From: Olof Johansson <olof@austin.ibm.com>

RTAS on IBM pSeries runs in real mode, so all pointers being passed in to
it need to be in low memory.  There's two places in the RAS code that
passes in pointers to items on the stack, which might end up being above
the limit.

Below patch resolves this by creating a buffer in BSS + a lock for
serialization.  There's no reason to worry about contention on the lock,
since rtas_call() also serializes on a single spinlock and this is an
infrequent code path in the first place.

From: David Gibson <david@gibson.dropbear.id.au>

On PPC64, to deal with the restrictions imposed by the PPC MMU's segment
design, hugepages are only allowed to be mapping in two fixed address
ranges, one 2-3G (for use by 32-bit processes) and one 1-1.5T (for use in
64-bit processes).  This is quite limiting, particularly for 32-bit
processes which want to use a lot of large page memory.

This patch relaxes this restriction, and allows any of the low 16 segments
(i.e.  those below 4G) to be individually switched over to allow hugepage
mappings (provided the segment does not already have any normal page
mappings).  The 1-1.5T fixed range for 64-bit processes remains.

From: Stephen Rothwell <sfr@canb.auug.org.au>

This is the iSeries virtual ethernet driver.  David Gibson has taken you
previous comments and hopefully sitisfied most of them.  The driver has
also undergone some more testing which showed up some bugs which have been
addressed.

Unfortunately, Anton is about to submit some other patches of mine which
will sightly comflict with this.  I will send a patch shortly that will
(hopefully) fix that.

From: Paul Mackerras <paulus@samba.org>

This patch from Julie DeWandel exports the symbol itLpNaca on iSeries
machines, for the use of the viodasd driver.

From: Paul Mackerras <paulus@samba.org>

This patch from Julie DeWandel makes CONFIG_VT default to N on iSeries
machines which are using the iSeries virtual console driver viocons.c.  The
VT console and the viocons code can't coexist because they use the same tty
numbers, that is, viocons supplies /dev/tty1.  Without this patch the user
has to figure out somehow that s/he has to turn on CONFIG_EMBEDDED in order
to be able to turn off CONFIG_VT, which is really very non-obvious.

From: Benjamin Herrenschmidt <benh@kernel.crashing.org>

A recent patch that cleaned up some absolute/virt translation macros forgot
one occurence, thus breaking g5 build with iommu support.

From: Olof Johansson <olof@austin.ibm.com>

A bug snuck in during the rewrite of ppc64 IOMMU code.  When a
{pci,vio}_alloc_consistent() call fails, DMA_ERROR_CODE is returned instead
of NULL.

From: David Gibson <david@gibson.dropbear.id.au>

Found this again while looking at hugepage extensions.  Haven't actually had
it bite yet - the race is small and the other bug will never be triggered in
32-bit processes, and the function is rarely called on 64-bit processes.

This patch fixes two bugs in the (same part of the) PPC64 hugepage code.
First the method we were using to free stale PTE pages was not safe with some
recent changes (race condition).  BenH has fixed this to work in the new way.
 Second, we were not checking for a valid PGD entry before dereferencing the
PMD page when scanning for stale PTE page pointers.

From: David Gibson <david@gibson.dropbear.id.au>

The PPC64 version of is_aligned_hugepage_range() is buggy.  It is supposed to
test not only that the given range is hugepage aligned, but that it lies
within the address space allowed for hugepages.  We were checking only that
the given range intersected the hugepage range, not that it lay entirely
within it.  This patch fixes the problem and changes the name of some macros
to make it less likely to make that misunderstanding again.

From: Benjamin Herrenschmidt <benh@kernel.crashing.org>

This patch fixes si_addr on some segfaults in 64 bits mode, it used to be
bogus (address not passed to do_page_fault by the asm code after a failure
to set an SLB entry).

From: Benjamin Herrenschmidt <benh@kernel.crashing.org>

Without this patch, executing an altivec instruction on an altivec capable
CPU with a kernel that do not have CONFIG_ALTIVEC set would result in a
kernel crash.

(Fix forward ported from 2.4 by John Whitney
<jwhitney-linuxppc@sands-edge.com>)

From: William Lee Irwin III <wli@holomorphy.com>

Now the scheduler text is in its own ELF section this branch is asking for
an illegal displacement.

From: William Lee Irwin III <wli@holomorphy.com>

This addresses the issue with get_wchan() that the various functions acting
as scheduling-related primitives are not, in fact, contiguous in the text
segment.  It creates an ELF section for scheduling primitives to be placed
in, and places currently-detected (i.e.  skipped during stack decoding)
scheduling primitives and others like io_schedule() and down(), which are
currently missed by get_wchan() code, into this section also.

The net effects are more reliability of get_wchan()'s results and the new
ability, made use of by this code, to arbitrarily place scheduling
primitives in the source code without disturbing get_wchan()'s accuracy.

Suggestions by Arnd Bergmann and Matthew Wilcox regarding reducing the
invasiveness of the patch were incorporated during prior rounds of review. 
I've at least tried to sweep all arches in this patch.

From: Armin Schindler <armin@melware.de>

With this patch the ISDN kernel CAPI code uses a per application workqueue
with proper locking to prevent message re-ordering due to the fact a
workqueue may run on another CPU at the same time.  Also some locks for
internal data is added.

Removed global recv_queue work, use per application workqueue.  Added
proper locking mechanisms for application, controller and application
workqueue function.  Increased max.  number of possible applications and
controllers.

The race is that con_close() can sleep, and drops the BKL while
tty->count==1.  But another thread can come into init_dev() and will take a
new ref against the tty and start using it.

But con_close() doesn't notice that new ref and proceeds to null out
tty->driver_data while someone else is using the resurrected tty.

So the patch serialises con_close() against init_dev() with tty_sem.


Here's a test app which reproduced the oops instantly on 2-way.  It realy
needs to be run against all tty-capable devices.

/*
 * Run this against a tty which nobody currently has open, such as /dev/tty9
 */

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <linux/kd.h>

void doit(char *filename)
{
	int fd,x;

	fd = open(filename, O_RDWR);
	if (fd < 0) {
		perror("open");
		exit(1);
	}
	ioctl(fd, KDKBDREP, &x);
	close(fd);
}

main(int argc, char *argv[])
{
	char *filename = argv[1];

	for ( ; ; )
		doit(filename);
}

Remove the down_tty_sem() and up_tty_sem() and replace them with open-coded
up() and down().  This is an equivalent transformation.

I assume these functions were created to open the possibility of per-tty
semaphores at some time in the future.  But the code which is protected by
this lock deals with two tty's at the same time, and the next patch will need
to release the lock after the tty has been destroyed.

con_open() is called on every open of the tty, even if the tty is already all
set up.  We only need to do that initialisation if the tty is being set up
for the very first time (tty->count == 1).

So do that: check for tty_count == 1 inside console_sem() and if so, bypass
all the unnecessary initialisation.



Note that this patch reintroduces the con_close()-vs-init_dev() race+oops. 
This is because that oops is accidentally prevented because when it happens,
con_open() reinstalls tty->driver_data even when tty->count > 1.

But that's bogus, and when the race happens we end up running
vcs_make_devfs() and vcs_remove_devfs() against the same console at the same
time, producing indeterminate results.

So the race needs to be fixed again, for real.

- Remove unneeded casts of a void *

- whitespace consistency.

From: Olof Johansson <olof@austin.ibm.com>

It's currently a boolean, but that means that system_running goes to zero
again when shutting down.  So we then use code (in the page allocator) which
is only designed to be used during bootup - it is marked __init.

So we need to be able to distinguish early boot state from late shutdown
state.  Rename system_running to system_state and give it the three
appropriate states.

Nobody seems to have any outstanding work against devfs, so...

From: Rusty Russell <rusty@rustcorp.com.au>

From: "Petri T. Koistinen" <petri.koistinen@iki.fi>

1) Various URLs in the Kconfig files are out of date: update them.

2) URLs should be of form <http://url-goes-here>.

3) References to files in the source should be of form
   <file:path-from-top>

4) Email addresses should be of form <foo@bar.com>

From: Andi Kleen <ak@muc.de>

Current x86-64 patchkit for 2.6.5.

- Add drivers/firmware/Kconfig

- Clarify description of CONFIG_IOMMU_DEBUG

- Use correct gcc option to optimize for Intel CPUs

- Add EDD support (Matt Domsch)

- Add workaround for broken IOMMU on VIA hardware.  Uses swiotlb there now.

- Handle more than 8 local APICs (Suresh B Siddha) 

- Delete obsolete mtrr Makefile

- Add x86_cache_alignment and set it up properly for P4 (128 bytes instead
  of 64bytes).  Also report in /proc/cpuinfo

- Minor cleanup in in_gate_area

- Make asm-generic/dma-mapping.h compile with !CONFIG_PCI Just stub out all
  functions in this case.  This is mainly to work around sysfs.

- More !CONFIG_PCI compile fixes

- Make u64 sector_t unconditional

Herbert Xu noted:
  "The current stxncpy on alpha is still broken when it comes to single
   word, unaligned, src misalignment > dest misalignment copies.

   I've attached a program which demonstrates this problem."

Ugh, indeed. It fails when there is a zero byte before the data.
Thanks.

Here is the fix for this (both regular and ev6 version).

We default to "long" (which is what POSIX says), but since
a number of architectures have used "int" for historical
reasons, we need to allow overrides.

At least sparc64 needs this. Possibly others, but so far
architecture maintainers haven't spoken up. ppc64 and x86-64
are known to be ok with the default "long".

From Ivan Kokshaysky <ink@jurassic.park.msu.ru>.

into heffalump.twiddle.home:/home/rth/work/linux/axp-2.6

From: Matt Porter <mporter@kernel.crashing.org>

Patch fixes a latent bug in the PPC44x tlb management code.

From: Matt Porter <mporter@kernel.crashing.org>

Make a couple 4xx defconfigs functional again.

From: Matt Porter <mporter@kernel.crashing.org>

IDs new PPC44x silicon.

From: Matt Porter <mporter@kernel.crashing.org>

Patch fixes the build for PPC40x platforms.

From: Tom Rini <trini@kernel.crashing.org>

When I was updating ppc/boot/simple/relocate.S to work on PPC_PREP systems, I
in advertantly broke 4xx systems.  On classic PPC, the first three
instructions are nops, of which the first two can be overwritten.  This is
not true of 4xx (or 8xx, but that's not working right now anyhow).  The
following is needed to fix this.

The commoncap module calls this.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

- Use -march=armv6 where available.
- CFLAGS_BOOT isn't needed - the decompressor uses CFLAGS, remove it.
- PROCESSOR is never used, remove it.
- LDFLAGS_BLOB is never used, remove it.
- Remove MACHINE macro.
- Correct comments for include/asm-arm/.arch target.
- Copy format of include/asm symlink rule.
- Arrange for configuration to be split before making
  include/asm-arm/arch symlink.
- This means that asm-offsets.s no longer depends on
  include/config/MARKER.