nr_processes() returns the sum of the per cpu counter process_counts for
all online CPUs. This counter is incremented for the current CPU on
fork() and decremented for the current CPU on exit(). Since a process
does not necessarily fork and exit on the same CPU the process_count for
an individual CPU can be either positive or negative and effectively has
no meaning in isolation.

Therefore calculating the sum of process_counts over only the online
CPUs omits the processes which were started or stopped on any CPU which
has since been unplugged. Only the sum of process_counts across all
possible CPUs has meaning.

The only caller of nr_processes() is proc_root_getattr() which
calculates the number of links to /proc as
        stat->nlink = proc_root.nlink + nr_processes();

You don't have to be all that unlucky for the nr_processes() to return a
negative value leading to a negative number of links (or rather, an
apparently enormous number of links). If this happens then you can get
failures where things like "ls /proc" start to fail because they got an
-EOVERFLOW from some stat() call.

Example with some debugging inserted to show what goes on:
        # ps haux|wc -l
        nr_processes: CPU0:     90
        nr_processes: CPU1:     1030
        nr_processes: CPU2:     -900
        nr_processes: CPU3:     -136
        nr_processes: TOTAL:    84
        proc_root_getattr. nlink 12 + nr_processes() 84 = 96
        84
        # echo 0 >/sys/devices/system/cpu/cpu1/online
        # ps haux|wc -l
        nr_processes: CPU0:     85
        nr_processes: CPU2:     -901
        nr_processes: CPU3:     -137
        nr_processes: TOTAL:    -953
        proc_root_getattr. nlink 12 + nr_processes() -953 = -941
        75
        # stat /proc/
        nr_processes: CPU0:     84
        nr_processes: CPU2:     -901
        nr_processes: CPU3:     -137
        nr_processes: TOTAL:    -954
        proc_root_getattr. nlink 12 + nr_processes() -954 = -942
          File: `/proc/'
          Size: 0               Blocks: 0          IO Block: 1024   directory
        Device: 3h/3d   Inode: 1           Links: 4294966354
        Access: (0555/dr-xr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
        Access: 2009-11-03 09:06:55.000000000 +0000
        Modify: 2009-11-03 09:06:55.000000000 +0000
        Change: 2009-11-03 09:06:55.000000000 +0000

I'm not 100% convinced that the per_cpu regions remain valid for offline
CPUs, although my testing suggests that they do. If not then I think the
correct solution would be to aggregate the process_count for a given CPU
into a global base value in cpu_down().

This bug appears to pre-date the transition to git and it looks like it
may even have been present in linux-2.6.0-test7-bk3 since it looks like
the code Rusty patched in http://lwn.net/Articles/64773/ was already
wrong.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Rusty Russell <rusty@rustcorp.com.au>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: gpio-keys - use IRQF_SHARED
  Input: winbond-cir - select LEDS_TRIGGERS
  Input: i8042 - try to get stable CTR value when initializing
  Input: atkbd - add a quirk for OQO 01+ multimedia keys

* 'fixes-s3c-2632-rc5' of git://git.fluff.org/bjdooks/linux:
  ARM: S3C2410: Fix sparse warnings in arch/arm/mach-s3c2410/gpio.c
  ARM: S3C2440: mini2440: Fix spare warnings
  ARM: S3C24XX: Fix warnings in arch/arm/plat-s3c24xx/gpio.c
  ARM: S3C2440: mini2440: Fix missing CONFIG_S3C_DEV_USB_HOST
  ARM: S3C24XX: arch/arm/plat-s3c24xx: Move dereference after NULL test
  ARM: S3C: Fix adc function exports
  ARM: S3C2410: Fix link if CONFIG_S3C2410_IOTIMING is not set
  ARM: S3C24XX: Introduce S3C2442B CPU
  ARM: S3C24XX: Define a macro to avoid compilation error
  ARM: S3C: Add info for supporting circular DMA buffers
  ARM: S3C64XX: Set rate of crystal mux
  ARM: S3C64XX: Fix S3C64XX_CLKDIV0_ARM_MASK value

* 'i2c-fixes' of git://git.fluff.org/bjdooks/linux:
  i2c-mpc: Do not generate STOP after read.
  i2c: imx: disable clock when it's possible to save power.
  i2c: imx: only imx1 needs disable delay
  i2c: imx: check busy bit when START/STOP

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ryusuke/nilfs2:
  nilfs2: add zero-fill for new btree node buffers
  nilfs2: fix irregular checkpoint creation due to data flush
  nilfs2: fix dirty page accounting leak causing hang at write

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (21 commits)
  mac80211: check interface is down before type change
  cfg80211: fix NULL ptr deref
  libertas if_usb: Fix crash on 64-bit machines
  mac80211: fix reason code output endianness
  mac80211: fix addba timer
  ath9k: fix misplaced semicolon on rate control
  b43: Fix DMA TX bounce buffer copying
  mac80211: fix BSS leak
  rt73usb.c : more ids
  ipw2200: fix oops on missing firmware
  gre: Fix dev_addr clobbering for gretap
  sky2: set carrier off in probe
  net: fix sk_forward_alloc corruption
  pcnet_cs: add cis of PreMax PE-200 ethernet pcmcia card
  r8169: Fix card drop incoming VLAN tagged MTU byte large jumbo frames
  ibmtr: possible Read buffer overflow?
  net: Fix RPF to work with policy routing
  net: fix kmemcheck annotations
  e1000e: rework disable K1 at 1000Mbps for 82577/82578
  e1000e: config PHY via software after resets
  ...

There is nothing that disallows gpio-keys to share it's IRQ line
w/ other drivers. Make it use IRQF_SHARED in request_irq().

An example of other driver with which I'd like to share IRQ line
for GPIO buttons is ledtrig-gpio.
Signed-off-by: Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

drivers/input/misc/winbond-cir.c depends on LEDS_TRIGGERS so
add an appropriate select to drivers/input/misc/Kconfig
Signed-off-by: David Härdeman <david@hardeman.nu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

If user presses keys while i8042 is being initialized there is a chance
that keyboard data will be mistaken for results of Read Control Register
command causing futher troubles. Work around this issue by reading CTR
several times and stop when we get matching results.
Reported-and-tested-by: Dave Young <hidave.darkstar@gmail.com>
Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

Adds missing initialization of newly allocated b-tree node buffers.
This avoids garbage data to be mixed in b-tree node blocks.
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>

When nilfs flushes out dirty data to reduce memory pressure, creation
of checkpoints is wrongly postponed.  This bug causes irregular
checkpoint creation especially in small footprint systems.

To correct this issue, a timer for the checkpoint creation has to be
continued if a log writer does not create a checkpoint.

This will do the correction.
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>

Bruno Prémont and Dunphy, Bill noticed me that NILFS will certainly
hang on ARM-based targets.

I found this was caused by an underflow of dirty pages counter.  A
b-tree cache routine was marking page dirty without adjusting page
account information.

This fixes the dirty page accounting leak and resolves the hang on
arm-based targets.
Reported-by: Bruno Prémont <bonbons@linux-vserver.org>
Reported-by: Dunphy, Bill <WDunphy@tandbergdata.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Tested-by: Bruno Prémont <bonbons@linux-vserver.org>
Cc: stable <stable@kernel.org>

The driver always ends a read with a STOP condition which
breaks subsequent I2C reads/writes in the same transaction as
these expect to do a repeated START(ReSTART).

This will also help I2C multimaster as the bus will not be released
after the first read, but when the whole transaction ends.
Signed-off-by: Joakim Tjernlund <Joakim.Tjernlund@transmode.se>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>

Enable clock before START, disable it after STOP.
Signed-off-by: Richard Zhao <linuxzsc@gmail.com>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>

check cpu_is_mx1() when disable delay.
Signed-off-by: Richard Zhao <linuxzsc@gmail.com>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>

The controller can't do anything else before it actually generates START/STOP.
So we check busy bit to make sure START/STOP is successfully finished.

If we don't check busy bit, START/STOP may fail on some fast CPUs.
Signed-off-by: Richard Zhao <linuxzsc@gmail.com>
Signed-off-by: Ben Dooks <ben-linux@fluff.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ericvh/v9fs:
  9p: fix readdir corner cases
  9p: fix readlink
  9p: fix a small bug in readdir for long directories

For some strange reason the netif_running() check
ended up after the actual type change instead of
before, potentially causing all kinds of problems
if the interface is up while changing the type;
one of the problems manifests itself as a warning:

WARNING: at net/mac80211/iface.c:651 ieee80211_teardown_sdata+0xda/0x1a0 [mac80211]()
Hardware name: Aspire one
Pid: 2596, comm: wpa_supplicant Tainted: G        W  2.6.31-10-generic #32-Ubuntu
Call Trace:
 [] warn_slowpath_common+0x6d/0xa0
 [] warn_slowpath_null+0x15/0x20
 [] ieee80211_teardown_sdata+0xda/0x1a0 [mac80211]
 [] ieee80211_if_change_type+0x4a/0xc0 [mac80211]
 [] ieee80211_change_iface+0x61/0xa0 [mac80211]
 [] cfg80211_wext_siwmode+0xc7/0x120 [cfg80211]
 [] ioctl_standard_call+0x58/0xf0

(http://www.kerneloops.org/searchweek.php?search=ieee80211_teardown_sdata)

Cc: Arjan van de Ven <arjan@infradead.org>
Cc: stable@kernel.org
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 211a4d12abf86fe0df4cd68fc6327cbb58f56f81
  Author: Johannes Berg <johannes@sipsolutions.net>
  Date:   Tue Oct 20 15:08:53 2009 +0900

      cfg80211: sme: deauthenticate on assoc failure

introduced a potential NULL pointer dereference that
some people have been hitting for some reason -- the
params.bssid pointer is not guaranteed to be non-NULL
for what seems to be a race between various ways of
reaching the same thing.

While I'm trying to analyse the problem more let's
first fix the crash. I think the real fix may be to
avoid doing _anything_ if it ended up being NULL, but
right now I'm not sure yet.

I think
http://bugzilla.kernel.org/show_bug.cgi?id=14342
might also be this issue.
Reported-by: Parag Warudkar <parag.lkml@gmail.com>
Tested-by: Parag Warudkar <parag.lkml@gmail.com>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  Revert "[IA64] fix percpu warnings"
  [IA64] fix percpu warnings
  [IA64] SMT friendly version of spin_unlock_wait()
  [IA64] use printk_once() unaligned.c/io_common.c
  [IA64] Require SAL 3.2 in order to do extended config space ops
  [IA64] unsigned cannot be less than 0 in sn_hwperf_ioctl()
  [IA64] Restore registers in the stack on INIT
  [IA64] Re-implement spinaphores using ticket lock concepts
  [IA64] Squeeze ticket locks back into 4 bytes.

This reverts commit d0646f7b, as
requested by Eric Sandeen.

It can basically cause an ext4 filesystem to miss recovery (and thus get
mounted with errors) if the journal checksum does not match.

Quoth Eric:

   "My hand-wavy hunch about what is happening is that we're finding a
    bad checksum on the last partially-written transaction, which is
    not surprising, but if we have a wrapped log and we're doing the
    initial scan for head/tail, and we abort scanning on that bad
    checksum, then we are essentially running an unrecovered filesystem.

    But that's hand-wavy and I need to go look at the code.

    We lived without journal checksums on by default until now, and at
    this point they're doing more harm than good, so we should revert
    the default-changing commit until we can fix it and do some good
    power-fail testing with the fixes in place."

See

	http://bugzilla.kernel.org/show_bug.cgi?id=14354

for all the gory details.
Requested-by: Eric Sandeen <sandeen@redhat.com>
Cc: Theodore Tso <tytso@mit.edu>
Cc: Alexey Fisher <bug-track@fisher-privat.net>
Cc: Maxim Levitsky <maximlevitsky@gmail.com>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: Mathias Burén <mathias.buren@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of master.kernel.org:/home/rmk/linux-2.6-arm:
  ARM: ensure initial page tables are setup for SMP systems
  ARM: 5776/1: Check compiler version and EABI support when adding ARM unwind support.
  ARM: 5774/1: Fix Realview ARM1176PB board reboot
  ARM: Fix errata 411920 workarounds
  ARM: Fix sparsemem with SPARSEMEM_EXTREME enabled
  ARM: Use GFP_DMA only for masks _less_ than 32-bit
  ARM: integrator: allow Integrator to be built with highmem
  ARM: Fix signal restart issues with NX and OABI compat

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: hda - Don't check invalid HP pin
  ALSA: dummy - Fix descriptions of pcm_substreams parameter
  ALSA: pcmcia: use dynamic debug infrastructure, deprecate CS_CHECK (sound)
  ALSA: hda: Use quirk mask for Dell Inspiron Mini9/Vostro A90 using ALC268
  sound: via82xx: deactivate DXS controls of inactive streams
  ALSA: snd-usb-caiaq: Bump version number to 1.3.20
  ALSA: snd-usb-caiaq: Lock on stream start/unpause
  ALSA: snd-usb-caiaq: Missing lock around use of buffer positions
  ALSA: sound/parisc: Move dereference after NULL test
  ALSA: sound: Move dereference after NULL test and drop unnecessary NULL tests
  ALSA: hda_intel: Add the Linux device ID for NVIDIA HDA controller
  ALSA: pcsp - Fix nforce workaround
  ALSA: SND_CS5535AUDIO: Remove the X86 platform dependency
  ASoC: Amstrad Delta: add info about the line discipline requirement to Kconfig help text
  ASoC: Fix possible codec_dai->ops NULL pointer problems
  ALSA: hda - Fix capture source checks for ALC662/663 codecs
  ASoC: Serialize access to dapm_power_widgets()

Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  futex: Fix spurious wakeup for requeue_pi really

Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  perf tools: Remove -Wcast-align
  perf tools: Fix compatibility with libelf 0.8 and autodetect
  perf events: Don't generate events for the idle task when exclude_idle is set
  perf events: Fix swevent hrtimer sampling by keeping track of remaining time when enabling/disabling swevent hrtimers

Merge branch 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'tracing-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  tracing: Remove cpu arg from the rb_time_stamp() function
  tracing: Fix comment typo and documentation example
  tracing: Fix trace_seq_printf() return value
  tracing: Update *ppos instead of filp->f_pos

Merge branch 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'x86-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86: Make EFI RTC function depend on 32bit again
  x86-64: Fix register leak in 32-bit syscall audting
  x86: crash_dump: Fix non-pae kdump kernel memory accesses
  x86: Side-step lguest problem by only building cmpxchg8b_emu for pre-Pentium
  x86: Remove STACKPROTECTOR_ALL

In try_to_unuse(), swcount is a local copy of *swap_map, including the
SWAP_HAS_CACHE bit; but a wrong comparison against swap_count(*swap_map),
which masks off the SWAP_HAS_CACHE bit, succeeded where it should fail.

That had the effect of resetting the mm from which to start searching
for the next swap page, to an irrelevant mm instead of to an mm in which
this swap page had been found: which may increase search time by ~20%.
But we're used to swapoff being slow, so never noticed the slowdown.

Remove that one spurious use of swap_count(): Bo Liu thought it merely
redundant, Hugh rewrote the description since it was measurably wrong.
Signed-off-by: Bo Liu <bo-liu@hotmail.com>
Signed-off-by: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Reviewed-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

In commit c1c7af60 ("drm/i915: force
mode set at lid open time") the intel graphics driver was taught to
restore the LVDS mode on lid open.

That caused problems with interaction with the suspend/resume code,
which commonly runs at the same time (suspend is often caused by the lid
close event, while lid open is commonly a resume event), which was
worked around with in commit 06891e27
("drm/i915: fix suspend/resume breakage in lid notifier").

However, in the meantime the lid event code had also grown a user event
notifier (commit 06324194: "drm/i915:
generate a KMS uevent at lid open/close time"), and now _that_ causes
problems with suspend/resume and some versions of Xorg reacting to those
uevents by setting the mode.

So this effectively reverts that commit 06324194, and makes the lid
open protection logic against suspend/resume more explicit.  This fixes
at least one laptop. See

	http://bugzilla.kernel.org/show_bug.cgi?id=14484

for more details.
Acked-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: Riccardo Magliocchetti <riccardo.magliocchetti@gmail.com>
Cc: Eric Anholt <eric@anholt.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This reverts commit b94b0808.

genksyms currently cannot handle complicated types for exported
percpu variables.  Drop this patch for now as it prevents a
module from being loaded on sn2 systems:

 xpc: no symbol version for per_cpu____sn_cnodeid_to_nasid
 xpc: Unknown symbol per_cpu____sn_cnodeid_to_nasid
Signed-off-by: Tony Luck <tony.luck@intel.com>

Mapping the same memory using two different attributes (memory
type, shareability, cacheability) is unpredictable.  During boot,
we encounter a situation when we're updating the kernel's page
tables which can lead to dirty cache lines existing in the cache
which are subsequently missed.  This causes stack corruption,
and therefore a crash.

Therefore, ensure that the shared and cacheability settings
matches the configuration that will be used later; this together
with the restriction in early_cachepolicy() ensures that we won't
create a mismatch during boot.
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

ARM unwind is known to compile only with EABI and not-buggy compilers.
The problem is not the unwinding information but the -fno-frame-pointer
option added as a result of !CONFIG_FRAME_POINTER.  Now we check the
compiler and raise a #warning in case of wrong compiler.
Signed-off-by: Claudio Scordino <claudio@evidence.eu.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

The patch below also addresses a couple of other corner cases in readdir
seen with a large (e.g. 64k) msize.  I'm not sure what people think of
my co-opting of fid->aux here.  I'd be happy to rework if there's a better
way.

When the size of the user supplied buffer passed to readdir is smaller
than the data returned in one go by the 9P read request, v9fs_dir_readdir()
currently discards extra data so that, on the next call, a 9P read
request will be issued with offset < previous offset + bytes returned,
which voilates the constraint described in paragraph 3 of read(5) description.
This patch preseves the leftover data in fid->aux for use in the next call.
Signed-off-by: Jim Garlick <garlick@llnl.gov>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>

I do not know if you've looked on the patch, but unfortunately it is
incorrect. A suggested better version is in this email (the old
version didn't work in case the user provided buffer was not long
enough - it incorrectly appended null byte on a position of last char,
and thus broke the contract of the readlink method). However, I'm
still not sure this is 100% correct thing to do, I think readlink is
supposed to return buffer without last null byte in all cases, but we
do return last null byte (even the old version).. on the other hand it
is likely unspecified what is in the remaining part of the buffer, so
null character may be fine there ;):
Signed-off-by: Martin Stava <martin.stava@gmail.com>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>

Here is a proposed patch for bug in readdir. Listing of dirs with
many files fails without this patch.
Signed-off-by: Martin Stava <martin.stava@gmail.com>
Signed-off-by: Eric Van Hensbergen <ericvh@gmail.com>

alc_automute_pin() might be called even if any HP pin is defined, and
it will result in verbs with NID=0.

This patch adds a check for the validity of HP widget before issuing
any verbs.
Signed-off-by: Takashi Iwai <tiwai@suse.de>