into home.transmeta.com:/home/torvalds/v2.5/linux

to 
	1) check result of calls to request_region and handle failure to allocate region resource
	2) add and use an extra label "Failure1" which frees the region resource
	in case of device driver initialisation error later on
       
I don't have this hardware so changes not tested. 

        1) remove call to check_region 
        2) check the status of call to request_region 
        3) and return an error in case of problem.

and returns -EFAULT in case not all data was copied. Patch also changes the return code
of stl_getserial() from void to int in order to return error code in case of failure.

I don't have this hardware so compilation checked only.

	1) checks the result of copy_XX_user and returns -EFAULT in case not all data was copied. 
	2) Patch changes the return code of stl_getserial() from void to int in order to return error code in case of failure.
	3) Patch also fixes two instances of the uninitialised string name being used on request_region calls

I don't have this hardware so compilation checked only.

	1) check the result of copy_from_user 
	2) return -EFAULT in case not all data was copied
	3) release resources in case of failure

into kroah.com:/home/greg/linux/BK/gregkh-2.5

This patch adds support for the Aiptek 8000U driver to the kernel tree.

	- moved the firmware download to probe() time

- added calc_num_ports() ability to determine the number of actual
  ports the device has on the fly.  This should help out with some
  of the Palm and Sony devices.

	- added calc_num_ports() callback so that driver can override the
	  fixed num_ports value after querying the device.
	- split startup() callback into probe() and attach() in anticipation
	  of the driverfs api changes
	- probe() is called before the usb_serial structure is set up,
	  and can be used to download firmware to a device, and other
	  early initialization.
	- attach() is called after the usb_serial structure is completely
	  setup, allowing the device to create private structures, and
	  have full access to the device.

In both preempt_schedule in sched.c and resume_kernel in entry.S, it is
possible to return with need_resched set and thus a pending preemption
but not service that preemption for some time.

Consider:

	- return from schedule() to preempt_schedule
	- interrupt occurs, sets need_resched
	- we cannot preempt since preempt_count = PREEMPT_ACTIVE
	- back in preempt_schedule, set preempt_count = 0

Now we again can preempt, but we will not.  Instead we return and
continue executing.  On the next interrupt, we will redo the whole
fiasco which is a waste since we could of reentered schedule while we
were there.  Worse, if we acquire a lock before the next interrupt we
can potentially delay the pending reschedule a very long time.  This is
not acceptable.

The solution is to check for and loop on need_resched on resume_kernel
and preempt_schedule like schedule itself does.

Two big ouches in x86 entry.S:

(1) Up until 2.5.20, we were not properly reading the irq_stat
    and bh_count values from the right CPU.  Brian Gerst sent you
    a patch to fix this.  This raises the question: why was this not
    a problem?  Seems we do not need this check at all as having a
    nonzero irq_star or bh_count implies having a nonzero preempt_count,
    which we test for above.  Thus this patch removes those tests and
    the related defines.

(2) What if it is possible to preempt even with interrupts disabled?
    Turns out it is.  Consider if we take an exception (say, for a
    TLB miss) and enter resume_kernel and preempt.  Even if interrupts
    are disabled, an exception can occur and end up in resume_kernel.
    We need to check to make sure interrupts are not off, to ensure
    we are not coming off an unmasked exception.

Even with the added check from issue #2, we have less code after #1 so
we can walk away with a bugfix and an optimization here. ;)

Thanks to George Anzinger, with whom I actually had #2 bite me, and who
helped with these issues.

 - Realize that the only place where ata_do_taskfile gets used is ide-disk.c
   move it and its "friends' over there.

 - Unify the do_request method for disk devices. This saves quite a lot of code.

 - Make task_muin_intr and task_in_intr use the same busy status checks on
   entry.

 - Unfold get_command at the single only place where it's used.

 - Add missing __ata_end_request on kill_rq path.

 - Rename udma_tcq_taskfile() to udma_tcq_init to make the code look like to
   normal udma_init. Revert the logics of udma_init and it's
   implementations to mirror that of udma_tcq_init().

 - Fix a tiny bug in pmac_udma_init() where it was reporting the wrong value up
   on failure.

 - Revert the logics of udma_start(). It's called from udma_init context.
   Realize that it is always returning ide_started. Make it self and the
   implementations of it return void.

 - Implement the assertion that the lock is already held, if we run
   ata_status_poll.

 - The usual host chip code load from Bartomiej onierkiewicz.  Fortunately
   I'm able to check the sis5513 fixes on a life system.

   More serious stuff... for IDE 88:

	- implement ata_best_pio_mode() in ata-timing.c
	  (play safer than driver's config_chipset_for_pio())

	- replace config_chipset_for_pio() by ata_best_pio_mode()
	  in host chips drivers
	  (trivial for hpt34x.c, hpt366.c and serverworks.c,
	   non-trivial for cmd64x.c and sis5513.c)

	- set PIO also for (U)DMA modes in cmd64x_tune_chipset()
	  (cmd64x.c)

	- fix bug in setting PIO0-2 for devices also supporting PIO3/4
	  (sis5513.c)

	- misc cleanups

 - Rename XXX_do_request back do do_request. This was just tmporary tagging.

 - Move ata_taskfile() call down to the ide-disk request handler.c, which is the
   only place needing it. Rename ata_taskfile to ata_do_taskfile().  This
   allowed us to implement the assertion that ata_do_taskfile() will be only
   called with the channel lock already held.

 - fix lock initialization  for device tree handling. Well I would be lucky if
   it would be just a device tree like in Solaris.  But after studying the code
   which goes in right now it appears to develop quite fast in to a "just in
   case" and "ad-hoc" inferface mess we have already in /proc. Shit!

   Look for example at the initialization of a device struct. First we have a
   name to the directory encompassing the device and the immediately we fill in
   the georgeous name field - which is enterly unnecessary.

 - Pull locking out from the device type drivers do_request handlers.  This
   allowed us to remove the draddy unlocking on entry to start_request.

   Much more of host controller rigister acces on crutial code paths is
   now covered by the queue access lock.

during debugging ALSA's usb audio driver, it's found out that there
are devices with insuccessive alternate settings.

for example, m-audio's quattro usb audio has audio streaming
descriptors jumping from altset 0 to 4 or 3.

apparently, usb_set_interface() sends the array index instead of the
actual altset value.  the attached patch fixes this behavior.

ioctl(LPGETSTATUS) is known to put the status into  an  int.  The  usblp
driver has a problem in this area as it does not put it into an int  but
into a char. Let's see :

from drivers/char/lp.c : lp_ioctl :
    int status
    copy_to_user((int *) arg, &status, sizeof(int))

from drivers/usb/printer.c : usblp_ioctl :
    unsigned char status;
    copy_to_user ((unsigned char *)arg, &status, 1)

Even though in  most  cases  it  can  work  unnoticed  on  little-endian
machines ;o), it's broken on non-little-endian machines (I got bitten on
PPC).

this saves memory by making the buffer for firmware temporary.

Here's a followup patch, should apply on top of what I sent
this morning ... please do so!  (Sorry, same name but the
patch is different.)

Along with some cleanups, this actually restores a line that
was dropped somewhere in 2.5 ... basically, at least SiS and
OPTi violate the OHCI spec so they don't init "by the book".

Linus, betcha cannot find a more trivial (but correct) patch...

This showstopper is against 2.5.21 - please apply.

into home.transmeta.com:/home/torvalds/v2.5/linux

Todd R. Eigenschink <todd@tekinteractive.com> reported 2.4 swapoff
kernel BUG at filemap.c:122 to LKML 24 May.  Other problems on that
system may have contributed, but yes, despite __delete_from_swap_cache
doing ClearPageDirty before __remove_inode_page to avoid the BUG(),
a concurrent zap_pte_range might race to set_page_dirty.  So skip
that oops in PageSwapCache case.  Remove the prior ClearPageDirty?
maybe but not without deeper thought: let stay for now.

Recent testing has shown that BUG() check in try_to_unuse is unsafe.
delete_from_swap_cache does final swap_free just after removing page
from swap cache, and add_to_swap_cache does swap_duplicate just before
putting page into swap cache, therefore swapin_readahead may resurrect
a dying swap entry and assign a new page to it.  That's fine, there's
no need to change this ordering; but it does mean that try_to_unuse's
page may have left the swap cache yet its swap_map count still be set.
That BUG() has done good service for swapoff sanity, but now abandon it.

Burton Windle <bwindle@fint.org> reported Kernel memory leak with
swapon/swapoff? LKML 31 May.  swapon uses rw_swap_page_nolock to read
swap_header page (peculiar! should probably rework that sometime),
nothing freed the buffers from the page, thus page also never freed.

Remove /* SMP-safe */ comments before shmem_truncate and shmem_mknod:
don't know who or why put there, but they seem to imply that the rest
of shmem.c is unsafe.

Several simple speedups to tmpfs swapoff: without patch, swapoff of a
kernel tree in tmpfs might take take 2 minutes, with patch 4 seconds.
Inline search go no further than necessary; only search inode when it
has swapped pages; start next search from same inode; list in order.

(There's a "list_move_tail" in this patch: not available in 2.5.21,
but I believe you now have it in your ongoing tree.)

shmem_mknod should not update directory times if it cannot get an inode.

shmem_symlink was letting a long symlink overwrite its vfs_inode, now
included within struct shmem_inode_info - oops! and failed long symlink
inodes were freed but still left on the shmem_inodes list, causing oops
in swapoff at shutdown (if not earlier).

shmem_rename was not maintaining the correct link count on the
parent directories when a directory was moved from one to another.
This patch from Christoph Rohland <cr@sap.com>, already in 2.5-dj.

 - Bunch of cleanups by Bartlomiej (accounts for over a half of the patch):

    cmd64x.c:
	- kill SPLIT_BYTE() macro
	- kill wrappers for cmd64x_config_drive_for_dma()
	- misc cleanups

    cy82c693.c:
	- kill obsolete comments
	- clean cy82c693_tune_drive() and calc_clk()
	- misc cleanups

    hpt34x.c:
	- kill obsolete comment
	- kill SPLIT_BYTE()
	- kill hpt34x_clear_chipset()
	- simplify hpt34x_tune_drive()

    hpt366.c:
	- kill hpt_min_rev()
	- kill redundant hpt368_tune_chipset() and hpt374_tune_chipset()
	- fix badlists checking in config_chipset_for_dma()
	- misc cleanups

    pdc202xx.c:
	- clean registers decoding
	- clean pdc202xx_tune_chipset()
	- kill pdc202xx_udma_irq_status(), use generic udma_pci_irq_status()
	- rationalize pdc202xx_reset()
	- kill UDMA_SPEED_FLAG() and PDC_CLOCK() macros,
	  do it right by defining constants PDC_UDMA and PDC_CLK
	- kill init_high_16() inline, no need to hide internals
	- clean pdc202xx_init_chipset()
	- split ata66_pdc202xx() and pdc202xx_init_chipset()
	- clean config_chipset_for_dma()
	- misc cleanups

 - Fix plug in of CF cards. The previously used sub device driver attach method
   lookup was entirely hosed.

 - Enforce indentation style on ide-cs.c. Enable debugging there. (Makes the
   patch quite big...)

This makes the IO bitmap allocations a separately allocated structure,
shrinking the default task size.

We alloc it in sys_ioperm() and copy_thread() and frees in
exit_thread().  It also gets rid of the IO_BITMAP_SIZE+1 crap, as only
the tss actually needs the tail long, and we weren't copying it into the
bitmap anyways.

The utime and utimes should do exactly the smae permission check
according to SUSv3.
	"The effective user ID of the process shall match the owner of the file,
or has write access to the file or appropriate privileges to use this call
in this manner."

utimes when passed a NULL second argument would fail on a read only
file even if the file is owned by the caller.

into home.transmeta.com:/home/torvalds/v2.5/linux

The following comes from James Bottemley, as he updated the SCSI layer
to use the generic tagging.

Basically just put blk_queue_tag_request() into ll_rw_blk.c and name it
something more sane, blk_queue_find_tag(). In addition, remove REQ_CMD
requirement in blk_queue_start_tag() -- this is actually IDE specific
(we can only tag read/write requests there...), SCSI actually requires
everything to be tagged once enabled. It's replaced with a safety check
for an already tagged request.