.p.zijlstra at chello.nl>
Date:   Thu Aug 6 19:40:28 2009 +0200

    perf report: Fix per task mult-counter stat reporting
    
    Brice Goglin reported:
    
    > I can easily sort them by thread id, but I don't know how to match
    > my 4 events with each group of 4 lines.
    
    Also report the counter id and the time running/enabled
    stats (in case the counter got time-shared).
    
    Reported-by: Brice Goglin <Brice.Goglin at inria.fr>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Tested-by: Brice Goglin <Brice.Goglin at inria.fr>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 1c222bce7dd0cb9578b4c5cd3874a74f1db497c3
Author: Peter Zijlstra <a.p.zijlstra at chello.nl>
Date:   Thu Aug 6 20:57:41 2009 +0200

    perf tools: Fix multi-counter stat bug caused by incorrect reading of perf.data file header
    
    Brice Goglin reported that only the first result from a
    multi-counter perf record --stat run is accurate, the
    rest looks bogus.
    
    A silly mistake made us re-read the first attribute for
    every recorded attribute.
    
    Reported-by: Brice Goglin <Brice.Goglin at inria.fr>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Tested-by: Brice Goglin <Brice.Goglin at inria.fr>
    Cc: paulus at samba.org
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 1953287bfe8afcbbd235bd6c42c9df06d52438dc
Author: Frederic Weisbecker <fweisbec at gmail.com>
Date:   Fri Aug 7 07:11:05 2009 +0200

    perf tools: Fix call-chain cumul hit based sub-total (fractal mode)
    
    The callchain fractal mode builds each new total hits in a new
    branch of profiling by using the parent's hits of the current
    branch plus the hits of the children.
    
    This is wrong, the total hits of a branch should be made of the
    sum of every children hits, we must ignore the parent hits in
    this scope.
    
    This patch also fixes another mistake with the hit counting.
    
    Now the rates are correct.
    
    Signed-off-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Pekka Enberg <penberg at cs.helsinki.fi>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 836179834833272f89098c6d1e1b89e8e69797c2
Author: Mike Galbraith <efault at gmx.de>
Date:   Tue Aug 4 10:24:41 2009 +0200

    perf top: Update man page
    
    perf_counter tools: update perf top manual page to reflect
    current implementation.
    
    Signed-off-by: Mike Galbraith <efault at gmx.de>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 091bd2e993fcb1094a23e36157285b62bc87afdf
Author: Mike Galbraith <efault at gmx.de>
Date:   Tue Aug 4 10:21:23 2009 +0200

    perf top: Improve interactive key handling
    
    Pressing any key which is not currently mapped to
    functionality, based on startup command line options, displays
    currently mapped keys, and prompts for input.
    
    Pressing any unmapped key at the prompt returns the user to
    display mode with variables unchanged.  eg, pressing ? <SPACE>
    <ESC> etc displays currently available keys, the value of the
    variable associated with that key, and prompts.
    
    Pressing same again aborts input.
    
    Signed-off-by: Mike Galbraith <efault at gmx.de>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 7b4b6658e152ed4568cfff48175d93645df081d1
Author: Peter Zijlstra <a.p.zijlstra at chello.nl>
Date:   Wed Jul 22 09:29:32 2009 +0200

    perf_counter: Fix software counters for fast moving event sources
    
    Reimplement the software counters to deal with fast moving
    event sources (such as tracepoints). This means being able
    to generate multiple overflows from a single 'event' as well
    as support throttling.
    
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Paul Mackerras <paulus at samba.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 46ab976443c6c566c8fe6fc72a6733a55ba9fbea
Author: Mike Galbraith <efault at gmx.de>
Date:   Fri Jul 24 10:09:50 2009 +0200

    perf_counter tools: Allow perf top top users to switch between weighted and individual counter display
    
    Add [w]eighted hotkey.  Pressing [w] toggles between displaying
    weighted total of all counters, and the counter selected via
    [E]vent select key.
    
    ------------------------------------------------------------------------------
       PerfTop:   90395 irqs/sec  kernel:16.1% [cache-misses/cache-references/instructions],  (all, 4 CPUs)
    ------------------------------------------------------------------------------
    
      weight     samples    pcnt         RIP          kernel function
      ______     _______   _____   ________________   _______________
    
    1275408.6      10881 -  5.3% - ffffffff81146f70 : copy_page_c
     553683.4      43569 - 21.3% - ffffffff81146f20 : clear_page_c
      74075.0       6768 -  3.3% - ffffffff81147190 : copy_user_generic_string
      40602.9       7538 -  3.7% - ffffffff81284ba2 : _spin_lock
      26882.1        965 -  0.5% - ffffffff8109d280 : file_ra_state_init
    
    [w]
    
    ------------------------------------------------------------------------------
       PerfTop:   91221 irqs/sec  kernel:14.5% [10000Hz cache-misses],  (all, 4 CPUs)
    ------------------------------------------------------------------------------
    
      weight     samples    pcnt         RIP          kernel function
      ______     _______   _____   ________________   _______________
    
                47320.00 - 22.3% - ffffffff81146f20 : clear_page_c
                14261.00 -  6.7% - ffffffff810992f5 : __rmqueue
                11046.00 -  5.2% - ffffffff81146f70 : copy_page_c
                 7842.00 -  3.7% - ffffffff81284ba2 : _spin_lock
                 7234.00 -  3.4% - ffffffff810aa1d6 : unmap_vmas
    
    Signed-off-by: Mike Galbraith <efault at gmx.de>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 923c42c19944da214d697e312a040384a0e33e78
Author: Mike Galbraith <efault at gmx.de>
Date:   Wed Jul 22 20:36:03 2009 +0200

    perf_counter tools: Fix/resurrect perf top annotation in a simple interactive form
    
    perf top used to have annotation support, but it has bitrotted and
    removed.
    
    This patch restores that: it allows the user to select any symbol
    in kernel space for source level annotation on the fly, switch
    between event counters and alter display variables. When symbol
    details are being displayed, stopping annotation reverts to normal.
    
    known keys:
            [d]     select display delay.
            [e]     select display entries (lines).
            [E]     select annotation event counter.
            [f]     select normal display count filter.
            [F]     select annotation display count filter (percentage).
            [qQ]    quit.
            [s]     select annotation symbol and start annotation.
            [S]     stop annotation, revert to normal display.
            [z]     toggle event count zeroing.
    
    Sample:
    ------------------------------------------------------------------------------
       PerfTop:   16719 irqs/sec  kernel:78.7% [cache-misses/cache-references/instructions/cycles],  (all, 4 CPUs)
    ------------------------------------------------------------------------------
    
    Showing cache-misses for e1000_clean_rx_irq
      Events  Pcnt (>=3%)
           0  0.0%                  /* adjust length to remove Ethernet CRC */
           0  0.0%                  if (!(adapter->flags2 & FLAG2_CRC_STRIPPING))
           0  0.0%                          length -= 4;
         436  5.0%      f039:       41 f6 84 24 5c 29 00    testb  $0x1,0x295c(%r12)
           0  0.0%      f089:       8b 4d 84                mov    -0x7c(%rbp),%ecx
           0  0.0%      f08c:       48 83 ef 02             sub    $0x2,%rdi
           0  0.0%      f090:       48 83 ee 02             sub    $0x2,%rsi
         811  9.3%      f094:       f3 a4                   rep movsb %ds:(%rsi),%es:(%rdi)
           0  0.0%
           0  0.0%          while (rx_desc->status & E1000_RXD_STAT_DD) {
           0  0.0%      f114:       41 f6 47 0c 01          testb  $0x1,0xc(%r15)
        7226 82.6%      f119:       0f 85 24 fe ff ff       jne    ef43 <e1000_clean_rx_irq+0x84>
    
    Available events:
            0 cache-misses
            1 cache-references
            2 instructions
            3 cycles
    Enter details event counter: 2
    ------------------------------------------------------------------------------
       PerfTop:   15035 irqs/sec  kernel:79.0% [cache-misses/cache-references/instructions/cycles],  (all, 4 CPUs)
    ------------------------------------------------------------------------------
    
    Showing instructions for e1000_clean_rx_irq
      Events  Pcnt (>=3%)
           0  0.0%                                 int *work_done, int work_to_do)
           0  0.0%  {
         175  0.9%      eebf:       55                      push   %rbp
        1898  9.8%      eec0:       48 89 e5                mov    %rsp,%rbp
           0  0.0%
           0  0.0%          i = rx_ring->next_to_clean;
         140  0.7%      ef0a:       0f b7 41 1a             movzwl 0x1a(%rcx),%eax
         670  3.4%      ef0e:       89 45 ac                mov    %eax,-0x54(%rbp)
           0  0.0%  {
           0  0.0%          memcpy(skb->data + offset, from, len);
          91  0.5%      f07b:       49 8b b6 e8 00 00 00    mov    0xe8(%r14),%rsi
        1153  5.9%      f082:       48 8b b8 e8 00 00 00    mov    0xe8(%rax),%rdi
          42  0.2%      f089:       8b 4d 84                mov    -0x7c(%rbp),%ecx
          14  0.1%      f08c:       48 83 ef 02             sub    $0x2,%rdi
           0  0.0%      f090:       48 83 ee 02             sub    $0x2,%rsi
        1618  8.3%      f094:       f3 a4                   rep movsb %ds:(%rsi),%es:(%rdi)
           0  0.0%
           0  0.0%                  /* return some buffers to hardware, one at a time is too slow */
           0  0.0%                  if (cleaned_count >= E1000_RX_BUFFER_WRITE) {
         867  4.5%      f0e7:       83 7d b0 0f             cmpl   $0xf,-0x50(%rbp)
           0  0.0%
           0  0.0%          while (rx_desc->status & E1000_RXD_STAT_DD) {
          37  0.2%      f114:       41 f6 47 0c 01          testb  $0x1,0xc(%r15)
        4047 20.8%      f119:       0f 85 24 fe ff ff       jne    ef43 <e1000_clean_rx_irq+0x84>
    
    Signed-off-by: Mike Galbraith <efault at gmx.de>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Paul Mackerras <paulus at samba.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit f413cdb80ce00ec1a4d0ab949b5d96c81cae7f75
Author: Frederic Weisbecker <fweisbec at gmail.com>
Date:   Fri Aug 7 01:25:54 2009 +0200

    perf_counter: Fix/complete ftrace event records sampling
    
    This patch implements the kernel side support for ftrace event
    record sampling.
    
    A new counter sampling attribute is added:
    
       PERF_SAMPLE_TP_RECORD
    
    which requests ftrace events record sampling. In this case
    if a PERF_TYPE_TRACEPOINT counter is active and a tracepoint
    fires, we emit the tracepoint binary record to the
    perfcounter event buffer, as a sample.
    
    Result, after setting PERF_SAMPLE_TP_RECORD attribute from perf
    record:
    
     perf record -f -F 1 -a -e workqueue:workqueue_execution
     perf report -D
    
     0x21e18 [0x48]: event: 9
     .
     . ... raw event: size 72 bytes
     .  0000:  09 00 00 00 01 00 48 00 d0 c7 00 81 ff ff ff ff  ......H........
     .  0010:  0a 00 00 00 0a 00 00 00 21 00 00 00 00 00 00 00  ........!......
     .  0020:  2b 00 01 02 0a 00 00 00 0a 00 00 00 65 76 65 6e  +...........eve
     .  0030:  74 73 2f 31 00 00 00 00 00 00 00 00 0a 00 00 00  ts/1...........
     .  0040:  e0 b1 31 81 ff ff ff ff                          .......
    .
    0x21e18 [0x48]: PERF_EVENT_SAMPLE (IP, 1): 10: 0xffffffff8100c7d0 period: 33
    
    The raw ftrace binary record starts at offset 0020.
    
    Translation:
    
     struct trace_entry {
    	type		= 0x2b = 43;
    	flags		= 1;
    	preempt_count	= 2;
    	pid		= 0xa = 10;
    	tgid		= 0xa = 10;
     }
    
     thread_comm = "events/1"
     thread_pid  = 0xa = 10;
     func	    = 0xffffffff8131b1e0 = flush_to_ldisc()
    
    What will come next?
    
     - Userspace support ('perf trace'), 'flight data recorder' mode
       for perf trace, etc.
    
     - The unconditional copy from the profiling callback brings
       some costs however if someone wants no such sampling to
       occur, and needs to be fixed in the future. For that we need
       to have an instant access to the perf counter attribute.
       This is a matter of a flag to add in the struct ftrace_event.
    
     - Take care of the events recursivity! Don't ever try to record
       a lock event for example, it seems some locking is used in
       the profiling fast path and lead to a tracing recursivity.
       That will be fixed using raw spinlock or recursivity
       protection.
    
     - [...]
    
     - Profit! :-)
    
    Signed-off-by: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Li Zefan <lizf at cn.fujitsu.com>
    Cc: Tom Zanussi <tzanussi at gmail.com>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Mike Galbraith <efault at gmx.de>
    Cc: Steven Rostedt <rostedt at goodmis.org>
    Cc: Paul Mackerras <paulus at samba.org>
    Cc: Pekka Enberg <penberg at cs.helsinki.fi>
    Cc: Gabriel Munteanu <eduard.munteanu at linux360.ro>
    Cc: Lai Jiangshan <laijs at cn.fujitsu.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 3a6593050fbd8bbcaed3a44d01c31d907315c86c
Author: Peter Zijlstra <a.p.zijlstra at chello.nl>
Date:   Tue Jul 21 17:34:57 2009 +0200

    perf_counter, ftrace: Fix perf_counter integration
    
    Adds possible second part to the assign argument of TP_EVENT().
    
      TP_perf_assign(
    	__perf_count(foo);
    	__perf_addr(bar);
      )
    
    Which, when specified make the swcounter increment with @foo instead
    of the usual 1, and report @bar for PERF_SAMPLE_ADDR (data address
    associated with the event) when this triggers a counter overflow.
    
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Acked-by: Steven Rostedt <rostedt at goodmis.org>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Jason Baron <jbaron at redhat.com>
    Cc: Paul Mackerras <paulus at samba.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit e3560336be655c6791316482fe288b119f34c427
Merge: 26528e773ecc74fb1b61b7275f86f761cbb340ec 7b2aa037e878c939676675969983284a02958ae3
Author: Ingo Molnar <mingo at elte.hu>
Date:   Sun Aug 9 12:46:45 2009 +0200

    Merge branch 'linus' into tracing/urgent
    
    Merge reason: Merge up to almost-rc6 to pick up latest perfcounters
                  (on which we'll queue up a dependent fix)
    
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit b4a2f5e723e4f7df46731106faf9e2405673c073
Author: Gleb Natapov <gleb at redhat.com>
Date:   Sun Jul 5 18:48:11 2009 +0300

    KVM: Avoid redelivery of edge interrupt before next edge
    
    The check for an edge is broken in current ioapic code. ioapic->irr is
    cleared on each edge interrupt by ioapic_service() and this makes
    old_irr != ioapic->irr condition in kvm_ioapic_set_irq() to be always
    true. The patch fixes the code to properly recognise edge.
    
    Some HW emulation calls set_irq() without level change. If each such
    call is propagated to an OS it may confuse a device driver. This is the
    case with keyboard device emulation and Windows XP x64  installer on SMP VM.
    Each keystroke produce two interrupts (down/up) one interrupt is
    submitted to CPU0 and another to CPU1. This confuses Windows somehow
    and it ignores keystrokes.
    
    Signed-off-by: Gleb Natapov <gleb at redhat.com>
    Signed-off-by: Avi Kivity <avi at redhat.com>

commit fdb8a42742ac95606668f73481dfb2f760658fdd
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Thu Aug 6 15:58:13 2009 -0700

    x86: fix buffer overflow in efi_init()
    
    If the vendor name (from c16) can be longer than 100 bytes (or missing a
    terminating null), then the null is written past the end of vendor[].
    
    Found with Parfait, http://research.sun.com/projects/parfait/
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Cc: Ingo Molnar <mingo at elte.hu>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: H. Peter Anvin <hpa at zytor.com>
    Cc: Huang Ying <ying.huang at intel.com>

commit 6cb504c29b1338925c83e4430e42a51eaa43781e
Author: Frans Pop <elendil at planet.nl>
Date:   Sun Aug 9 12:25:29 2009 +1000

    drm/i915: silence vblank warnings
    
    these errors are pretty pointless
    
    Reviewed-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 8d3457ec3198a569dd14dc9e3ae8b6163bcaa0b5
Author: Paul Rolland <rol at as2917.net>
Date:   Sun Aug 9 12:24:01 2009 +1000

    drm: silence pointless vblank warning.
    
    Some applications/hardware combinations are triggering the message "failed to
    acquire vblank counter" to be issued up to 20 times a second, which makes it
    both useless and dangerous, as this may hide other important messages.
    This changes makes it only appear when people are debugging.
    
    Signed-off-by: Paul Rolland <rol at as2917.net>
    Reviewed-by: Jesse Barnes <jbarnes at virtuousgeek.org>
    Lost-twice-by: Dave Airlie <airlied at redhat.com>
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 38d5487db7f289be1d56ac7df704ee49ed3213b9
Author: Keith Packard <keithp at keithp.com>
Date:   Mon Jul 20 14:49:17 2009 -0700

    drm: When adding probed modes, preserve duplicate mode types
    
    The code which takes probed modes and adds them to a connector eliminates
    duplicate modes by comparing them using drm_mode_equal. That function
    doesn't consider the type bits, which means that any modes which differ only
    in the type field will be lost.
    
    One of the bits in the mode->type field is the DRM_MODE_TYPE_PREFERRED bit.
    If the mode with that bit is lost, then higher level code will not know
    which mode to select, causing a random mode to be used instead.
    
    This patch simply merges the two mode type bits together; that seems
    reasonable to me, but perhaps only a subset of the bits should be used? None
    of these can be user defined as they all come from looking at just the
    hardware.
    
    Signed-off-by: Keith Packard <keithp at keithp.com>
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 17d42c1c497aa54952b9e58c1502a46f0df40315
Author: Stanislaw Gruszka <sgruszka at redhat.com>
Date:   Thu Aug 6 16:03:30 2009 -0700

    posix_cpu_timers_exit_group(): Do not use thread_group_cputimer()
    
    When the process exits we don't have to run new cputimer nor
    use running one (as it not accounts when tsk->exit_state != 0)
    to get process CPU times.  As there is only one thread we can
    just use CPU times fields from task and signal structs.
    
    Signed-off-by: Stanislaw Gruszka <sgruszka at redhat.com>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Roland McGrath <roland at redhat.com>
    Cc: Vitaly Mayatskikh <vmayatsk at redhat.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 26528e773ecc74fb1b61b7275f86f761cbb340ec
Author: Tom Zanussi <tzanussi at gmail.com>
Date:   Sat Aug 8 10:49:53 2009 -0500

    tracing/filters: Always free pred on filter_add_subsystem_pred() failure
    
    If filter_add_subsystem_pred() fails due to ENOSPC or ENOMEM,
    the pred doesn't get freed, while as a side effect it does for
    other errors. Make it so the caller always frees the pred for
    any error.
    
    Signed-off-by: Tom Zanussi <tzanussi at gmail.com>
    Cc: Steven Rostedt <rostedt at goodmis.org>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Li Zefan <lizf at cn.fujitsu.com>
    LKML-Reference: <1249746593.6453.32.camel at tropicana>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 96b2de313b1e0e02aea80ee47df6a2b5cbdf8e13
Author: Tom Zanussi <tzanussi at gmail.com>
Date:   Sat Aug 8 10:49:09 2009 -0500

    tracing/filters: Don't use pred on alloc failure
    
    Dan Carpenter sent me a fix to prevent pred from being used if
    it couldn't be allocated.  I noticed the same problem also
    existed for the create_pred() case and added a fix for that.
    
    Reported-by: Dan Carpenter <error27 at gmail.com>
    Signed-off-by: Tom Zanussi <tzanussi at gmail.com>
    Cc: Steven Rostedt <rostedt at goodmis.org>
    Cc: Frederic Weisbecker <fweisbec at gmail.com>
    Cc: Li Zefan <lizf at cn.fujitsu.com>
    LKML-Reference: <1249746549.6453.29.camel at tropicana>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 498cdbfbcf98e0d2c90a26e6a02a82f043876e48
Author: Ozan Çağlayan <ozan at pardus.org.tr>
Date:   Tue Aug 4 19:39:31 2009 +0300

    x86: Add quirk to make Apple MacBookPro5,1 use reboot=pci
    
    MacBookPro5,1 is not able to reboot unless reboot=pci is set.
    This patch forces it through a DMI quirk specific to this
    device.
    
    Signed-off-by: Ozan Çağlayan <ozan at pardus.org.tr>
    LKML-Reference: <1249403971-6543-1-git-send-email-ozan at pardus.org.tr>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit ad7d6c7a0654a4bbda3e109f56af713267e96274
Author: Yinghai Lu <yinghai at kernel.org>
Date:   Tue Aug 4 09:01:33 2009 -0700

    x86/irq: Fix move_irq_desc() for nodes without ram
    
    Don't move it if target node is -1.
    
    Signed-off-by: Yinghai Lu <yinghai at kernel.org>
    LKML-Reference: <4A785B5D.4070702 at kernel.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 087d7e56deffb611a098e7e257388a41edbeef1f
Author: Yinghai Lu <yinghai at kernel.org>
Date:   Tue Aug 4 08:59:59 2009 -0700

    x86: Fix MSI-X initialization by using online_mask for x2apic target_cpus
    
    found a system where x2apic reports an MSI-X irq initialization
    failure:
    
    [  302.859446] igbvf 0000:81:10.4: enabling device (0000 -> 0002)
    [  302.874369] igbvf 0000:81:10.4: using 64bit DMA mask
    [  302.879023] igbvf 0000:81:10.4: using 64bit consistent DMA mask
    [  302.894386] igbvf 0000:81:10.4: enabling bus mastering
    [  302.898171] igbvf 0000:81:10.4: setting latency timer to 64
    [  302.914050] reserve_memtype added 0xefb08000-0xefb0c000, track uncached-minus, req uncached-minus, ret uncached-minus
    [  302.933839] reserve_memtype added 0xefb28000-0xefb29000, track uncached-minus, req uncached-minus, ret uncached-minus
    [  302.940367]   alloc irq_desc for 265 on node 4
    [  302.956874]   alloc kstat_irqs on node 4
    [  302.959452] alloc irq_2_iommu on node 0
    [  302.974328] igbvf 0000:81:10.4: irq 265 for MSI/MSI-X
    [  302.977778]   alloc irq_desc for 266 on node 4
    [  302.980347]   alloc kstat_irqs on node 4
    [  302.995312] free_memtype request 0xefb28000-0xefb29000
    [  302.998816] igbvf 0000:81:10.4: Failed to initialize MSI-X interrupts.
    
    ... it turns out that when trying to enable MSI-X,
    __assign_irq_vector(new, cfg_new, apic->target_cpus()) can not
    get vector because for x2apic target-cpus returns cpumask_of(0)
    
    Update that to online_mask like xapic.
    
    Signed-off-by: Yinghai Lu <yinghai at kernel.org>
    Acked-by: Suresh Siddha <suresh.b.siddha at intel.com>
    LKML-Reference: <4A785AFF.3050902 at kernel.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 7b2aa037e878c939676675969983284a02958ae3
Merge: 710ad849ae76bc2f938a885e928b90cdbbe61a6e cf7fdd57f978d40ceb9a0f58a25f5cf9c84d6f33
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 7 19:06:36 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6:
      USB: fix oops on disconnect in cdc-acm
      USB: storage: include Prolific Technology USB drive in unusual_devs list
      USB: ftdi_sio: add product_id for Marvell OpenRD Base, Client
      USB: ftdi_sio: add vendor and product id for Bayer glucose meter serial converter cable
      USB: EHCI: fix counting of transaction error retries
      USB: EHCI: fix two new bugs related to Clear-TT-Buffer
      USB: usbfs: fix -ENOENT error code to be -ENODEV
      USB: musb: fix the nop registration for OMAP3EVM
      USB: devio: Properly do access_ok() checks
      USB: pl2303: New vendor and product id

commit 710ad849ae76bc2f938a885e928b90cdbbe61a6e
Merge: b32b8e645ea764620ececc0c9a66a7fc08536d4d 749d00dbf154fc2f9ac59df669205039de0d5b45
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 7 19:06:13 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6:
      Staging: rspiusb: Fix buffer overflow
      staging: add dependencies on PCI for drivers that require it
      Staging: rtl8192su: fix build error
      Staging: rt2870: Revert d44ca7 Removal of kernel_thread() API
      Staging: rt2870: Add USB ID for Linksys, Planex Communications, Belkin

commit b32b8e645ea764620ececc0c9a66a7fc08536d4d
Merge: d6a0967c90dced0a8baf502e6f3d5862fd5a5805 819e0064634f580ab618189e657ea58341d214b7
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 7 19:03:59 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel: (22 commits)
      drm/i915: Fix read outside array bounds in restoring the SWF10 range.
      drm/i915: Use our own workqueue to avoid wedging the system along with the GPU.
      drm/i915: Add support for dual-channel LVDS on 8xx.
      drm/i915: Return disconnected for SDVO DVI when there's no digital EDID.
      drm/i915: Choose real sdvo output according to result from detection
      drm/i915: Set preferred mode for integrated TV according to TV format
      drm/i915: fix 845G FIFO size & burst length
      drm/i915: fix VGA detect on IGDNG
      drm/i915: Add eDP support on IGDNG mobile chip
      drm/i915: enable DisplayPort support on IGDNG
      drm/i915: Fix channel ending action for DP aux transaction
      drm/i915: fix issue in display pipe setup on IGDNG
      drm/i915: disable VGA plane reliably
      drm/I915: Fix offset to DVO timings in LVDS data
      drm/i915: hdmi detection according by reading edid
      drm/i915: correct self-refresh calculation in "everything off" case
      drm/i915: handle FIFO oversubsription correctly
      drm/i915: FIFO watermark calculation fixes
      drm/i915: ignore lvds on AOpen Mini PC MP-915
      drm/i915: Allow frame buffers up to 4096x4096 on 915/945 class hardware
      ...

commit d6a0967c90dced0a8baf502e6f3d5862fd5a5805
Merge: fb385003c4ac9634cf2448f6ded81e5fd1190c1f ceab36edd3d3ad3ffd01d41d6d1e05ac1ff8357e
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 7 19:03:09 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable:
      Btrfs: fix balancing oops when invalidate_inode_pages2 returns EBUSY
      Btrfs: correct error-handling zlib error handling
      Btrfs: remove superfluous NULL pointer check in btrfs_rename()
      Btrfs: make sure the async caching thread advances the key
      Btrfs: fix btrfs_remove_from_free_space corner case

commit fb385003c4ac9634cf2448f6ded81e5fd1190c1f
Merge: 36b8659f9316b24c514a7c8290596b2382b91dd2 b36ec0428a06fcbdb67d61e9e664154e5dd9a8c7
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 7 18:53:44 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/hch/xfs-icache-races
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/hch/xfs-icache-races:
      xfs: fix freeing of inodes not yet added to the inode cache
      vfs: add __destroy_inode
      vfs: fix inode_init_always calling convention

commit 749d00dbf154fc2f9ac59df669205039de0d5b45
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Fri Aug 7 21:00:10 2009 +0200

    Staging: rspiusb: Fix buffer overflow
    
    usb_buffer_map_sg() may return -1. This will result in a read from
    pdx->PixelUrb[frameInfo][-1]
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit 5fb4d2525b6dcffbb8bc26a7dfc7ed17ad323a06
Author: Jeff Mahoney <jeffm at suse.com>
Date:   Fri Aug 7 16:12:03 2009 -0700

    staging: add dependencies on PCI for drivers that require it
    
    This patch adds PCI dependencies to staging drivers that require it.
    
    Signed-off-by: Jeff Mahoney <jeffm at suse.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit ce9c010c5c39df05ed81a06aba492c45ee0c6f19
Author: Greg Kroah-Hartman <gregkh at suse.de>
Date:   Tue Aug 4 16:53:36 2009 -0700

    Staging: rtl8192su: fix build error
    
    This fixes a build error when selecting the rtl8192su driver as a
    module.  This has been reported by me, and the opensuse kernel developer
    team, and I finally tracked it down.
    
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit 2c63abf9e8a51dec886da482dfd8ae752581a61c
Author: Mike Galbraith <efault at gmx.de>
Date:   Fri Jul 31 07:14:04 2009 +0200

    Staging: rt2870: Revert d44ca7 Removal of kernel_thread() API
    
    Staging: rt2870: Revert d44ca7 Removal of kernel_thread() API
    
    The sanity check this patch introduced triggers on shutdown, apparently due to
    threads having already exited by the time BUG_ON() is reached.
    
    Signed-off-by: Mike Galbraith <efault at gmx.de>
    Cc: Peter Teoh <htmldeveloper at gmail.com>
    Cc: stable <stable at kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit 4d2da07bc876fc5bc455e0721df388a3db7e4ba5
Author: Jakob Gruber <jakob.gruber at kabelnet.at>
Date:   Thu Jul 30 20:37:36 2009 +0200

    Staging: rt2870: Add USB ID for Linksys, Planex Communications, Belkin
    
    Linksys WUSB100, Belkin F5D8053 N, Planex Communications unknown model.
    
    Signed-off-by: Jakob Gruber <jakob.gruber at kabelnet.at>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit cf7fdd57f978d40ceb9a0f58a25f5cf9c84d6f33
Author: Oliver Neukum <oliver at neukum.org>
Date:   Tue Aug 4 23:52:09 2009 +0200

    USB: fix oops on disconnect in cdc-acm
    
    This patch fixes an oops caused when during an unplug a device's table
    of endpoints is zeroed before the driver is notified. A pointer to
    the endpoint must be cached.
    
    this fixes a regression caused by commit
    5186ffee2320942c3dc9745f7930e0eb15329ca6
    Therefore it should go into 2.6.31
    
    Signed-off-by: Oliver Neukum <oliver at neukum.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit c15e3ca1d822abba78c00b1ffc3e7b382a50396e
Author: Rogerio Brito <rbrito at ime.usp.br>
Date:   Thu Aug 6 15:20:19 2009 -0700

    USB: storage: include Prolific Technology USB drive in unusual_devs list
    
    Add a quirk entry for the Leading Driver UD-11 usb flash drive.
    
    As Alan Stern told me, the device doesn't deal correctly with the
    locking media feature of the device, and this patch incorporates it.
    
    Compiled, tested, working.
    
    Signed-off-by: Rogerio Brito <rbrito at ime.usp.br>
    Cc: Phil Dibowitz <phil at ipom.com>
    Cc: Alan Stern <stern at rowland.harvard.edu>
    Cc: Robert Hancock <hancockrwd at gmail.com>
    Cc: stable <stable at kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit 50d0678e2026c18e4147f0b16b5853113659b82d
Author: Dhaval Vasa <dhaval.vasa at einfochips.com>
Date:   Fri Aug 7 17:26:49 2009 +0530

    USB: ftdi_sio: add product_id for Marvell OpenRD Base, Client
    
    reference:
    http://www.open-rd.org
    
    Signed-off-by: Dhaval Vasa <dhaval.vasa at einfochips.com>
    Cc: stable <stable at kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit c47aacc67a3d26dfab9c9b8965975ed2b2010b30
Author: Marko Hänninen <bugitus at gmail.com>
Date:   Fri Jul 31 22:32:39 2009 +0300

    USB: ftdi_sio: add vendor and product id for Bayer glucose meter serial converter cable
    
    Attached patch adds USB vendor and product IDs for Bayer's USB to serial
    converter cable used by Bayer blood glucose meters. It seems to be a
    FT232RL based device and works without any problem with ftdi_sio driver
    when this patch is applied. See: http://winglucofacts.com/cables/
    
    
    Signed-off-by: Marko Hänninen <bugitus at gmail.com>
    Cc: stable <stable at kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit ef4638f955f2c4a667c8af20769d03f5ed3781ca
Author: Alan Stern <stern at rowland.harvard.edu>
Date:   Fri Jul 31 10:41:40 2009 -0400

    USB: EHCI: fix counting of transaction error retries
    
    This patch (as1274) simplifies the counting of transaction-error
    retries.  Now we will count up from 0 to QH_XACTERR_MAX instead of
    down from QH_XACTERR_MAX to 0.
    
    The patch also fixes a small bug: qh->xacterr was not getting
    initialized for interrupt endpoints.
    
    Signed-off-by: Alan Stern <stern at rowland.harvard.edu>
    Tested-by: Matthijs Kooijman <matthijs at stdin.nl>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit 7a0f0d951273eee889c2441846842348ebc00a2a
Author: Alan Stern <stern at rowland.harvard.edu>
Date:   Fri Jul 31 10:40:22 2009 -0400

    USB: EHCI: fix two new bugs related to Clear-TT-Buffer
    
    This patch (as1273) fixes two(!) bugs introduced by the new
    Clear-TT-Buffer implementation in ehci-hcd.
    
    	It is now possible for an idle QH to have some URBs on its
    	queue -- this will happen if a Clear-TT-Buffer is pending for
    	the QH's endpoint.  Consequently we should not issue a warning
    	when someone tries to unlink an URB from an idle QH; instead
    	we should process the request immediately.
    
    	The refcounts for QHs could get messed up, because
    	submit_async() would increment the refcount when calling
    	qh_link_async() and qh_link_async() would then refuse to link
    	the QH into the schedule if a Clear-TT-Buffer was pending.
    	Instead we should increment the refcount only when the QH
    	actually is added to the schedule.  The current code tries to
    	be clever by leaving the refcount alone if an unlink is
    	immediately followed by a relink; the patch changes this to an
    	unconditional decrement and increment (although they occur in
    	the opposite order).
    
    Signed-off-by: Alan Stern <stern at rowland.harvard.edu>
    CC: David Brownell <david-b at pacbell.net>
    Tested-by: Manuel Lauss <manuel.lauss at gmail.com>
    Tested-by: Matthijs Kooijman <matthijs at stdin.nl>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit 01105a246345f011fde64d24a601090b646e9e4c
Author: Alan Stern <stern at rowland.harvard.edu>
Date:   Thu Jul 30 15:28:14 2009 -0400

    USB: usbfs: fix -ENOENT error code to be -ENODEV
    
    This patch (as1272) changes the error code returned when an open call
    for a USB device node fails to locate the corresponding device.  The
    appropriate error code is -ENODEV, not -ENOENT.
    
    Signed-off-by: Alan Stern <stern at rowland.harvard.edu>
    CC: Kay Sievers <kay.sievers at vrfy.org>
    Cc: stable <stable at kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit e8e2ff462dd92693f29eb848f42d3eb720390d59
Author: Gupta, Ajay Kumar <ajay.gupta at ti.com>
Date:   Wed Jul 29 11:58:57 2009 +0530

    USB: musb: fix the nop registration for OMAP3EVM
    
    OMAP3EVM uses ISP1504 phy which doesn't require any programming and
    thus has to use NOP otg transceiver.
    
    Cleanups being done:
    	- Remove unwanted code in usb-musb.c file
    	- Register NOP in OMAP3EVM board file using
    	  usb_nop_xceiv_register().
    	- Select NOP_USB_XCEIV for OMAP3EVM boards.
    	- Don't enable TWL4030_USB in omap3_evm_defconfig
    
    Signed-off-by: Ajay Kumar Gupta <ajay.gupta at ti.com>
    Signed-off-by: Eino-Ville Talvala <talvala at stanford.edu>
    Acked-by: David Brownell <dbrownell at users.sourceforge.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit 18753ebc8a98efe0e8ff6167afb31cef220c8e50
Author: Michael Buesch <mb at bu3sch.de>
Date:   Wed Jul 29 11:39:03 2009 +0200

    USB: devio: Properly do access_ok() checks
    
    access_ok() checks must be done on every part of the userspace structure
    that is accessed. If access_ok() on one part of the struct succeeded, it
    does not imply it will succeed on other parts of the struct. (Does
    depend on the architecture implementation of access_ok()).
    
    This changes the __get_user() users to first check access_ok() on the
    data structure.
    
    Signed-off-by: Michael Buesch <mb at bu3sch.de>
    Cc: stable <stable at kernel.org>
    Cc: Pete Zaitcev <zaitcev at redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit 49276560c9004fce24c42e3c0ad75f34d956fc63
Author: Khanh-Dang Nguyen Thu Lam <kdntl at yahoo.fr>
Date:   Tue Jul 28 19:41:17 2009 +0200

    USB: pl2303: New vendor and product id
    
    I am submitting a patch for the pl2303 driver.  This patch adds support
    for the "Sony QN-3USB" cable (vendor=0x054c, product=0x0437).  This USB
    cable is a so-called data cable used to connect a Sony mobile phone to a
    computer.  Supported models are Sony CMD-J5, J6, J7, J16, J26, J70 and
    Z7.
    
    I have used this patch with my Sony CMD-J70 for several days and I
    haven't encountered any kernel/hardware issue.
    
    
    From: Khanh-Dang Nguyen Thu Lam <kdntl at yahoo.fr>
    Signed-off-by: Greg Kroah-Hartman <gregkh at suse.de>

commit 8a57a9dda760ea7845390f1cd36f3eb2a49391d8
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Thu Aug 6 16:07:50 2009 -0700

    ocfs2: keep index within status_map[]
    
    Do not exceed array status_map[]
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Cc: Mark Fasheh <mfasheh at suse.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Joel Becker <joel.becker at oracle.com>

commit e7432675f8ca868a4af365759a8d4c3779a3d922
Author: Sunil Mushran <sunil.mushran at oracle.com>
Date:   Thu Aug 6 16:12:58 2009 -0700

    ocfs2: Initialize the cluster we're writing to in a non-sparse extend
    
    In a non-sparse extend, we correctly allocate (and zero) the clusters between
    the old_i_size and pos, but we don't zero the portions of the cluster we're
    writing to outside of pos<->len.
    
    It handles clustersize > pagesize and blocksize < pagesize.
    
    [Cleaned up by Joel Becker.]
    
    Signed-off-by: Sunil Mushran <sunil.mushran at oracle.com>
    Signed-off-by: Joel Becker <joel.becker at oracle.com>

commit ceab36edd3d3ad3ffd01d41d6d1e05ac1ff8357e
Author: Yan Zheng <zheng.yan at oracle.com>
Date:   Fri Aug 7 13:51:33 2009 -0400

    Btrfs: fix balancing oops when invalidate_inode_pages2 returns EBUSY
    
    invalidate_inode_pages2_range may return -EBUSY occasionally
    which results Oops. This patch fixes the issue by moving
    invalidate_inode_pages2_range into a loop and keeping calling
    it until the return value is not -EBUSY.
    
    The EBUSY return is temporary, and can happen when the btrfs release page
    function is unable to release a page because the EXTENT_LOCK
    bit is set.
    
    Signed-off-by: Yan Zheng <zheng.yan at oracle.com>
    Signed-off-by: Chris Mason <chris.mason at oracle.com>

commit 60f2e8f8a07331097a57ec4abcdc680405579377
Author: Julia Lawall <julia at diku.dk>
Date:   Fri Aug 7 13:51:33 2009 -0400

    Btrfs: correct error-handling zlib error handling
    
    find_zlib_workspace returns an ERR_PTR value in an error case instead of NULL.
    
    A simplified version of the semantic match that finds this problem is as
    follows: (http://coccinelle.lip6.fr/)
    
    // <smpl>
    @match exists@
    expression x, E;
    statement S1, S2;
    @@
    
    x = find_zlib_workspace(...)
    ... when != x = E
    (
    *  if (x == NULL || ...) S1 else S2
    |
    *  if (x == NULL && ...) S1 else S2
    )
    // </smpl>
    
    Signed-off-by: Julia Lawall <julia at diku.dk>
    Signed-off-by: Chris Mason <chris.mason at oracle.com>

commit 4baf8c9201e88546918cbfa61ea8062c38bc1644
Author: Bartlomiej Zolnierkiewicz <bzolnier at gmail.com>
Date:   Fri Aug 7 13:47:08 2009 -0400

    Btrfs: remove superfluous NULL pointer check in btrfs_rename()
    
    This takes care of the following entry from Dan's list:
    
    fs/btrfs/inode.c +4788 btrfs_rename(36) warning: variable derefenced before check 'old_inode'
    
    Reported-by: Dan Carpenter <error27 at gmail.com>
    Cc: Jonathan Corbet <corbet at lwn.net>
    Cc: Eugene Teo <eteo at redhat.com>
    Cc: Julia Lawall <julia at diku.dk>
    Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier at gmail.com>
    Signed-off-by: Chris Mason <chris.mason at oracle.com>

commit 36b8659f9316b24c514a7c8290596b2382b91dd2
Merge: cba8784ae0a9f7d0f1f87e0607e7ae66fc45666c c0c60c4b9ab45bb02b20796401dd6a90770fd0ee
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 7 10:46:51 2009 -0700

    Merge master.kernel.org:/home/rmk/linux-2.6-arm
    
    * master.kernel.org:/home/rmk/linux-2.6-arm: (30 commits)
      ARM: 5639/1: arm: clkdev.c should include <linux/clk.h>
      ARM: 5638/1: arch/arm/kernel/signal.c: use correct address space for CRUNCH
      ARM: 5637/1: [KS8695] Don't reference CLOCK_TICK_RATE in drivers
      ARM: S3C64XX: serial: Fix section mismatch warning
      ARM: S3C24XX: serial: Fix section mismatch warnings
      ARM: S3C: PWM fix for low duty cycle
      ARM: 5597/1: [PCI] reset all internal hardware prior PCI initialization
      ARM: 5627/1: Fix restoring of lr at the end of mcount
      ARM: 5624/1: Document cache aliasing region
      S3C64XX: Fix ARMCLK configuration
      S3C64XX: Fix get_rate() for ARMCLK
      S3C24XX: GPIO: Fix pin range check in s3c_gpiolib_getchip
      mx3 defconfig update
      mx27 defconfig update
      ARM: 5623/1: Treo680: ir shutdown typo fix
      ARM: includecheck fix: plat-stmp3xxx/pinmux.c
      ARM: includecheck fix: plat-s3c64xx/pm.c
      ARM: includecheck fix: mach-omap2/mcbsp.c
      ARM: includecheck fix: mach-omap1/mcbsp.c
      ARM: includecheck fix: board-sffsdr.c
      ...

commit cba8784ae0a9f7d0f1f87e0607e7ae66fc45666c
Merge: 9cf9d28e9bf991af21fc4bbf33281b66843b094b 0bf52b981770cbf006323bab5177f2858a196766
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 7 10:46:27 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
      net: Fix spinlock use in alloc_netdev_mq()

commit 9cf9d28e9bf991af21fc4bbf33281b66843b094b
Merge: ff1649ff780fb7c0bfbf42d05ffc9b56336b9aa3 53cb780adbe69df90c8dc23e992ce40455e687c3
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 7 10:46:09 2009 -0700

    Merge branch 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6
    
    * 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6:
      [S390] KVM: Read buffer overflow
      [S390] kernel: Storing machine flags early in lowcore

commit ff1649ff780fb7c0bfbf42d05ffc9b56336b9aa3
Merge: da758ddede96dd850945d3417ff75209a666ba0d c5b1525533c484238015c48c78f86d49a1bfb86b
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 7 10:44:11 2009 -0700

    Merge git://git.infradead.org/~dwmw2/iommu-2.6.31
    
    * git://git.infradead.org/~dwmw2/iommu-2.6.31:
      intel-iommu: Fix enabling snooping feature by mistake
      intel-iommu: Mask physical address to correct page size in intel_map_single()
      intel-iommu: Correct sglist size calculation.

commit da758ddede96dd850945d3417ff75209a666ba0d
Merge: 389623fef0e8b088f293c437d3b7094fe82349fd 1054598cab8674438675085fae459e960eb10799
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 7 10:43:07 2009 -0700

    Merge branch 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip
    
    * 'perfcounters-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
      perf_counter: Fix double list iteration in per task precise stats
      perf: Auto-detect libelf
      perf symbol: Fix symbol parsing in certain cases: use the build-id as a symlink
      perf_counter/powerpc: Check oprofile_cpu_type for NULL before using it
      ftrace: Fix perf-tracepoint OOPS
      perf report: Add missing command line options to man page
      perf: Auto-detect libbfd
      perf report: Make --sort comm,dso,symbol the default

commit 389623fef0e8b088f293c437d3b7094fe82349fd
Merge: 385861206c21364c01dcfdda5064643ce111d517 57ca7deb062abf56168d15f000c16e25f88a9cf3
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 7 10:42:31 2009 -0700

    Merge git://git.infradead.org/mtd-2.6
    
    * git://git.infradead.org/mtd-2.6:
      jffs2: Fix return value from jffs2_do_readpage_nolock()
      mtd: mtdblock: introduce mtdblks_lock
      mtd: remove 'SBC8240 Wind River' Device Driver Code
      mtd: OneNAND: OMAP2/3: free GPMC CS on module removal
      mtd: OneNAND: fix incorrect bufferram offset
      mtd: blkdevs: do not forget to get MTD devices
      mtd: fix the conversion from dev to mtd_info
      mtd: let include/linux/mtd/partitions.h stand on its own

commit 385861206c21364c01dcfdda5064643ce111d517
Merge: 131f7340b4f93f9a4a8e5a65abbd352b34d0ee08 d82f1c35348cebe2fb2d4a4d31ce0ab0769e3d93
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 7 10:42:14 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
      Input: matrix_keypad - make matrix keymap size dynamic
      Input: wistron_btns - support Prestigio Wifi RF kill button
      Input: i8042 - add Asus G1S to noloop exception list

commit 131f7340b4f93f9a4a8e5a65abbd352b34d0ee08
Merge: 3440625d78711bee41a84cf29c3d8c579b522666 17332925d7b11bb6c2d0c49450ae58dd836005da
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Fri Aug 7 10:41:36 2009 -0700

    Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6
    
    * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
      drm/radeon/kms: setup MC/VRAM the same way for suspend/resume
      drm/radeon/kms: Fix caching mode selection for GTT object

commit 3440625d78711bee41a84cf29c3d8c579b522666
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Thu Aug 6 15:09:34 2009 -0700

    flat: fix uninitialized ptr with shared libs
    
    The new credentials code broke load_flat_shared_library() as it now uses
    an uninitialized cred pointer.
    
    Reported-by: Bernd Schmidt <bernds_cb1 at t-online.de>
    Tested-by: Bernd Schmidt <bernds_cb1 at t-online.de>
    Cc: Mike Frysinger <vapier at gentoo.org>
    Cc: David Howells <dhowells at redhat.com>
    Cc: <stable at kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 9e5cf0ca2e9b65110ae5f094d7f0f7165cd1bbbb
Author: Albin Tonnerre <albin.tonnerre at free-electrons.com>
Date:   Thu Aug 6 15:09:32 2009 -0700

    lib/decompress_*: only include <linux/slab.h> if STATIC is not defined
    
    These includes were added by 079effb6933f34b9b1b67b08bd4fd7fb672d16ef
    ("kmemtrace, kbuild: fix slab.h dependency problem in
    lib/decompress_inflate.c") to fix the build when using kmemtrace.  However
    this is not necessary when used to create a compressed kernel, and
    actually creates issues (brings a lot of things unavailable in the
    decompression environment), so don't include it if STATIC is defined.
    
    Signed-off-by: Albin Tonnerre <albin.tonnerre at free-electrons.com>
    Cc: Sam Ravnborg <sam at ravnborg.org>
    Cc: Russell King <rmk at arm.linux.org.uk>
    Cc: Ingo Molnar <mingo at elte.hu>
    Cc: Thomas Gleixner <tglx at linutronix.de>
    Cc: "H. Peter Anvin" <hpa at zytor.com>
    Cc: Pekka Enberg <penberg at cs.helsinki.fi>
    Cc: Eduard - Gabriel Munteanu <eduard.munteanu at linux360.ro>
    Cc: Phillip Lougher <phillip at lougher.demon.co.uk>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit b1af4315d823a2b6659c5b14bc17f7bc61878ef4
Author: Phillip Lougher <phillip at lougher.demon.co.uk>
Date:   Thu Aug 6 15:09:31 2009 -0700

    bzip2/lzma: remove nasty uncompressed size hack in pre-boot environment
    
    decompress_bunzip2 and decompress_unlzma have a nasty hack that subtracts
    4 from the input length if being called in the pre-boot environment.
    
    This is a nasty hack because it relies on the fact that flush = NULL only
    when called from the pre-boot environment (i.e.
    arch/x86/boot/compressed/misc.c).  initramfs.c/do_mounts_rd.c pass in a
    flush buffer (flush != NULL).
    
    This hack prevents the decompressors from being used with flush = NULL by
    other callers unless knowledge of the hack is propagated to them.
    
    This patch removes the hack by making decompress (called only from the
    pre-boot environment) a wrapper function that subtracts 4 from the input
    length before calling the decompressor.
    
    Signed-off-by: Phillip Lougher <phillip at lougher.demon.co.uk>
    Cc: "H. Peter Anvin" <hpa at zytor.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit daeb6b6fbe27049f465c48a7d0ee5555c3b84064
Author: Phillip Lougher <phillip at lougher.demon.co.uk>
Date:   Thu Aug 6 15:09:30 2009 -0700

    bzip2/lzma/gzip: fix comments describing decompressor API
    
    Fix and improve comments in decompress/generic.h that describe the
    decompressor API.  Also remove an unused definition, and rename INBUF_LEN
    in lib/decompress_inflate.c to conform to bzip2/lzma naming.
    
    Signed-off-by: Phillip Lougher <phillip at lougher.demon.co.uk>
    Cc: "H. Peter Anvin" <hpa at zytor.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 9c8a8228d0827e0d91d28527209988f672f97d28
Author: Eric Dumazet <eric.dumazet at gmail.com>
Date:   Thu Aug 6 15:09:28 2009 -0700

    execve: must clear current->clear_child_tid
    
    While looking at Jens Rosenboom bug report
    (http://lkml.org/lkml/2009/7/27/35) about strange sys_futex call done from
    a dying "ps" program, we found following problem.
    
    clone() syscall has special support for TID of created threads.  This
    support includes two features.
    
    One (CLONE_CHILD_SETTID) is to set an integer into user memory with the
    TID value.
    
    One (CLONE_CHILD_CLEARTID) is to clear this same integer once the created
    thread dies.
    
    The integer location is a user provided pointer, provided at clone()
    time.
    
    kernel keeps this pointer value into current->clear_child_tid.
    
    At execve() time, we should make sure kernel doesnt keep this user
    provided pointer, as full user memory is replaced by a new one.
    
    As glibc fork() actually uses clone() syscall with CLONE_CHILD_SETTID and
    CLONE_CHILD_CLEARTID set, chances are high that we might corrupt user
    memory in forked processes.
    
    Following sequence could happen:
    
    1) bash (or any program) starts a new process, by a fork() call that
       glibc maps to a clone( ...  CLONE_CHILD_SETTID | CLONE_CHILD_CLEARTID
       ...) syscall
    
    2) When new process starts, its current->clear_child_tid is set to a
       location that has a meaning only in bash (or initial program) context
       (&THREAD_SELF->tid)
    
    3) This new process does the execve() syscall to start a new program.
       current->clear_child_tid is left unchanged (a non NULL value)
    
    4) If this new program creates some threads, and initial thread exits,
       kernel will attempt to clear the integer pointed by
       current->clear_child_tid from mm_release() :
    
            if (tsk->clear_child_tid
                && !(tsk->flags & PF_SIGNALED)
                && atomic_read(&mm->mm_users) > 1) {
                    u32 __user * tidptr = tsk->clear_child_tid;
                    tsk->clear_child_tid = NULL;
    
                    /*
                     * We don't check the error code - if userspace has
                     * not set up a proper pointer then tough luck.
                     */
    << here >>      put_user(0, tidptr);
                    sys_futex(tidptr, FUTEX_WAKE, 1, NULL, NULL, 0);
            }
    
    5) OR : if new program is not multi-threaded, but spied by /proc/pid
       users (ps command for example), mm_users > 1, and the exiting program
       could corrupt 4 bytes in a persistent memory area (shm or memory mapped
       file)
    
    If current->clear_child_tid points to a writeable portion of memory of the
    new program, kernel happily and silently corrupts 4 bytes of memory, with
    unexpected effects.
    
    Fix is straightforward and should not break any sane program.
    
    Reported-by: Jens Rosenboom <jens at mcbone.net>
    Acked-by: Linus Torvalds <torvalds at linux-foundation.org>
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    Signed-off-by: Oleg Nesterov <oleg at redhat.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Sonny Rao <sonnyrao at us.ibm.com>
    Cc: Ingo Molnar <mingo at elte.hu>
    Cc: Thomas Gleixner <tglx at linutronix.de>
    Cc: Ulrich Drepper <drepper at redhat.com>
    Cc: Oleg Nesterov <oleg at redhat.com>
    Cc: <stable at kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 2198a64a7487aba036f71998ade8a6528070d32c
Author: Julia Lawall <julia at diku.dk>
Date:   Thu Aug 6 15:07:41 2009 -0700

    drivers/mmc: correct error-handling code
    
    sdhci_alloc_host returns an ERR_PTR value in an error case instead of NULL.
    
    A simplified version of the semantic match that finds this problem is as
    follows: (http://coccinelle.lip6.fr/)
    
    // <smpl>
    @match exists@
    expression x, E;
    statement S1, S2;
    @@
    
    x = sdhci_alloc_host(...)
    ... when != x = E
    (
    *  if (x == NULL || ...) S1 else S2
    |
    *  if (x == NULL && ...) S1 else S2
    )
    // </smpl>
    
    Signed-off-by: Julia Lawall <julia at diku.dk>
    Acked-by: Anton Vorontsov <avorontsov at ru.mvista.com>
    Cc: Matt Fleming <matt at console-pimps.org>
    Cc: Ian Molton <ian at mnementh.co.uk>
    Cc: "Roberto A. Foglietta" <roberto.foglietta at gmail.com>
    Cc: Philip Langdale <philipl at overt.org>
    Cc: Pierre Ossman <pierre at ossman.eu>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 20de03dae54e10271ffd308654dfb4a117f4789d
Author: Guennadi Liakhovetski <g.liakhovetski at gmx.de>
Date:   Thu Aug 6 15:07:40 2009 -0700

    i.MX31: fix framebuffer locking regressions
    
    Recent framebuffer locking patches first made affected systems unbootable,
    then the dead-lock has been fixed but as of 2.6.31-rc4 the framebuffer on
    mx3 machines doesn't work. Fix this.
    
    Signed-off-by: Guennadi Liakhovetski <g.liakhovetski at gmx.de>
    Cc: Sascha Hauer <s.hauer at pengutronix.de>
    Cc: Krzysztof Helt <krzysztof.h1 at poczta.fm>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 2d8dd38a5aa0cc2490bbad9b75e77fa154e1d145
Author: OGAWA Hirofumi <hirofumi at mail.parknet.co.jp>
Date:   Thu Aug 6 15:07:39 2009 -0700

    vfs: mnt_want_write_file(): fix special file handling
    
    I suspect that mnt_want_write_file() may have wrong assumption.  I think
    mnt_want_write_file() is assuming it increments ->mnt_writers if
    (file->f_mode & FMODE_WRITE).  But, if it's special_file(), it is false?
    
    Signed-off-by: OGAWA Hirofumi <hirofumi at mail.parknet.co.jp>
    Acked-by: Dave Hansen <dave at linux.vnet.ibm.com>
    Cc: Al Viro <viro at zeniv.linux.org.uk>
    Cc: Nick Piggin <nickpiggin at yahoo.com.au>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 69130c7cf96ea853dc5be599dd6a4b98907d39cc
Author: Eric Sandeen <sandeen at redhat.com>
Date:   Thu Aug 6 15:07:37 2009 -0700

    compat_ioctl: hook up compat handler for FIEMAP ioctl
    
    The FIEMAP_IOC_FIEMAP mapping ioctl was missing a 32-bit compat handler,
    which means that 32-bit suerspace on 64-bit kernels cannot use this ioctl
    command.
    
    The structure is nicely aligned, padded, and sized, so it is just this
    simple.
    
    Tested w/ 32-bit ioctl tester (from Josef) on a 64-bit kernel on ext4.
    
    Signed-off-by: Eric Sandeen <sandeen at redhat.com>
    Cc: <linux-ext4 at vger.kernel.org>
    Cc: Mark Lord <lkml at rtr.ca>
    Cc: Arnd Bergmann <arnd at arndb.de>
    Cc: Josef Bacik <josef at redhat.com>
    Cc: Jan Kara <jack at suse.cz>
    Cc: <stable at kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 0035fe00f77d2b0a1a2d001f7442136d1ec5aefa
Author: Johannes Weiner <hannes at cmpxchg.org>
Date:   Thu Aug 6 15:07:36 2009 -0700

    fbcon: don't use vc_resize() on initialization
    
    Catalin and kmemleak spotted a leak of a VC screen buffer in
    vc_allocate() due to the following chain of events:
    
    	vc_allocate()
    	  visual_init(init=1)
    	    vc->vc_sw->con_init(init=1)
                  fbcon_init()
    	        vc_resize()
    	          vc->screen_buf = kmalloc()
    	  vc->screen_buf = kmalloc()
    
    The common way for the VC drivers is to set the screen dimension
    parameters manually in the init case and only call vc_resize() for
    !init - which allocates a screen buffer according to the new
    dimensions.
    
    fbcon instead would do vc_resize() unconditionally and afterwards set
    the dimensions manually (again) for !init - i.e. completely upside
    down.  The vc_resize() allocated buffer would then get lost by
    vc_allocate() allocating a fresh one.
    
    Use vc_resize() only for actual resizing to close the leak.
    
    Set the dimensions manually only in initialization mode to remove the
    redundant setting in resize mode.
    
    The kmemleak trace from Catalin:
    
    unreferenced object 0xde158000 (size 12288):
      comm "Xorg", pid 1439, jiffies 4294961016
      hex dump (first 32 bytes):
        20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00   . . . . . . . .
        20 00 20 00 20 00 20 00 20 00 20 00 20 00 20 00   . . . . . . . .
      backtrace:
        [<c006f74b>] __save_stack_trace+0x17/0x1c
        [<c006f81d>] create_object+0xcd/0x188
        [<c01f5457>] kmemleak_alloc+0x1b/0x3c
        [<c006e303>] __kmalloc+0xdb/0xe8
        [<c012cc4b>] vc_do_resize+0x73/0x1e0
        [<c012cdf1>] vc_resize+0x15/0x18
        [<c011afc1>] fbcon_init+0x1f9/0x2b8
        [<c0129e87>] visual_init+0x9f/0xdc
        [<c012aff3>] vc_allocate+0x7f/0xfc
        [<c012b087>] con_open+0x17/0x80
        [<c0120e43>] tty_open+0x1f7/0x2e4
        [<c0072fa1>] chrdev_open+0x101/0x118
        [<c006ffad>] __dentry_open+0x105/0x1cc
        [<c00700fd>] nameidata_to_filp+0x2d/0x38
        [<c00788cd>] do_filp_open+0x2c1/0x54c
        [<c006fdff>] do_sys_open+0x3b/0xb4
    
    Reported-by: Catalin Marinas <catalin.marinas at arm.com>
    Signed-off-by: Johannes Weiner <hannes at cmpxchg.org>
    Tested-by: Catalin Marinas <catalin.marinas at arm.com>
    Cc: Pekka Enberg <penberg at cs.helsinki.fi>
    Cc: Krzysztof Helt <krzysztof.h1 at poczta.fm>
    Tested-by: Dave Young <hidave.darkstar at gmail.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 521594442cc62d1c2af8436a05ab5918b7730b19
Author: Florian Tobias Schandinat <FlorianSchandinat at gmx.de>
Date:   Thu Aug 6 15:07:34 2009 -0700

    viafb: fix rmmod bug
    
    This fixes a bug caused by changing pointers (viafb_mode, viafb_mode1)
    assigned by module_param.  It reduces driver complexity by not needlessly
    changing these vars as they are only read once and removing now
    superfluous code.
    
    On unpatched kernels loading viafb with viafb_mode or viafb_mode1 option
    used and afterwards unloading it results in:
    
    kernel BUG at mm/slub.c:2926!
    invalid opcode: 0000 [#1] PREEMPT
    last sysfs file: /sys/devices/virtual/block/loop0/removable
    Modules linked in: snd_hda_codec_realtek snd_hda_intel snd_hda_codec
    snd_hwdep snd_pcm rtl8187 snd_timer eeprom_93cx6 mmc_block snd soundcore
    via_sdmmc fb snd_page_alloc i2c_algo_bit i2c_viapro ehci_hcd uhci_hcd
    cfbcopyarea mmc_core cfbimgblt cfbfillrect video output [last unloaded:
    viafb]
    
      Pid: 3355, comm: rmmod Not tainted (2.6.31-rc1 #0)
      EIP: 0060:[<c106a759>] EFLAGS: 00010246 CPU: 0
      EIP is at kfree+0x80/0xda
      EAX: c17c2da0 EBX: dc7edbdc ECX: 0000010f EDX: 00000000
      ESI: c102c700 EDI: dc7ed8fa EBP: d703ff2c ESP: d703ff20
       DS: 007b ES: 007b FS: 0000 GS: 0033 SS: 0068
      Process rmmod (pid: 3355, ti=d703e000 task=db1412c0 task.ti=d703e000)
      Stack:
       dc7edbdc 00000014 00000016 d703ff40 c102c700 dc7f45d4 dc7f45d4 00000880
       d703ff4c c103e571 00000000 d703ffac c103e751 66616976 da140062 db89ba80
       00000328 d702edf8 db89ba80 d703ff9c c105d0f0 00000200 da14f898 00000014
      Call Trace:
       [<c102c700>] ? destroy_params+0x1e/0x2b
       [<c103e571>] ? free_module+0xa2/0xd7
       [<c103e751>] ? sys_delete_module+0x1ab/0x1da
       [<c105d0f0>] ? do_munmap+0x20a/0x225
       [<c10029b4>] ? sysenter_do_call+0x12/0x26
      Code: 10 76 7a 8d 87 00 00 00 40 c1 e8 0c c1 e0 05 03 05 1c 87 41 c1 66 83 38 00 79 03 8b 40 0c 8b 10 84 d2 78 12 66 f7 c2 00 c0 75 04 <0f> 0b eb fe e8 6f 5a fe ff eb 47 8b 55 04 8b 58 0c 9c 5e fa 3b
      EIP: [<c106a759>] kfree+0x80/0xda SS:ESP 0068:d703ff20
    
    This is caused by the current code changing the pointers assigned by
    module_param.  During unload it tries to free the memory the pointers
    point at which is now part of an internal structure.
    
    The patch simply avoids changing the pointers.  This is okay as they are
    read only once during the initialization process.
    
    Signed-off-by: Florian Tobias Schandinat <FlorianSchandinat at gmx.de>
    Cc: Scott Fang <ScottFang at viatech.com.cn>
    Cc: Joseph Chan <JosephChan at via.com.tw>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 4bfc44958e499af9a73f62201543b3a1f617cfeb
Author: KAMEZAWA Hiroyuki <kamezawa.hiroyu at jp.fujitsu.com>
Date:   Thu Aug 6 15:07:33 2009 -0700

    mm: make set_mempolicy(MPOL_INTERLEAV) N_HIGH_MEMORY aware
    
    At first, init_task's mems_allowed is initialized as this.
     init_task->mems_allowed == node_state[N_POSSIBLE]
    
    And cpuset's top_cpuset mask is initialized as this
     top_cpuset->mems_allowed = node_state[N_HIGH_MEMORY]
    
    Before 2.6.29:
    policy's mems_allowed is initialized as this.
    
      1. update tasks->mems_allowed by its cpuset->mems_allowed.
      2. policy->mems_allowed = nodes_and(tasks->mems_allowed, user's mask)
    
    Updating task's mems_allowed in reference to top_cpuset's one.
    cpuset's mems_allowed is aware of N_HIGH_MEMORY, always.
    
    In 2.6.30: After commit 58568d2a8215cb6f55caf2332017d7bdff954e1c
    ("cpuset,mm: update tasks' mems_allowed in time"), policy's mems_allowed
    is initialized as this.
    
      1. policy->mems_allowd = nodes_and(task->mems_allowed, user's mask)
    
    Here, if task is in top_cpuset, task->mems_allowed is not updated from
    init's one.  Assume user excutes command as #numactrl --interleave=all
    ,....
    
      policy->mems_allowd = nodes_and(N_POSSIBLE, ALL_SET_MASK)
    
    Then, policy's mems_allowd can includes a possible node, which has no pgdat.
    
    MPOL's INTERLEAVE just scans nodemask of task->mems_allowd and access this
    directly.
    
      NODE_DATA(nid)->zonelist even if NODE_DATA(nid)==NULL
    
    Then, what's we need is making policy->mems_allowed be aware of
    N_HIGH_MEMORY.  This patch does that.  But to do so, extra nodemask will
    be on statck.  Because I know cpumask has a new interface of
    CPUMASK_ALLOC(), I added it to node.
    
    This patch stands on old behavior.  But I feel this fix itself is just a
    Band-Aid.  But to do fundametal fix, we have to take care of memory
    hotplug and it takes time.  (task->mems_allowd should be N_HIGH_MEMORY, I
    think.)
    
    mpol_set_nodemask() should be aware of N_HIGH_MEMORY and policy's nodemask
    should be includes only online nodes.
    
    In old behavior, this is guaranteed by frequent reference to cpuset's
    code.  Now, most of them are removed and mempolicy has to check it by
    itself.
    
    To do check, a few nodemask_t will be used for calculating nodemask.  But,
    size of nodemask_t can be big and it's not good to allocate them on stack.
    
    Now, cpumask_t has CPUMASK_ALLOC/FREE an easy code for get scratch area.
    NODEMASK_ALLOC/FREE shoudl be there.
    
    [akpm at linux-foundation.org: cleanups & tweaks]
    Tested-by: KOSAKI Motohiro <kosaki.motohiro at jp.fujitsu.com>
    Signed-off-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu at jp.fujitsu.com>
    Cc: Miao Xie <miaox at cn.fujitsu.com>
    Cc: Ingo Molnar <mingo at elte.hu>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Christoph Lameter <cl at linux-foundation.org>
    Cc: Paul Menage <menage at google.com>
    Cc: Nick Piggin <nickpiggin at yahoo.com.au>
    Cc: Yasunori Goto <y-goto at jp.fujitsu.com>
    Cc: Pekka Enberg <penberg at cs.helsinki.fi>
    Cc: David Rientjes <rientjes at google.com>
    Cc: Lee Schermerhorn <lee.schermerhorn at hp.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 93274e4d4e9416ad1fa47e2f26011e2c483fe5fe
Author: Stefani Seibold <stefani at seibold.net>
Date:   Thu Aug 6 15:07:30 2009 -0700

    fbcon: fix rotate upside down crash
    
    Fix the rotate_ud() function not to crash in case of a font which has not
    a width of multiple by 8: The inner loop of the font pixel copy should not
    access a bit outside the font memory area.  Subtract the shift offset from
    the font width will prevent this.
    
    Signed-off-by: Stefani Seibold <stefani at seibold.net>
    Cc: Krzysztof Helt <krzysztof.h1 at poczta.fm>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 69dd647f969c28d18de77e2153f30d05a1874571
Author: Xiao Guangrong <xiaoguangrong at cn.fujitsu.com>
Date:   Thu Aug 6 15:07:29 2009 -0700

    generic-ipi: fix hotplug_cfd()
    
    Use CONFIG_HOTPLUG_CPU, not CONFIG_CPU_HOTPLUG
    
    When hot-unpluging a cpu, it will leak memory allocated at cpu hotplug,
    but only if CPUMASK_OFFSTACK=y, which is default to n.
    
    The bug was introduced by 8969a5ede0f9e17da4b943712429aef2c9bcd82b
    ("generic-ipi: remove kmalloc()").
    
    Signed-off-by: Xiao Guangrong <xiaoguangrong at cn.fujitsu.com>
    Cc: Ingo Molnar <mingo at elte.hu>
    Cc: Jens Axboe <jens.axboe at oracle.com>
    Cc: Nick Piggin <nickpiggin at yahoo.com.au>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Rusty Russell <rusty at rustcorp.com.au>
    Cc: <stable at kernel.org>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit 2020002a878403a6858868d85a43623f74859dba
Author: Stoyan Gaydarov <sgayda2 at uiuc.edu>
Date:   Thu Aug 6 15:07:28 2009 -0700

    drivers/w1/masters/omap_hdq.c: fix missing mutex unlock
    
    This was found using a semantic patch, more info can be found at:
    http://www.emn.fr/x-info/coccinelle/
    
    Signed-off-by: Stoyan Gaydarov <sgayda2 at uiuc.edu>
    Acked-by: Evgeniy Polyakov <johnpol at 2ka.mipt.ru>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>

commit b36ec0428a06fcbdb67d61e9e664154e5dd9a8c7
Author: Christoph Hellwig <hch at lst.de>
Date:   Fri Aug 7 14:38:34 2009 -0300

    xfs: fix freeing of inodes not yet added to the inode cache
    
    When freeing an inode that lost race getting added to the inode cache we
    must not call into ->destroy_inode, because that would delete the inode
    that won the race from the inode cache radix tree.
    
    This patch uses splits a new xfs_inode_free helper out of xfs_ireclaim
    and uses that plus __destroy_inode to make sure we really only free
    the memory allocted for the inode that lost the race, and not mess with
    the inode cache state.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Eric Sandeen <sandeen at sandeen.net>
    Reported-by: Alex Samad <alex at samad.com.au>
    Reported-by: Andrew Randrianasulu <randrik at mail.ru>
    Reported-by: Stephane <sharnois at max-t.com>
    Reported-by: Tommy <tommy at news-service.com>
    Reported-by: Miah Gregory <mace at darksilence.net>
    Reported-by: Gabriel Barazer <gabriel at oxeva.fr>
    Reported-by: Leandro Lucarella <llucax at gmail.com>
    Reported-by: Daniel Burr <dburr at fami.com.au>
    Reported-by: Nickolay <newmail at spaces.ru>
    Reported-by: Michael Guntsche <mike at it-loops.com>
    Reported-by: Dan Carley <dan.carley+linuxkern-bugs at gmail.com>
    Reported-by: Michael Ole Olsen <gnu at gmx.net>
    Reported-by: Michael Weissenbacher <mw at dermichi.com>
    Reported-by: Martin Spott <Martin.Spott at mgras.net>
    Reported-by: Christian Kujau <lists at nerdbynature.de>
    Tested-by: Michael Guntsche <mike at it-loops.com>
    Tested-by: Dan Carley <dan.carley+linuxkern-bugs at gmail.com>
    Tested-by: Christian Kujau <lists at nerdbynature.de>

commit 2e00c97e2c1d2ffc9e26252ca26b237678b0b772
Author: Christoph Hellwig <hch at lst.de>
Date:   Fri Aug 7 14:38:29 2009 -0300

    vfs: add __destroy_inode
    
    When we want to tear down an inode that lost the add to the cache race
    in XFS we must not call into ->destroy_inode because that would delete
    the inode that won the race from the inode cache radix tree.
    
    This patch provides the __destroy_inode helper needed to fix this,
    the actual fix will be in th next patch.  As XFS was the only reason
    destroy_inode was exported we shift the export to the new __destroy_inode.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Eric Sandeen <sandeen at sandeen.net>

commit 54e346215e4fe2ca8c94c54e546cc61902060510
Author: Christoph Hellwig <hch at lst.de>
Date:   Fri Aug 7 14:38:25 2009 -0300

    vfs: fix inode_init_always calling convention
    
    Currently inode_init_always calls into ->destroy_inode if the additional
    initialization fails.  That's not only counter-intuitive because
    inode_init_always did not allocate the inode structure, but in case of
    XFS it's actively harmful as ->destroy_inode might delete the inode from
    a radix-tree that has never been added.  This in turn might end up
    deleting the inode for the same inum that has been instanciated by
    another process and cause lots of cause subtile problems.
    
    Also in the case of re-initializing a reclaimable inode in XFS it would
    free an inode we still want to keep alive.
    
    Signed-off-by: Christoph Hellwig <hch at lst.de>
    Reviewed-by: Eric Sandeen <sandeen at sandeen.net>

commit 94f81a47c4a7a2d7a16fcfdd6d81da381732c101
Author: Kenji Kaneshige <kaneshige.kenji at jp.fujitsu.com>
Date:   Mon Jul 27 12:06:46 2009 +0900

    PCI hotplug: SGI hotplug: do not use hotplug_slot_attr
    
    By the pci slot changes, callbacks of attributes under slot directory
    (/sys/bus/pci/slots) had been changed to get the pointer to struct
    pci_slot instead of struct hotplug_slot. So the path_show() that
    assumes the parameter is a pointer to struct hotplug_slot seems
    broken.
    
    Tested-by: Mike Habeck <habeck at sgi.com>
    Signed-off-by: Kenji Kaneshige <kaneshige.kenji at jp.fujitsu.com>
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>

commit d25f14389a65c7f95512b01415d8d4a8d62855ab
Author: Kenji Kaneshige <kaneshige.kenji at jp.fujitsu.com>
Date:   Mon Jul 27 12:05:38 2009 +0900

    PCI hotplug: SGI hotplug: fix build failure
    
    The commit bd3d99c17039fd05a29587db3f4a180c48da115a ("PCI: Remove
    untested Electromechanical Interlock (EMI) support in pciehp."), which
    removes the definition of "struct hotplug_slot_attr", broke SGI
    hotplug driver. By this commit, we get the following compile error.
    
    drivers/pci/hotplug/sgi_hotplug.c:106: error: variable 'sn_slot_path_attr' has initializer but incomplete type
    drivers/pci/hotplug/sgi_hotplug.c:106: error: unknown field 'attr' specified in initializer
    drivers/pci/hotplug/sgi_hotplug.c:106: error: extra brace group at end of initializer
    drivers/pci/hotplug/sgi_hotplug.c:106: error: (near initialization for 'sn_slot_path_attr')
    drivers/pci/hotplug/sgi_hotplug.c:106: warning: excess elements in struct initializer
    drivers/pci/hotplug/sgi_hotplug.c:106: warning: (near initialization for 'sn_slot_path_attr')
    drivers/pci/hotplug/sgi_hotplug.c:106: error: unknown field 'show' specified in initializer
    drivers/pci/hotplug/sgi_hotplug.c:106: warning: excess elements in struct initializer
    drivers/pci/hotplug/sgi_hotplug.c:106: warning: (near initialization for 'sn_slot_path_attr')
    drivers/pci/hotplug/sgi_hotplug.c: In function 'sn_hp_destroy':
    drivers/pci/hotplug/sgi_hotplug.c:203: error: invalid use of undefined type 'struct hotplug_slot_attribute'
    drivers/pci/hotplug/sgi_hotplug.c: In function 'sn_hotplug_slot_register':
    drivers/pci/hotplug/sgi_hotplug.c:655: error: invalid use of undefined type 'struct hotplug_slot_attribute'
    
    This patch fixes this regression by adding the definition of struct
    hotplug_slot_attr into sgi_hotplug.c.
    
    Tested-by: Mike Habeck <habeck at sgi.com>
    Signed-off-by: Kenji Kaneshige <kaneshige.kenji at jp.fujitsu.com>
    Signed-off-by: Jesse Barnes <jbarnes at virtuousgeek.org>

commit dd1f57ecaf9688efa69d982652ecfa3e64f1fa55
Author: Bob Dunlop <rdunlop at guralp.com>
Date:   Thu Aug 6 12:01:03 2009 -0400

    libertas: correct packing of rxpd structure
    
    Older Gcc compilers (3.4.5 tested) need additional hints in order to get
    the packing of the rxpd structure (which contains a 16 bit union)
    correct on the ARM processor.
    
    struct txpd does not need these hints since it contains a 32 bit union
    that packs naturally.
    
    Signed-off-by: R.J.Dunlop <rdunlop at guralp.com>
    Acked-by: Dan Williams <dcbw at redhat.com>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit 60aa569f9212a13382c29cc734f275dec0f55e0b
Author: Lennert Buytenhek <buytenh at wantstofly.org>
Date:   Mon Aug 3 21:59:09 2009 +0200

    mwl8k: prevent module unload hang
    
    We need to unregister our ieee80211_hw before resetting the chip, as
    the former causes firmware commands to be issued which will time out
    once the chip has been reset.
    
    Signed-off-by: Lennert Buytenhek <buytenh at marvell.com>
    Acked-by: Nicolas Pitre <nico at marvell.com>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit a94cc97e14c5750ec2b50b2e4ecdfb0f369ed0f4
Author: Lennert Buytenhek <buytenh at wantstofly.org>
Date:   Mon Aug 3 21:58:57 2009 +0200

    mwl8k: prevent crash in ->configure_filter() if no interface was added
    
    Signed-off-by: Lennert Buytenhek <buytenh at marvell.com>
    Acked-by: Nicolas Pitre <nico at marvell.com>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit 37055bd455b31b8220c35a1ede9c6aceb791cc88
Author: Lennert Buytenhek <buytenh at wantstofly.org>
Date:   Mon Aug 3 21:58:47 2009 +0200

    mwl8k: call pci_unmap_single() before accessing command structure again
    
    Signed-off-by: Lennert Buytenhek <buytenh at marvell.com>
    Acked-by: Nicolas Pitre <nico at marvell.com>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit 4ff6432ea620ba467e50ec04b8271ea0eb94e62e
Author: Lennert Buytenhek <buytenh at wantstofly.org>
Date:   Mon Aug 3 21:58:39 2009 +0200

    mwl8k: add various missing GET_HW_SPEC endian conversions
    
    Signed-off-by: Lennert Buytenhek <buytenh at marvell.com>
    Acked-by: Nicolas Pitre <nico at marvell.com>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit d25f9f1357139bbdc79bc960ea84909a7c22ec2b
Author: Lennert Buytenhek <buytenh at wantstofly.org>
Date:   Mon Aug 3 21:58:26 2009 +0200

    mwl8k: fix NULL pointer dereference on receive out-of-memory
    
    When we go into out-of-memory and fail to allocate skbuffs to
    refill the receive ring with, rxq_process can end up running into
    a receive ring entry that is marked as host-owned but doesn't have
    an associated skbuff.  If this happens, we must break out of the
    rx processing loop instead of trying to process the descriptor.
    
    Signed-off-by: Lennert Buytenhek <buytenh at marvell.com>
    Acked-by: Nicolas Pitre <nico at marvell.com>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit 7dd2459d8f7a967bcd1466591aec72bb3ddc07cc
Author: Zhu Yi <yi.zhu at intel.com>
Date:   Mon Jul 27 10:10:20 2009 +0800

    ipw2x00: Write outside array bounds
    
    > channel_index loops up to IPW_SCAN_CHANNELS, but is used after being
    > incremented. This might be able to access 1 past the end of the array
    
    Reported-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: John W. Linville <linville at tuxdriver.com>

commit bd3f02212d6a457267e0c9c02c426151c436d9d4
Author: Eric Dumazet <eric.dumazet at gmail.com>
Date:   Fri Aug 7 12:49:29 2009 +0200

    ring-buffer: Fix memleak in ring_buffer_free()
    
    I noticed oprofile memleaked in linux-2.6 current tree,
    and tracked this ring-buffer leak.
    
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    LKML-Reference: <4A7C06B9.2090302 at gmail.com>
    Cc: stable at kernel.org
    Signed-off-by: Steven Rostedt <rostedt at goodmis.org>

commit afc5e65245255a268ab22a20477ed2c9f2cdfcd3
Author: Takashi Iwai <tiwai at suse.de>
Date:   Fri Aug 7 16:33:53 2009 +0200

    ASoC: Add missing DRV_NAME definitions for fsl/* drivers
    
    Module builds are broken due to missing DRV_NAME for
    efika-audio-fabric and pcm030-audio-fabric.
    
    Signed-off-by: Takashi Iwai <tiwai at suse.de>

commit 17332925d7b11bb6c2d0c49450ae58dd836005da
Author: Dave Airlie <airlied at linux.ie>
Date:   Fri Aug 7 11:03:26 2009 +1000

    drm/radeon/kms: setup MC/VRAM the same way for suspend/resume
    
    we should align the GTT after VRAM no matter what, as we can
    come back from resume and put in a different place and bad things happen.
    
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 0e692a94e378628b7d527260ad939894454bcca8
Author: Li Zefan <lizf at cn.fujitsu.com>
Date:   Fri Aug 7 15:10:54 2009 +0800

    lockdep: Fix typos in documentation
    
    s/head/held
    
    Signed-off-by: Li Zefan <lizf at cn.fujitsu.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    LKML-Reference: <4A7BD37E.9060806 at cn.fujitsu.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 9795447f71324d8f14c19ed68b43c883135c3f59
Author: Li Zefan <lizf at cn.fujitsu.com>
Date:   Fri Aug 7 16:37:10 2009 +0800

    lockdep: Fix file mode of lock_stat
    
    /proc/lock_stat is writable.
    
    Signed-off-by: Li Zefan <lizf at cn.fujitsu.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    LKML-Reference: <4A7BE7B6.10904 at cn.fujitsu.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 53cb780adbe69df90c8dc23e992ce40455e687c3
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Fri Aug 7 10:39:25 2009 +0200

    [S390] KVM: Read buffer overflow
    
    Check whether index is within bounds before testing the element.
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky at de.ibm.com>

commit 677c1dd706d9cc384730cbd52baf821923d8be9b
Author: Hendrik Brueckner <brueckner at linux.vnet.ibm.com>
Date:   Fri Aug 7 10:39:24 2009 +0200

    [S390] kernel: Storing machine flags early in lowcore
    
    Currently, the machine_flags are stored late in the startup
    initialization which results in failing machine type checks
    (e.g. for MACHINE_IS_VM).
    To allow these checks, store the machine flags in the lowcore
    when the machine type has been detected.
    
    Moving the machine_flags to the lowcore has been introduced with
    git commit 25097bf153391f7be4c591d47061b3dc4990dac2
    
    Signed-off-by: Hendrik Brueckner <brueckner at linux.vnet.ibm.com>
    Signed-off-by: Martin Schwidefsky <schwidefsky at de.ibm.com>

commit 7dbdee2e9a2ac42ea5135801bcc9d1a8e3f672aa
Author: Steven Rostedt <srostedt at redhat.com>
Date:   Thu Aug 6 19:53:18 2009 -0400

    tracing: Fix recordmcount.pl to handle sections with only weak functions
    
    Roland Dreier found that a section that contained only a weak
    function in one of the staging drivers and this caused
    recordmcount.pl to spit out a warning and fail.
    
    Although it is strange that a driver would have a weak function, and
    this function only be used in one place, it should not be something
    to make recordmcount.pl fail.
    
    This patch fixes the issue in a simple manner: if only weak
    functions exist in a section, then that section will not be
    recorded.
    
    Reported-by: Roland Dreier <rdreier at cisco.com>
    Signed-off-by: Steven Rostedt <rostedt at goodmis.org>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 0d502d8267ebab9ae4b5b4c065d20196d6069f52
Merge: 09384dfc76e526c3993c09c42e016372dc9dd22c a9dfac3353b03432e3d46a0dde6795588c46256d
Author: David S. Miller <davem at davemloft.net>
Date:   Thu Aug 6 13:18:22 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lowpan/lowpan

commit 09384dfc76e526c3993c09c42e016372dc9dd22c
Author: Eric Dumazet <eric.dumazet at gmail.com>
Date:   Thu Aug 6 03:55:04 2009 +0000

    irda: Fix irda_getname() leak
    
    irda_getname() can leak kernel memory to user.
    
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 3d392475c873c10c10d6d96b94d092a34ebd4791
Author: Eric Dumazet <eric.dumazet at gmail.com>
Date:   Thu Aug 6 02:27:43 2009 +0000

    appletalk: fix atalk_getname() leak
    
    atalk_getname() can leak 8 bytes of kernel memory to user
    
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit f6b97b29513950bfbf621a83d85b6f86b39ec8db
Author: Eric Dumazet <eric.dumazet at gmail.com>
Date:   Thu Aug 6 03:31:07 2009 +0000

    netrom: Fix nr_getname() leak
    
    nr_getname() can leak kernel memory to user.
    
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 80922bbb12a105f858a8f0abb879cb4302d0ecaa
Author: Eric Dumazet <eric.dumazet at gmail.com>
Date:   Thu Aug 6 03:48:36 2009 +0000

    econet: Fix econet_getname() leak
    
    econet_getname() can leak kernel memory to user.
    
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 17ac2e9c58b69a1e25460a568eae1b0dc0188c25
Author: Eric Dumazet <eric.dumazet at gmail.com>
Date:   Thu Aug 6 03:34:06 2009 +0000

    rose: Fix rose_getname() leak
    
    rose_getname() can leak kernel memory to user.
    
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 1054598cab8674438675085fae459e960eb10799
Author: Peter Zijlstra <peterz at infradead.org>
Date:   Thu Aug 6 18:06:26 2009 +0200

    perf_counter: Fix double list iteration in per task precise stats
    
    Brice Goglin reported this crash with per task precise stats:
    
    > I finally managed to test the threaded perfcounter statistics (thanks a
    > lot for implementing it). I am running 2.6.31-rc5 (with the AMD
    > magny-cours patches but I don't think they matter here). I am trying to
    > measure local/remote memory accesses per thread during the well-known
    > stream benchmark. It's compiled with OpenMP using 16 threads on a
    > quad-socket quad-core barcelona machine.
    >
    > Command line is:
    >  /mnt/scratch/bgoglin/cpunode/linux-2.6.31/tools/perf/perf record -f -s
    > -e r1000001e0 -e r1000002e0 -e r1000004e0 -e r1000008e0 ./stream
    >
    > It seems to work fine with a single -e <counter> on the command line
    > while it crashes when there are at least 2 of them.
    > It seems to work fine without -s as well.
    
    A silly copy-paste resulted in a messed up iteration which would
    cause the OOPS.
    
    Reported-by: Brice Goglin <Brice.Goglin at inria.fr>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Tested-by: Brice Goglin <Brice.Goglin at inria.fr>
    LKML-Reference: <1249574786.32113.550.camel at twins>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 9424edc2da097c8589fcc24a72552d33e54be161
Author: Peter Zijlstra <a.p.zijlstra at chello.nl>
Date:   Wed Aug 5 14:05:16 2009 +0200

    perf: Auto-detect libelf
    
    Adds autodetection for libelf as well, and simplifies the
    libbfd code. Furthermore, fail make with an error when libelf
    is not found and warn about the lack of libbfd.
    
    Also provide an option to build a 32bit version even though you
    might be running a 64bit kernel.
    
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 4d1e00a8af426500edfb8643fa6c375b89f1f804
Author: Arnaldo Carvalho de Melo <acme at redhat.com>
Date:   Wed Aug 5 19:02:49 2009 -0300

    perf symbol: Fix symbol parsing in certain cases: use the build-id as a symlink
    
    In some cases distros have binaries and debuginfo in weird places:
    
    [root at doppio tuna]# ls -la /usr/lib64/{xulrunner-1.9.1/xulrunner-stub,firefox-3.5.2/firefox}
    -rwxr-xr-x 1 root root 90024 2009-08-03 19:45 /usr/lib64/firefox-3.5.2/firefox
    -rwxr-xr-x 1 root root 90024 2009-08-03 18:23 /usr/lib64/xulrunner-1.9.1/xulrunner-stub
    [root at doppio tuna]# sha1sum /usr/lib64/{xulrunner-1.9.1/xulrunner-stub,firefox-3.5.2/firefox}
    19a858077d263d5de22c9c5da250d3e4396ae739  /usr/lib64/xulrunner-1.9.1/xulrunner-stub
    19a858077d263d5de22c9c5da250d3e4396ae739  /usr/lib64/firefox-3.5.2/firefox
    [root at doppio tuna]# rpm -qf /usr/lib64/{xulrunner-1.9.1/xulrunner-stub,firefox-3.5.2/firefox}
    xulrunner-1.9.1.2-1.fc11.x86_64
    firefox-3.5.2-2.fc11.x86_64
    [root at doppio tuna]# ls -la /usr/lib/debug/{usr/lib64/xulrunner-1.9.1/xulrunner-stub,usr/lib64/firefox-3.5.2/firefox}.debug
    ls: cannot access /usr/lib/debug/usr/lib64/firefox-3.5.2/firefox.debug: No such file or directory
    -rwxr-xr-x 1 root root 403608 2009-08-03 18:22 /usr/lib/debug/usr/lib64/xulrunner-1.9.1/xulrunner-stub.debug
    
    Seemingly we don't have a .symtab when we actually can find it
    if we use the .note.gnu.build-id ELF section put in place by
    some distros. Use it and find the symbols we need.
    
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>
    Acked-by: Peter Zijlstra <peterz at infradead.org>
    LKML-Reference: <new-submission>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 469535a598f28c13a2a42037e1b778f671af1d16
Author: Robert Richter <robert.richter at amd.com>
Date:   Thu Jul 30 19:19:18 2009 +0200

    ring-buffer: Fix advance of reader in rb_buffer_peek()
    
    When calling rb_buffer_peek() from ring_buffer_consume() and a
    padding event is returned, the function rb_advance_reader() is
    called twice. This may lead to missing samples or under high
    workloads to the warning below. This patch fixes this. If a padding
    event is returned by rb_buffer_peek() it will be consumed by the
    calling function now.
    
    Also, I simplified some code in ring_buffer_consume().
    
    ------------[ cut here ]------------
    WARNING: at /dev/shm/.source/linux/kernel/trace/ring_buffer.c:2289 rb_advance_reader+0x2e/0xc5()
    Hardware name: Anaheim
    Modules linked in:
    Pid: 29, comm: events/2 Tainted: G        W  2.6.31-rc3-oprofile-x86_64-standard-00059-g5050dc2 #1
    Call Trace:
    [<ffffffff8106776f>] ? rb_advance_reader+0x2e/0xc5
    [<ffffffff81039ffe>] warn_slowpath_common+0x77/0x8f
    [<ffffffff8103a025>] warn_slowpath_null+0xf/0x11
    [<ffffffff8106776f>] rb_advance_reader+0x2e/0xc5
    [<ffffffff81068bda>] ring_buffer_consume+0xa0/0xd2
    [<ffffffff81326933>] op_cpu_buffer_read_entry+0x21/0x9e
    [<ffffffff810be3af>] ? __find_get_block+0x4b/0x165
    [<ffffffff8132749b>] sync_buffer+0xa5/0x401
    [<ffffffff810be3af>] ? __find_get_block+0x4b/0x165
    [<ffffffff81326c1b>] ? wq_sync_buffer+0x0/0x78
    [<ffffffff81326c76>] wq_sync_buffer+0x5b/0x78
    [<ffffffff8104aa30>] worker_thread+0x113/0x1ac
    [<ffffffff8104dd95>] ? autoremove_wake_function+0x0/0x38
    [<ffffffff8104a91d>] ? worker_thread+0x0/0x1ac
    [<ffffffff8104dc9a>] kthread+0x88/0x92
    [<ffffffff8100bdba>] child_rip+0xa/0x20
    [<ffffffff8104dc12>] ? kthread+0x0/0x92
    [<ffffffff8100bdb0>] ? child_rip+0x0/0x20
    ---[ end trace f561c0a58fcc89bd ]---
    
    Cc: Steven Rostedt <rostedt at goodmis.org>
    Cc: <stable at kernel.org>
    Signed-off-by: Robert Richter <robert.richter at amd.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit e0d82a0a4e9841b787e6431ccfbb515546c55dc2
Author: Benjamin Herrenschmidt <benh at kernel.crashing.org>
Date:   Thu Aug 6 21:16:44 2009 +1000

    perf_counter/powerpc: Check oprofile_cpu_type for NULL before using it
    
    If the current CPU doesn't support performance counters,
    cur_cpu_spec->oprofile_cpu_type can be NULL. The current
    perf_counter modules don't test for that case and would thus
    crash at boot time.
    
    Bug reported by David Woodhouse.
    
    Reported-by: David Woodhouse <dwmw2 at infradead.org>
    Signed-off-by: Benjamin Herrenschmidt <benh at kernel.crashing.org>
    Cc: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Signed-off-by: Paul Mackerras <paulus at samba.org>
    LKML-Reference: <19066.48028.446975.501454 at cargo.ozlabs.ibm.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit c5b1525533c484238015c48c78f86d49a1bfb86b
Author: Sheng Yang <sheng at linux.intel.com>
Date:   Thu Aug 6 13:31:56 2009 +0800

    intel-iommu: Fix enabling snooping feature by mistake
    
    Two defects work together result in KVM device passthrough randomly can't
    work:
    1. iommu_snooping is not initialized to zero when vm_iommu_init() called.
    So it is possible to get a random value.
    2. One line added by commit 2c2e2c38("IOMMU Identity Mapping Support")
    change the code path, let it bypass domain_update_iommu_cap(), as well as
    missing the increment of domain iommu reference count.
    
    The latter is also likely to cause a leak of domains on repeated VMM
    assignment and deassignment.
    
    Signed-off-by: Sheng Yang <sheng at linux.intel.com>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>

commit 53a27b39ff4d2492f84b1fdc2f0047175f0b0b93
Author: Marcelo Tosatti <mtosatti at redhat.com>
Date:   Wed Aug 5 15:43:58 2009 -0300

    KVM: MMU: limit rmap chain length
    
    Otherwise the host can spend too long traversing an rmap chain, which
    happens under a spinlock.
    
    Cc: stable at kernel.org
    Signed-off-by: Marcelo Tosatti <mtosatti at redhat.com>
    Signed-off-by: Avi Kivity <avi at redhat.com>

commit a9dfac3353b03432e3d46a0dde6795588c46256d
Author: Dmitry Eremin-Solenikov <dbaryshkov at gmail.com>
Date:   Mon Aug 3 17:53:00 2009 +0400

    af_ieee802154: provide dummy get/setsockopt
    
    Provide dummt get/setsockopt implementations to stop these
    syscalls from oopsing on our sockets.
    
    Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov at gmail.com>

commit 45a41d147a3a31bb218201b0dd70cfe4e9ed5105
Author: Dmitry Eremin-Solenikov <dbaryshkov at gmail.com>
Date:   Sun Aug 2 14:12:01 2009 +0400

    af_ieee802154: fix ioctl processing
    
    fix two errors in ioctl processing:
    1) if the ioctl isn't supported one should return -ENOIOCTLCMD
    2) don't call ndo_do_ioctl if the device doesn't provide it
    
    Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov at gmail.com>

commit d82f1c35348cebe2fb2d4a4d31ce0ab0769e3d93
Author: Eric Miao <eric.y.miao at gmail.com>
Date:   Wed Aug 5 01:24:41 2009 -0700

    Input: matrix_keypad - make matrix keymap size dynamic
    
    Remove assumption on the shift and size of rows/columns form
    matrix_keypad driver.
    
    Signed-off-by: Eric Miao <eric.y.miao at gmail.com>
    Signed-off-by: Dmitry Torokhov <dtor at mail.ru>

commit 194934785a846e0a7b1b674b7b475a9d0125d2f8
Author: TJ <linux at tjworld.net>
Date:   Mon Aug 3 13:39:09 2009 -0700

    Input: wistron_btns - support Prestigio Wifi RF kill button
    
    The Prestigio 157, an old no-name clone laptop uses input keys very
    similar to the Wistron 1557/MS2141 with the addition of BIOS-controlled
    wireless radio frequency kill switch.
    
    This patch adds support for the RF kill switch control and adds manual
    identification of the model.
    
    The Prestigio does not expose any recognisable identity via dmidecode
    and so requires manual selection at module init using
    
    force=1 keymap=prestigio
    
    Signed-off-by: TJ <ubuntu at tjworld.net>
    Signed-off-by: Dmitry Torokhov <dtor at mail.ru>

commit 985fe845aea9cd56fd351800302270444556e45a
Author: Jerome Glisse <jglisse at redhat.com>
Date:   Wed Jul 29 18:55:53 2009 +0200

    drm/radeon/kms: Fix caching mode selection for GTT object
    
    GTT object can either be cached,uncached or wc just let core ttm
    pick the best mode according to how the bo driver and GTT memory
    type was initialized.
    
    Signed-off-by: Jerome Glisse <jglisse at redhat.com>
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit af6af30c0fcd77e621638e53ef8b176bca8bd3b4
Author: Peter Zijlstra <peterz at infradead.org>
Date:   Wed Aug 5 20:41:04 2009 +0200

    ftrace: Fix perf-tracepoint OOPS
    
    Not all tracepoints are created equal, in specific the ftrace
    tracepoints are created with TRACE_EVENT_FORMAT() which does
    not generate the needed bits to tie them into perf counters.
    
    For those events, don't create the 'id' file and fail
    ->profile_enable when their ID is specified through other
    means.
    
    Reported-by: Chris Mason <chris.mason at oracle.com>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Steven Rostedt <rostedt at goodmis.org>
    LKML-Reference: <1249497664.5890.4.camel at laptop>
    [ v2: fix build error in the !CONFIG_EVENT_PROFILE case ]
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 1bbf20835c4e088667a090ce6523a0f70b62dc76
Author: Darren Hart <dvhltc at us.ibm.com>
Date:   Wed Aug 5 12:05:21 2009 -0700

    rtmutex: Avoid deadlock in rt_mutex_start_proxy_lock()
    
    In the event of a lock steal or owner died,
    rt_mutex_start_proxy_lock() will give the rt_mutex to the
    waiting task, but it fails to release the wait_lock. This leads
    to subsequent deadlocks when other tasks try to acquire the
    rt_mutex.
    
    I also removed a few extra blank lines that really spaced this
    routine out. I must have been high on the \n when I wrote this
    originally...
    
    Signed-off-by: Darren Hart <dvhltc at us.ibm.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    Cc: Steven Rostedt <rostedt at goodmis.org>
    Cc: Dinakar Guniguntala <dino at in.ibm.com>
    Cc: John Stultz <johnstul at linux.vnet.ibm.com>
    LKML-Reference: <4A79D7F1.4000405 at us.ibm.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit b4adbb4ddf63091f48668e7ff1b9b0f6f84d4b40
Author: Pascal Terjan <pterjan at mandriva.com>
Date:   Wed Aug 5 04:11:39 2009 +0000

    Add IDs for 3C905B-TX Fast Etherlink XL PCI
    
    We found this old card which was not supported, and physically
    looks similar to the other 3C905B we have (9055).
    
    After adding the IDs it seems to work fine (MII report, dhcp, scp, ...)
    
    Acked-by: Steffen Klassert <klassert at mathematik.tu-chemnitz.de>
    
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 3f6e968ef4e1d8d93d8a8505461b0e50a9e97ad8
Author: Steven Rostedt <rostedt at goodmis.org>
Date:   Wed Aug 5 22:00:14 2009 -0400

    tracing: do not use functions starting with .L in recordmcount.pl
    
    On Wed, 5 Aug 2009, Ingo Molnar wrote:
    > * Dave Airlie <airlied at gmail.com> wrote:
    >
    > > Hey,
    > >
    > > So I spent 3-4 hrs today (I'm stupid yes) tracking down a .o
    > > breakage by blaming rawhide gcc/binutils as I was using make
    > > V=1and seeing only the compiler chain running,
    >
    > Hm, is this that powerpc related build bug you just reported?
    
    Well we tracked it down and it is powerpc64 specific.
    
    Seems that in drivers/hwmon/lm93.c there's a function called:
    
       LM93_IN_FROM_REG()
    
    But PPC64 has function descriptors and the real function names (the ones
    you see in objdump) start with a '.'. Thus this in objdump you have:
    
     Disassembly of section .text:
    
     0000000000000000 <.LM93_IN_FROM_REG>:
           0:       7c 08 02 a6     mflr    r0
           4:       fb 81 ff e0     std     r28,-32(r1)
    
    The function name used is .LM93_IN_FROM_REG. But gcc considers symbols
    that start with ".L" as a special symbol that is used inside the assembly
    stage.
    
    The nm passed into recordmcount uses the --synthetic option which shows
    the ".L" symbols (my runs outside of the build did not include the
    --synthetic option, so my older patch worked). We see the function as a
    local.
    
    Now to capture all the locations that use "mcount" we need to have a
    reference to link into the object file a list of mcount callers. We need a
    reference that will not disappear. We try to use a global function and if
    that does not work, we use a local function as a reference. But to relink
    the section back into the object, we need to make it global. In this case,
    we run objcopy using --globalize-symbol and --localize-symbol to convert
    the symbol into a global symbol, link the mcount list, then convert it
    back to a local symbol.
    
    This works great except for this case. .L* symbols can not be converted
    into a global symbol, and the mcount section referencing it will remain
    unresolved.
    
    Reported-by: Dave Airlie <airlied at gmail.com>
    LKML-Reference: <alpine.DEB.2.00.0908052011590.5010 at gandalf.stny.rr.com>
    Signed-off-by: Steven Rostedt <rostedt at goodmis.org>

commit 464e85eb0e63096bd52e4c3e2a6fb8357fb95828
Author: Steven Rostedt <srostedt at redhat.com>
Date:   Wed Aug 5 15:26:37 2009 -0400

    ring-buffer: do not disable ring buffer on oops_in_progress
    
    The commit:
    
      commit e0fdace10e75dac67d906213b780ff1b1a4cc360
      Author: David Miller <davem at davemloft.net>
      Date:   Fri Aug 1 01:11:22 2008 -0700
    
        debug_locks: set oops_in_progress if we will log messages.
    
        Otherwise lock debugging messages on runqueue locks can deadlock the
        system due to the wakeups performed by printk().
    
        Signed-off-by: David S. Miller <davem at davemloft.net>
        Signed-off-by: Ingo Molnar <mingo at elte.hu>
    
    Will permanently set oops_in_progress on any lockdep failure.
    When this triggers it will cause any read from the ring buffer to
    permanently disable the ring buffer (not to mention no locking of
    printk).
    
    This patch removes the check. It keeps the print in NMI which makes
    sense. This is probably OK, since the ring buffer should not cause
    something to set oops_in_progress anyway.
    
    Signed-off-by: Steven Rostedt <rostedt at goodmis.org>

commit 0f2541d299d233eddddee4345795e0c46264fd56
Author: Steven Rostedt <srostedt at redhat.com>
Date:   Wed Aug 5 12:02:48 2009 -0400

    ring-buffer: fix check of try_to_discard result
    
    The function ring_buffer_discard_commit inversed the code path
    of the result of try_to_discard. It should skip incrementing the
    entry counter if try_to_discard succeeded. But instead, it increments
    the entry conder if it succeeded to discard, and does not increment
    it if it fails.
    
    The result of this bug is that filtering will make the stat counters
    incorrect.
    
    Signed-off-by: Steven Rostedt <rostedt at goodmis.org>

commit c0c60c4b9ab45bb02b20796401dd6a90770fd0ee
Author: Hartley Sweeten <hartleys at visionengravers.com>
Date:   Tue Aug 4 23:38:06 2009 +0100

    ARM: 5639/1: arm: clkdev.c should include <linux/clk.h>
    
    <linux/clk.h> should be included to get the base API prototypes.
    
    This fixes the following sparse warnings:
    
      arch/arm/common/clkdev.c:65:12:
        warning: symbol 'clk_get_sys' was not declared. Should it be static?
    
      arch/arm/common/clkdev.c:79:12:
        warning: symbol 'clk_get' was not declared. Should it be static?
    
      arch/arm/common/clkdev.c:87:6:
        warning: symbol 'clk_put' was not declared. Should it be static?
    
    Signed-off-by: H Hartley Sweeten <hsweeten at visionengravers.com>
    Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>

commit 65a5053b764a42d33b334ba55810bb5b56eb92df
Author: Hartley Sweeten <hartleys at visionengravers.com>
Date:   Tue Aug 4 23:20:45 2009 +0100

    ARM: 5638/1: arch/arm/kernel/signal.c: use correct address space for CRUNCH
    
    preserve_crunch_context() calls __copy_to_user() which expects the
    destination address to be in __user space.  setup_sigframe() properly
    passes the destination address.
    
    restore_crunch_context() calls __copy_from_user() which expects the
    source address to be in __user space.  restore_sigframe() properly
    passes the source address.
    
    This fixes {preserve/restore}_crunch_context() to accept the
    address as __user space and resolves the following sparse warnings:
    
      arch/arm/kernel/signal.c:146:31:
         warning: incorrect type in argument 1 (different address spaces)
            expected void [noderef] <asn:1>*to
            got struct crunch_sigframe *frame
    
      arch/arm/kernel/signal.c:156:38:
         warning: incorrect type in argument 2 (different address spaces)
            expected void const [noderef] <asn:1>*from
            got struct crunch_sigframe *frame
    
      arch/arm/kernel/signal.c:250:48:
         warning: incorrect type in argument 1 (different address spaces)
            expected struct crunch_sigframe *frame
            got struct crunch_sigframe [noderef] <asn:1>*<noident>
    
      arch/arm/kernel/signal.c:365:49:
         warning: incorrect type in argument 1 (different address spaces)
            expected struct crunch_sigframe *frame
            got struct crunch_sigframe [noderef] <asn:1>*<noident>
    
    Signed-off-by: H Hartley Sweeten <hsweeten at visionengravers.com>
    Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>

commit 0a51810aa058a0a4ac76dd6f87f4d10bee774e2e
Author: Andrew Victor <linux at maxim.org.za>
Date:   Tue Aug 4 19:55:56 2009 +0100

    ARM: 5637/1: [KS8695] Don't reference CLOCK_TICK_RATE in drivers
    
    Stop referencing CLOCK_TICK_RATE in the KS8695 drivers, rather refer
    to a KS8695_CLOCK_RATE.
    Issue pointed out by Russell King on arm-linux-kernel mailing list.
    
    Signed-off-by: Andrew Victor <linux at maxim.org.za>
    Signed-off-by: Russell King <rmk+kernel at arm.linux.org.uk>

commit cf39c4c572dc54adbdf8933d1e6cd87ee94d8fc0
Author: Eric Dumazet <eric.dumazet at gmail.com>
Date:   Mon Jul 27 08:03:18 2009 -0700

    phonet: phonet_device_get() fix
    
    net/phonet/pn_dev.c: In function `phonet_device_get':
    net/phonet/pn_dev.c:99: warning: 'dev' might be used uninitialized in this function
    
    Signed-off-by: Eric Dumazet <eric.dumazet at gmail.com>
    Acked-by: Rémi Denis-Courmont <remi.denis-courmont at nokia.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 819e0064634f580ab618189e657ea58341d214b7
Author: Roel Kluin <roel.kluin at gmail.com>
Date:   Sun Jul 26 00:50:38 2009 +0200

    drm/i915: Fix read outside array bounds in restoring the SWF10 range.
    
    dev_priv->saveSWF1 is a 16 element array, but this reads up to index 22,
    and restored values from the wrong registers.
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: Eric Anholt <eric at anholt.net>

commit 9c9fe1f841745184bbc5460c6f3909fded3b929b
Author: Eric Anholt <eric at anholt.net>
Date:   Mon Aug 3 16:09:16 2009 -0700

    drm/i915: Use our own workqueue to avoid wedging the system along with the GPU.
    
    Signed-off-by: Eric Anholt <eric at anholt.net>

commit 476181cb05c6a3aea3ef42309388e255c934a06f
Author: Wei Yongjun <yjwei at cn.fujitsu.com>
Date:   Tue Aug 4 21:44:39 2009 +0000

    dccp: missing destroy of percpu counter variable while unload module
    
    percpu counter dccp_orphan_count is init in dccp_init() by
    percpu_counter_init() while dccp module is loaded, but the
    destroy of it is missing while dccp module is unloaded. We
    can get the kernel WARNING about this. Reproduct by the
    following commands:
    
      $ modprobe dccp
      $ rmmod dccp
      $ modprobe dccp
    
    WARNING: at lib/list_debug.c:26 __list_add+0x27/0x5c()
    Hardware name: VMware Virtual Platform
    list_add corruption. next->prev should be prev (c080c0c4), but was (null). (next
    =ca7188cc).
    Modules linked in: dccp(+) nfsd lockd nfs_acl auth_rpcgss exportfs sunrpc
    Pid: 1956, comm: modprobe Not tainted 2.6.31-rc5 #55
    Call Trace:
     [<c042f8fa>] warn_slowpath_common+0x6a/0x81
     [<c053a6cb>] ? __list_add+0x27/0x5c
     [<c042f94f>] warn_slowpath_fmt+0x29/0x2c
     [<c053a6cb>] __list_add+0x27/0x5c
     [<c053c9b3>] __percpu_counter_init+0x4d/0x5d
     [<ca9c90c7>] dccp_init+0x19/0x2ed [dccp]
     [<c0401141>] do_one_initcall+0x4f/0x111
     [<ca9c90ae>] ? dccp_init+0x0/0x2ed [dccp]
     [<c06971b5>] ? notifier_call_chain+0x26/0x48
     [<c0444943>] ? __blocking_notifier_call_chain+0x45/0x51
     [<c04516f7>] sys_init_module+0xac/0x1bd
     [<c04028e4>] sysenter_do_call+0x12/0x22
    
    Signed-off-by: Wei Yongjun <yjwei at cn.fujitsu.com>
    Acked-by: Eric Dumazet <eric.dumazet at gmail.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit f60f785679b507cbeeb03d2db080ab649ac86027
Author: Dhananjay Phadke <dhananjay at netxen.com>
Date:   Tue Aug 4 10:39:03 2009 +0000

    netxen: fix dma mask update calculation
    
    Fix dma mask calculation that caps at 63-bit addressing even
    when firmware advertises full 64-bit support.
    
    Signed-off-by: Dhananjay Phadke <dhananjay at netxen.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 6fd210a9cc398ecbff7bcdbe220651b73b654f56
Author: Kevin Hilman <khilman at deeprootsystems.com>
Date:   Mon Jul 20 09:09:23 2009 -0700

    OMAP3: Overo: add missing pen-down GPIO definition
    
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit 55b6019ae29456e0f1e4087546bf4221c48622a0
Author: Kevin Hilman <khilman at deeprootsystems.com>
Date:   Thu Jun 4 15:57:10 2009 -0700

    OMAP: GPIO: clear/restore level/edge detect settings on mask/unmask
    
    If IRQ triggering is enabled, it can trigger a pending interrupt
    even for masked interrupts.  Any pending GPIO interrupts can
    prevent the powerdomain from hitting retention.
    
    Problem found, reported and additional review and testing by Chunquiu
    Wang.
    
    Tested-by: Chunquiu Wang <cqwang at motorola.com>
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit 6c5f80393b107b0c9e2a54b03b65d1880e706655
Author: Jouni Hogander <jouni.hogander at nokia.com>
Date:   Wed Oct 29 12:06:04 2008 +0200

    OMAP3: PM: Fix wrong sequence in suspend.
    
    Powerdomain previous state is checked after restoring new states in
    suspend. This patch fixes this problem.
    
    Signed-off-by: Jouni Hogander <jouni.hogander at nokia.com>
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit 60c45ae1107c4ec47d2c84e5984ea59d02b2863d
Author: Eero Nurkkala <ext-eero.nurkkala at nokia.com>
Date:   Tue Jun 23 12:53:29 2009 +0300

    OMAP: PM: CPUfreq: obey min/max settings of policy
    
    Use the min/max settings from CPUfreq policy rather than
    processor defined min/max settings.
    
    Without this patch, it's possible to scale frequency outside
    the current policy range.
    
    Signed-off-by: Eero Nurkkala <ext-eero.nurkkala at nokia.com>
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit bcf396c48012a5e4c7ab77be5c40df10d6bdb8ad
Author: Kevin Hilman <khilman at deeprootsystems.com>
Date:   Tue Jun 30 21:02:45 2009 -0700

    OMAP2/3/4: UART: allow in-order port traversal
    
    Use list_add_tail() when adding discovered UART ports.  This is so
    traversal using list_for_each_entry() will traverse the list in the
    order they were found.
    
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit fd455ea899b5a14a8cdd276e15f3b47696526f92
Author: Kevin Hilman <khilman at deeprootsystems.com>
Date:   Mon Apr 27 12:27:36 2009 -0700

    OMAP2/3/4: UART: Allow per-UART disabling wakeup for serial ports
    
    This patch causes the OMAP uarts to honor the sysfs power/wakeup file
    for IOPAD wakeups. Before the OMAP was always woken up from off mode
    on a rs232 signal change.  This patch also creates a different
    platform device for each serial port so that the wakeup properties can
    be control per port.
    
    By default, IOPAD wakeups are enabled for each UART.  To disable,
    
      # echo disabled > /sys/devices/platform/serial8250.0/power/wakeup
    
    Where serial8250.0 can be replaced by .1, or .2 to control the other
    ports.
    
    Original idea and original patch from Russ Dill <russ.dill at gmail.com>
    
    Cc: Russ Dill <russ.dill at gmail.com>
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit 2466211e5debd205fc550d871fe0ab9b9a6d02ed
Author: Tero Kristo <tero.kristo at nokia.com>
Date:   Thu Mar 5 16:32:23 2009 +0200

    OMAP3: Fixed crash bug with serial + suspend
    
    It was possible for an unhandled interrupt to occur if there was incoming
    serial traffic during wakeup from suspend. This was caused by the code
    in arch-arm/mach-omap2/serial.c keeping interrupt enabled all the time,
    but not acking its interrupts. Applies on top of PM branch.
    
    Use the PM begin/end hooks to ensure that the "serial idle" interrupts
    are disabled during the suspend path.  Also, since begin/end hooks are
    now used, use the suspend_state that is passed in the begin hook instead
    of the enter hook as per the platform_suspend_ops docs.
    
    Signed-off-by: Tero Kristo <tero.kristo at nokia.com>
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit 4789998a30d845d94a7595076d1392ffd5a9d39e
Author: Kevin Hilman <khilman at deeprootsystems.com>
Date:   Wed Jun 24 10:32:03 2009 -0700

    OMAP4: UART: cleanup special case IRQ handling
    
    Streamline the OMAP4 special IRQ assignments by putting inside
    normal init loop instead of having a separate loop.
    
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit 10f90ed2d727c0f344d910c02c9726d0481d9b00
Author: Kevin Hilman <khilman at deeprootsystems.com>
Date:   Wed Jun 24 11:39:18 2009 -0700

    OMAP3: PM: Do not build suspend code if SUSPEND is not enabled
    
    Signed-off-by: Jouni Hogander <jouni.hogander at nokia.com>
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit 040fed059c34da5115790609f1a038fc9aec88d1
Author: Kevin Hilman <khilman at deeprootsystems.com>
Date:   Tue May 5 16:34:25 2009 -0700

    OMAP3: PM: prevent module wakeups from waking IVA2
    
    By default, prevent functional wakeups from inside a module from
    waking up the IVA2.  Let DSP Bridge code handle this when loaded.
    
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit 3a07ae30a0bfa93ff2b242acf670c6d8e2de35de
Author: Kevin Hilman <khilman at deeprootsystems.com>
Date:   Mon Apr 27 16:14:54 2009 -0700

    OMAP3: PM: Clear pending PRCM reset flags on init
    
    Any pending reset flags can prevent retention.  Ensure they are all
    cleared during boot.
    
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit 3a6667acf916b3e32be4682196882fc2ed0ec23e
Author: Kevin Hilman <khilman at deeprootsystems.com>
Date:   Mon Apr 27 07:50:23 2009 -0700

    OMAP3: PM: Ensure PRCM interrupts are cleared at boot
    
    Any pending PRCM interrupts can prevent retention.  Ensure
    they are cleared during boot.
    
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit 364dd47466ff7a7749bf037df4bf3b7aedbfe6f4
Author: Kevin Hilman <khilman at deeprootsystems.com>
Date:   Tue Jun 9 11:45:30 2009 -0700

    OMAP3: PM: CM_REGADDR macros using wrong name
    
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit 7cc515f74d2871daff106a17714bfd16bcb045ca
Author: Kevin Hilman <khilman at deeprootsystems.com>
Date:   Wed Jun 10 09:02:25 2009 -0700

    OMAP2/3: PM: make PM __init calls static
    
    Signed-off-by: Kevin Hilman <khilman at deeprootsystems.com>

commit 0bf52b981770cbf006323bab5177f2858a196766
Author: Ingo Molnar <mingo at elte.hu>
Date:   Tue Aug 4 21:16:58 2009 +0000

    net: Fix spinlock use in alloc_netdev_mq()
    
    -tip testing found this lockdep warning:
    
    [    2.272010] calling  net_dev_init+0x0/0x164 @ 1
    [    2.276033] device class 'net': registering
    [    2.280191] INFO: trying to register non-static key.
    [    2.284005] the code is fine but needs lockdep annotation.
    [    2.284005] turning off the locking correctness validator.
    [    2.284005] Pid: 1, comm: swapper Not tainted 2.6.31-rc5-tip #1145
    [    2.284005] Call Trace:
    [    2.284005]  [<7958eb4e>] ? printk+0xf/0x11
    [    2.284005]  [<7904f83c>] __lock_acquire+0x11b/0x622
    [    2.284005]  [<7908c9b7>] ? alloc_debug_processing+0xf9/0x144
    [    2.284005]  [<7904e2be>] ? mark_held_locks+0x3a/0x52
    [    2.284005]  [<7908dbc4>] ? kmem_cache_alloc+0xa8/0x13f
    [    2.284005]  [<7904e475>] ? trace_hardirqs_on_caller+0xa2/0xc3
    [    2.284005]  [<7904fdf6>] lock_acquire+0xb3/0xd0
    [    2.284005]  [<79489678>] ? alloc_netdev_mq+0xf5/0x1ad
    [    2.284005]  [<79591514>] _spin_lock_bh+0x2d/0x5d
    [    2.284005]  [<79489678>] ? alloc_netdev_mq+0xf5/0x1ad
    [    2.284005]  [<79489678>] alloc_netdev_mq+0xf5/0x1ad
    [    2.284005]  [<793a38f2>] ? loopback_setup+0x0/0x74
    [    2.284005]  [<798eecd0>] loopback_net_init+0x20/0x5d
    [    2.284005]  [<79483efb>] register_pernet_device+0x23/0x4b
    [    2.284005]  [<798f5c9f>] net_dev_init+0x115/0x164
    [    2.284005]  [<7900104f>] do_one_initcall+0x4a/0x11a
    [    2.284005]  [<798f5b8a>] ? net_dev_init+0x0/0x164
    [    2.284005]  [<79066f6d>] ? register_irq_proc+0x8c/0xa8
    [    2.284005]  [<798cc29a>] do_basic_setup+0x42/0x52
    [    2.284005]  [<798cc30a>] kernel_init+0x60/0xa1
    [    2.284005]  [<798cc2aa>] ? kernel_init+0x0/0xa1
    [    2.284005]  [<79003e03>] kernel_thread_helper+0x7/0x10
    [    2.284078] device: 'lo': device_add
    [    2.288248] initcall net_dev_init+0x0/0x164 returned 0 after 11718 usecs
    [    2.292010] calling  neigh_init+0x0/0x66 @ 1
    [    2.296010] initcall neigh_init+0x0/0x66 returned 0 after 0 usecs
    
    it's using an zero-initialized spinlock. This is a side-effect of:
    
            dev_unicast_init(dev);
    
    in alloc_netdev_mq() making use of dev->addr_list_lock.
    
    The device has just been allocated freshly, it's not accessible
    anywhere yet so no locking is needed at all - in fact it's wrong
    to lock it here (the lock isnt initialized yet).
    
    This bug was introduced via:
    
    | commit a6ac65db2329e7685299666f5f7b6093c7b0f3a0
    | Date:   Thu Jul 30 01:06:12 2009 +0000
    |
    |     net: restore the original spinlock to protect unicast list
    
    Signed-off-by: Ingo Molnar <mingo at elte.hu>
    Acked-by: Jiri Pirko <jpirko at redhat.com>
    Tested-by: Mark Brown <broonie at opensource.wolfsonmicro.com>
    Signed-off-by: David S. Miller <davem at davemloft.net>

commit 386c0b702b1ea81c0f54f5c9832a3d4a52270f14
Author: Arnaldo Carvalho de Melo <acme at redhat.com>
Date:   Wed Aug 5 10:04:53 2009 -0300

    perf report: Add missing command line options to man page
    
    Signed-off-by: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Peter Zijlstra <peterz at infradead.org>
    LKML-Reference: <20090805130453.GC10688 at ghostprotocols.net>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit b37c45b8c27c049dc44673e40fd63820fd9a9d91
Author: Roger Quadros <ext-roger.quadros at nokia.com>
Date:   Wed Aug 5 16:53:24 2009 +0300

    OMAP: GPIO: Fix incorrect gpio_get logic for output GPIOs
    
    gpio_get() should return DATAIN register value when the GPIO
    is configured as input whereas it should return DATAOUT register
    value when the GPIO is configured as output.
    Now /sys/kernel/debug/gpio shows proper values for output GPIOs
    
    Signed-off-by: Roger Quadros <ext-roger.quadros at nokia.com>
    Signed-off-by: Tony Lindgren <tony at atomide.com>

commit 2cdbc46d7b2cb0acb68c3ecad93b000552121fa6
Author: Peter Zijlstra <a.p.zijlstra at chello.nl>
Date:   Wed Aug 5 14:05:16 2009 +0200

    perf: Auto-detect libbfd
    
    Since the C++ demangling isn't needed for everybody and
    bfd/iberty aren't widely/easily available on all machines, make
    it optional.
    
    It also allows you to forcefully disable demangling by using
    NO_DEMANGLE=1 and otherwise tries to detect libbfd/libiberty
    combinations that result in a compiling demangler.
    
    Reported-by: Jens Axboe <jens.axboe at oracle.com>
    Signed-off-by: Peter Zijlstra <a.p.zijlstra at chello.nl>
    Cc: Arnaldo Carvalho de Melo <acme at redhat.com>
    Cc: Kyle McMartin <kyle at mcmartin.ca>
    LKML-Reference: <20090801082048.GX12579 at kernel.dk>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit e9cbde8c158629cc96a26b2323c4a243536c1951
Author: Avi Kivity <avi at redhat.com>
Date:   Mon Jul 6 12:49:39 2009 +0300

    KVM: ia64: fix build failures due to ia64/unsigned long mismatches
    
    Signed-off-by: Avi Kivity <avi at redhat.com>

commit c428dcc9b9f967945992a2f8529e8c50a31d7913
Author: Stephen Rothwell <sfr at canb.auug.org.au>
Date:   Wed Jun 17 15:04:19 2009 +1000

    KVM: Make KVM_HPAGES_PER_HPAGE unsigned long to avoid build error on powerpc
    
    Eliminates this compiler warning:
    
    arch/powerpc/kvm/../../../virt/kvm/kvm_main.c:1178: error: integer overflow in expression
    
    Signed-off-by: Stephen Rothwell <sfr at canb.auug.org.au>
    Signed-off-by: Avi Kivity <avi at redhat.com>

commit 114cfab222233f50f46d7162cf7d99fdc6c271e5
Author: Pekka Enberg <penberg at cs.helsinki.fi>
Date:   Wed Aug 5 13:25:21 2009 +0300

    perf report: Make --sort comm,dso,symbol the default
    
    If you're doing performance testing, you're interested in the
    symbols anyway so lets make "--sort comm,dso,symbol" the
    default sort option.
    
    Signed-off-by: Pekka Enberg <penberg at cs.helsinki.fi>
    Acked-by: Peter Zijlstra <peterz at infradead.org>
    Cc: acme at redhat.com
    LKML-Reference: <1249467921-10450-1-git-send-email-penberg at cs.helsinki.fi>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 5116d8f6b977970ebefc1932c0f313163a6ec91f
Author: Michael S. Tsirkin <mst at redhat.com>
Date:   Sun Jul 26 17:10:01 2009 +0300

    KVM: fix ack not being delivered when msi present
    
    kvm_notify_acked_irq does not check irq type, so that it sometimes
    interprets msi vector as irq.  As a result, ack notifiers are not
    called, which typially hangs the guest.  The fix is to track and
    check irq type.
    
    Signed-off-by: Michael S. Tsirkin <mst at redhat.com>
    Signed-off-by: Avi Kivity <avi at redhat.com>

commit d3bc2f91b4761a8d9f96bea167fef2f8c00dea54
Author: Christian Borntraeger <borntraeger at de.ibm.com>
Date:   Thu Jul 16 17:17:37 2009 +0200

    KVM: s390: fix wait_queue handling
    
    There are two waitqueues in kvm for wait handling:
    vcpu->wq for virt/kvm/kvm_main.c and
    vpcu->arch.local_int.wq for the s390 specific wait code.
    
    the wait handling in kvm_s390_handle_wait was broken by using different
    wait_queues for add_wait queue and remove_wait_queue.
    
    There are two options to fix the problem:
    o  move all the s390 specific code to vcpu->wq and remove
       vcpu->arch.local_int.wq
    o  move all the s390 specific code to vcpu->arch.local_int.wq
    
    This patch chooses the 2nd variant for two reasons:
    o  s390 does not use kvm_vcpu_block but implements its own enabled wait
       handling.
       Having a separate wait_queue make it clear, that our wait mechanism is
       different
    o  the patch is much smaller
    
    Report-by:  Julia Lawall <julia at diku.dk>
    Signed-off-by: Christian Borntraeger <borntraeger at de.ibm.com>
    Signed-off-by: Marcelo Tosatti <mtosatti at redhat.com>
    Signed-off-by: Avi Kivity <avi at redhat.com>

commit 263799a3616242201e20fd2025fe84047b1379b1
Author: Jan Kiszka <jan.kiszka at siemens.com>
Date:   Tue Jul 21 10:43:07 2009 +0200

    KVM: VMX: Fix locking imbalance on emulation failure
    
    We have to disable preemption and IRQs on every exit from
    handle_invalid_guest_state, otherwise we generate at least a
    preempt_disable imbalance.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Marcelo Tosatti <mtosatti at redhat.com>
    Signed-off-by: Avi Kivity <avi at redhat.com>

commit 34f0c1ad27a74bd5eb0f99ea43ab6a4658d6419d
Author: Jan Kiszka <jan.kiszka at web.de>
Date:   Wed Jul 22 23:53:26 2009 +0200

    KVM: VMX: Fix locking order in handle_invalid_guest_state
    
    Release and re-acquire preemption and IRQ lock in the same order as
    vcpu_enter_guest does.
    
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Marcelo Tosatti <mtosatti at redhat.com>
    Signed-off-by: Avi Kivity <avi at redhat.com>

commit 025dbbf36a7680bffe54d9dcbf0a8bc01a7cbd10
Author: Marcelo Tosatti <mtosatti at redhat.com>
Date:   Wed Jul 22 13:05:49 2009 -0300

    KVM: MMU: handle n_free_mmu_pages > n_alloc_mmu_pages in kvm_mmu_change_mmu_pages
    
    kvm_mmu_change_mmu_pages mishandles the case where n_alloc_mmu_pages is
    smaller then n_free_mmu_pages, by not checking if the result of
    the subtraction is negative.
    
    Its a valid condition which can happen if a large number of pages has
    been recently freed.
    
    Signed-off-by: Marcelo Tosatti <mtosatti at redhat.com>
    Signed-off-by: Avi Kivity <avi at redhat.com>

commit 4b656b1202498184a0ecef86b3b89ff613b9c6ab
Author: Marcelo Tosatti <mtosatti at redhat.com>
Date:   Tue Jul 21 12:47:45 2009 -0300

    KVM: SVM: force new asid on vcpu migration
    
    If a migrated vcpu matches the asid_generation value of the target pcpu,
    there will be no TLB flush via TLB_CONTROL_FLUSH_ALL_ASID.
    
    The check for vcpu.cpu in pre_svm_run is meaningless since svm_vcpu_load
    already updated it on schedule in.
    
    Such vcpu will VMRUN with stale TLB entries.
    
    Based on original patch from Joerg Roedel (http://patchwork.kernel.org/patch/10021/)
    
    Signed-off-by: Marcelo Tosatti <mtosatti at redhat.com>
    Acked-by: Joerg Roedel <joerg.roedel at amd.com>
    Signed-off-by: Avi Kivity <avi at redhat.com>

commit d6289b9365c3f622a8cfe62c4fb054bb70b5061a
Author: Marcelo Tosatti <mtosatti at redhat.com>
Date:   Mon Jun 22 15:27:56 2009 -0300

    KVM: x86: verify MTRR/PAT validity
    
    Do not allow invalid memory types in MTRR/PAT (generating a #GP
    otherwise).
    
    Signed-off-by: Marcelo Tosatti <mtosatti at redhat.com>
    Signed-off-by: Avi Kivity <avi at redhat.com>

commit 0ff77873b1318fc2d77a85e70690d3cd6cafbd41
Author: Marcelo Tosatti <mtosatti at redhat.com>
Date:   Thu Jul 2 20:02:15 2009 -0300

    KVM: PIT: fix kpit_elapsed division by zero
    
    Fix division by zero triggered by latch count command on uninitialized
    counter.
    
    Cc: stable at kernel.org
    Signed-off-by: Marcelo Tosatti <mtosatti at redhat.com>
    Signed-off-by: Avi Kivity <avi at redhat.com>

commit e125e7b6944898831b56739a5448e705578bf7e2
Author: Jan Kiszka <jan.kiszka at web.de>
Date:   Thu Jul 2 21:45:47 2009 +0200

    KVM: Fix KVM_GET_MSR_INDEX_LIST
    
    So far, KVM copied the emulated_msrs (only MSR_IA32_MISC_ENABLE) to a
    wrong address in user space due to broken pointer arithmetic. This
    caused subtle corruption up there (missing MSR_IA32_MISC_ENABLE had
    probably no practical relevance). Moreover, the size check for the
    user-provided kvm_msr_list forgot about emulated MSRs.
    
    Cc: stable at kernel.org
    Signed-off-by: Jan Kiszka <jan.kiszka at siemens.com>
    Signed-off-by: Avi Kivity <avi at redhat.com>

commit 7d5b005652bc5ae3e1e0efc53fd0e25a643ec506
Author: Alok Kataria <akataria at vmware.com>
Date:   Tue Aug 4 15:34:22 2009 -0700

    x86: Fix VMI && stack protector
    
    With CONFIG_STACK_PROTECTOR turned on, VMI doesn't boot with
    more than one processor. The problem is with the gs value not
    being initialized correctly when registering the secondary
    processor for VMI's case.
    
    The patch below initializes the gs value for the AP to
    __KERNEL_STACK_CANARY. Without this the secondary processor
    keeps on taking a GP on every gs access.
    
    Signed-off-by: Alok N Kataria <akataria at vmware.com>
    Cc: <stable at kernel.org> # for v2.6.30.x
    LKML-Reference: <1249425262.18955.40.camel at ank32.eng.vmware.com>
    Signed-off-by: Ingo Molnar <mingo at elte.hu>

commit 33041ec049d39a6e0463c7edc7b6f631d24559e3
Author: Fenghua Yu <fenghua.yu at intel.com>
Date:   Tue Aug 4 15:10:59 2009 -0700

    intel-iommu: Mask physical address to correct page size in intel_map_single()
    
    The physical address passed to domain_pfn_mapping() should be rounded
    down to the start of the MM page, not the VT-d page.
    
    This issue causes kernel panic on PAGE_SIZE>VTD_PAGE_SIZE platforms e.g. ia64
    platforms.
    
    Signed-off-by: Fenghua Yu <fenghua.yu at intel.com>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>

commit f532959b77e5e567c84c914cb7c7b07d2582448b
Author: Fenghua Yu <fenghua.yu at intel.com>
Date:   Tue Aug 4 15:09:37 2009 -0700

    intel-iommu: Correct sglist size calculation.
    
    In domain_sg_mapping(), use aligned_nrpages() instead of hand-coded
    rounding code for calculating the size of each sg elem. This means that
    on IA64 we correctly round up to the MM page size, not just to the VT-d
    page size.
    
    Also remove the incorrect mm_to_dma_pfn() when intel_map_sg() calls
    domain_sg_mapping() -- the 'size' variable is in VT-d pages already.
    
    Signed-off-by: Fenghua Yu <fenghua.yu at intel.com>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>

commit 685aaca751271b2c5191901931a19ccaceeae1ce
Author: Jory A. Pratt <geekypenguin at gmail.com>
Date:   Mon Aug 3 09:32:34 2009 -0700

    Input: i8042 - add Asus G1S to noloop exception list
    
    The synaptic touchpad on the Asus G1S is not properly detected when
    rebooting machine or on cold boot from time to time. Adding the Asus
    G1S to the noloop exception table resolves the issue.
    
    # dmidecode 2.10
    SMBIOS 2.4 present.
    
    Handle 0x0001, DMI type 1, 27 bytes
    System Information
         Manufacturer: ASUSTeK Computer Inc.
         Product Name: G1S
         Version: 1.0
         Wake-up Type: Power Switch
         SKU Number:
         Family:
    
    Signed-off-by: Jory A. Pratt <geekypenguin at gmail.com>
    Signed-off-by: Dmitry Torokhov <dtor at mail.ru>

commit 6502fbfaf81b09b3f474bb7b3796257e9450273e
Author: Alex Deucher <alexdeucher at gmail.com>
Date:   Tue Aug 4 11:24:24 2009 -0400

    drm/radeon: Add support for RS880 chips
    
    These are new AMD IGP chips
    
    Signed-off-by: Alex Deucher <alexdeucher at gmail.com>
    Signed-off-by: Dave Airlie <airlied at redhat.com>

commit 90bc1a658a53f8832ee799685703977a450e5af9
Merge: 6ce90c430baef6e411dcf32e872913888bb3ef54 54822de7793bf9aa56d79cc173281cdb23b37f9f
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 4 15:49:11 2009 -0700

    Merge branch 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus
    
    * 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus: (32 commits)
      MIPS: Wire up accept4 syscall.
      MIPS: VPE: Delete unused function get_tc_unused().
      MIPS: VPE: Fix bogus indentation.
      MIPS: VPE: Make various functions static.
      MIPS: VPE: Free relocation chain on error.
      MIPS: VPE: Fix compiler warning.
      MIPS: Module: Make error messages unique.
      MIPS: Octeon: Run IPI code with interrupts disabled.
      MIPS: Jazz: Fix read buffer overflow
      MIPS: Use DIV_ROUND_CLOSEST
      MIPS: MTX-1: Request button GPIO before setting its direction
      MIPS: AR7: Override CFLAGS with -Werror
      MIPS: AR7: Remove unused tnetd7200_get_clock function
      MIPS: AR7: Use DMA_BIT_MASK(nn) instead of deprecated DMA_nnBIT_MASK
      MIPS: AR7: Fix build failures when CONFIG_SERIAL_8250 is not enabled
      MIPS: Fix read buffer overflow
      MIPS: AR7: Fix build warning on memory.c
      MIPS: Octeon PCIe: Make hardware and software bus numbers match.
      MIPS: RBTX4939: Fix IOC pin-enable register updating
      MIPS: Simplify and correct interrupt handling for MSP4200
      ...

commit 6ce90c430baef6e411dcf32e872913888bb3ef54
Merge: 9f3eea6a2fbf5a07625713dc35e5f8fb91adb12f 4b35d2ca2307d40ccb6b3b6f9cc25ac9178b2a6c
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 4 15:39:55 2009 -0700

    Merge branch 'fix/hda' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6
    
    * 'fix/hda' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
      ALSA: hda - Read buffer overflow
      ALSA: hda: Correct EAPD for Dell Inspiron 1525
      ALSA: hda: warn on spurious response
      ALSA: hda: remember last command for each codec
      ALSA: hda: read CORBWP inside reg_lock
      ALSA: hda: take reg_lock in azx_init_cmd_io/azx_free_cmd_io
      ALSA: hda: take cmd_mutex in probe_codec()
      ALSA: hda: track CIRB/CORB command/response states for each codec
      ALSA: hda - Fix quirk for Toshiba Satellite A135-S4527

commit 9f3eea6a2fbf5a07625713dc35e5f8fb91adb12f
Merge: 2cf812d732442e86c1e2018e23ad82f9bc594a38 cbe9352fa08f90aa03b4dbf1bbabfc95d196e562
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 4 15:39:43 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty-2.6:
      tty-ldisc: be more careful in 'put_ldisc' locking
      tty-ldisc: turn ldisc user count into a proper refcount
      tty-ldisc: make refcount be atomic_t 'users' count

commit 2cf812d732442e86c1e2018e23ad82f9bc594a38
Merge: ae83060026537885fd23737af161fee8afd04f4b 14d9fa352592582e457cf75022202766baac1348
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 4 15:39:16 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block
    
    * 'for-linus' of git://git.kernel.dk/linux-2.6-block:
      Make SCSI SG v4 driver enabled by default and remove EXPERIMENTAL dependency, since udev depends on BSG
      block: Update topology documentation
      block: Stack optimal I/O size
      block: Add a wrapper for setting minimum request size without a queue
      block: Make blk_queue_stack_limits use the new stacking interface

commit ae83060026537885fd23737af161fee8afd04f4b
Merge: 2edb3898b82a20ec459a67fcf76ceddcbecfe395 357eb46d8f275b4e8484541234ea3ba06065e258
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 4 15:38:34 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (47 commits)
      ehea: Fix napi list corruption on ifconfig down
      igbvf: Allow VF driver to correctly recognize failure to set mac
      3c59x: Fix build failure with gcc 3.2
      sky2: Avoid transmits during sky2_down()
      iwlagn: do not send key clear commands when rfkill enabled
      libertas: Read buffer overflow
      drivers/net/wireless: introduce missing kfree
      drivers/net/wireless/iwlwifi: introduce missing kfree
      zd1211rw: fix unaligned access in zd_mac_rx
      cfg80211: fix regression on beacon world roaming feature
      cfg80211: add two missing NULL pointer checks
      ixgbe: Patch to modify 82598 PCIe completion timeout values
      bluetooth: rfcomm_init bug fix
      mlx4_en: Fix double pci unmapping.
      mISDN: Fix handling of receive buffer size in L1oIP
      pcnet32: VLB support fixes
      pcnet32: remove superfluous NULL pointer check in pcnet32_probe1()
      net: restore the original spinlock to protect unicast list
      netxen: fix coherent dma mask setting
      mISDN: Read buffer overflow
      ...

commit 2edb3898b82a20ec459a67fcf76ceddcbecfe395
Merge: c71c090ff9c474d70af4796b5ea9f548a9d3b6b8 ffd4bc2a984fab40ed969163efdff321490e8032
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 4 15:38:10 2009 -0700

    Merge git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6
    
    * git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-rc-fixes-2.6: (23 commits)
      [SCSI] sd: Avoid sending extended inquiry to legacy devices
      [SCSI] libsas: fix wide port hotplug issues
      [SCSI] libfc: fix a circular locking warning during sending RRQ
      [SCSI] qla4xxx: Remove hiwat code so scsi eh does not get escalated when we can make progress
      [SCSI] qla4xxx: Fix srb lookup in qla4xxx_eh_device_reset
      [SCSI] qla4xxx: Fix Driver Fault Recovery Completion
      [SCSI] qla4xxx: add timeout handler
      [SCSI] qla4xxx: Correct Extended Sense Data Errors
      [SCSI] libiscsi: disable bh in and abort handler.
      [SCSI] zfcp: Fix tracing of request id for abort requests
      [SCSI] zfcp: Fix wka port processing
      [SCSI] zfcp: avoid double notify in lowmem scenario
      [SCSI] zfcp: Add port only once to FC transport class
      [SCSI] zfcp: Recover from stalled outbound queue
      [SCSI] zfcp: Fix erp escalation procedure
      [SCSI] zfcp: Fix logic for physical port close
      [SCSI] zfcp: Use -EIO for SBAL allocation failures
      [SCSI] zfcp: Use unchained mode for small ct and els requests
      [SCSI] zfcp: Use correct flags for zfcp_erp_notify
      [SCSI] zfcp: Return -ENOMEM for allocation failures in zfcp_fsf
      ...

commit c71c090ff9c474d70af4796b5ea9f548a9d3b6b8
Merge: 78ec75cd1c81e01909005f392954c797f686d7bc c2718348b41a8e7646516d9af8bb0231c6a44374
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 4 15:35:47 2009 -0700

    Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp
    
    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
      amd64_edac: print debug statements only on error
      amd64_edac: fix ECC checking

commit 78ec75cd1c81e01909005f392954c797f686d7bc
Merge: 1ee5332cf67c2f5f468ad1a59033d57453bcad1a c96e7c7a3a79931446ecf9494a8415e4d164ebd8
Author: Linus Torvalds <torvalds at linux-foundation.org>
Date:   Tue Aug 4 15:34:30 2009 -0700

    Merge branch 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6
    
    * 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6:
      drm/ttm: Read buffer overflow
      drm/radeon: Read buffer overflow
      drm/ttm: Fix a sync object leak.
      drm/radeon/kms: fix memory leak in radeon_driver_load_kms
      drm/radeon/kms: fix nomo