From: Dave Olien <dmo@osdl.org>

The dynamic queue allocation appears to have exposed a long-standing bug.

From: Todor Todorov <ttodorov@web.de>

A missig line fs/nls/Makefile prevents codepage 1250 from compiling and
installing whatever the .config value.

From: Yoshinori Sato <ysato@users.sourceforge.jp>

It writes one too many zeroes when nulling out the destination.

From: Matthew Dobson <colpatch@us.ibm.com>

16 proc x440 boxen aren't booting mainline kernels right now for many valid
configs.  This patch makes sure NUMA codepaths aren't executed for SMP
configs.  It also adds some sane error messages to the code, and cleans up
some #ifdefs.

From: Josh Boyer <jwboyer@charter.net>

jffs was missed in the statfs64 conversions.

From: Manuel Estrada Sainz <ranty@debian.org>

Add Manuel to MAINTAINERS for request_firmware().

From: Manuel Estrada Sainz <ranty@debian.org>

Add some higher level docs to Documentation/firmware_class/README.

From: Zwane Mwaikambo <zwane@linuxpower.ca>

The code appears to be able to add too many blocks back to
sbinfo->free_blocks in the failure path. We first do;

len = vma->vm_end - vma->vm_start;
sbinfo->free_blocks -= len;

but then later do;
len = (vma->vm_end - vma->vma_start) + (vma->vm_pgoff << HPAGE_SHIFT)

error:
sbinfo->free_blocks += len;

From: Zwane Mwaikambo <zwane@linuxpower.ca>

drivers/char/ipmi/ipmi_kcs_intf.c: In function `acpi_find_bmc':
drivers/char/ipmi/ipmi_kcs_intf.c:1088: warning: long unsigned int format, different type arg (arg 2)
drivers/char/ipmi/ipmi_kcs_intf.c:1088: warning: long unsigned int format, different type arg (arg 2)

From: Albert Cahalan <albert@users.sourceforge.net>

1. allows likely() and unlikely() to work for pointers

2. fixes likely() (in C, any non-zero value is true)

drivers/char/keyboard.c: In function `k_fn':
drivers/char/keyboard.c:665: warning: comparison is always true due
to limited range of data type

I didn't want to just delete the code because one day the size of func_table
may get smaller, or the type of `value' may get larger.  When that happens,
the test becomes valid again.

From: Peter Chubb <peterc@gelato.unsw.edu.au>

If you need a long long format, then cast to long long, not u64.  u64 is
long on 64-bit architectures.

From: Peter Chubb <peterc@gelato.unsw.edu.au>

Attached patch kills a warning when compiling on a 64-bit architecture
(ssize_t is long, not int)

From: Manuel Estrada Sainz <ranty@debian.org>

- undo recent change, made in the believe that "buffer" was the size of
  the whole file, it is just PAGE_SIZE in size.  This was causing kernel
  memory corruption.

  - Since files are allowed to have unknown sizes, by setting their
    size to 0, we can't preallocate a buffer of their size on open.

- Adapt request_firmware() to the sysfs change.

- Adapt drivers/pci/pci-sysfs.c to the sysfs change.

loop-on-file oopses during unmount.  This is because lo_queue is now freed
during lo_ioctl(LOOP_CLR_FD).  I think the scenario is:

1: umount(8) opens /dev/loop0

2: umount(8) runs lo_ioctl(LOOP_CLR_FD) (this frees the queue)

3: umount(8) closes the /dev/loop0 handle.  The blockdev layer syncs the
   blockdev, but its mapping->backing_dev_info now points into la-la-land.

We shouldn't be freeing the queue until all refs to it have gone away.  This
patch gives the queue the same lifetime as the controlling loop_device
itself.  It also makes the loop driver's queue appear in sysfs again.

It would be better to free the queue when the device is not in use, but I'm
not sure how we can hook into the blockdev layer to do that.

From: Peter Chubb <peterc@gelato.unsw.edu.au>

On 64-bit architectures, ino_t is int, not long, so the attached patch
is needed to prevent a warning.

From: Zwane Mwaikambo <zwane@linuxpower.ca>

hugetlbfs was accessing super_block->s_fs_info after free'ing it.  This was
because it was being free'd prematurely.  I have deferred free until
->put_super().  I have also removed hugetlbfs_kill_super since it now is
simply a kill_litter_super.

From: Adrian Bunk <bunk@fs.tum.de>

hd.c contains a typo

From: Zwane Mwaikambo <zwane@linuxpower.ca>

This is a patch to make the MTRR initialisation more conformant with what
is stated in volume 3 of (10-36 Memory Cache Control).  The most notable
change is entering the no-fill cache mode before clearing the PGE bit in
cr4.  Intel also states that we should do the cache flush via the cr3
register shuffle.  If there is a problem with the patch please don't
hesitate to beat me vigorously with a clue-by-four.

It has been tested on a 3x Pentium 133, 8x PIII Xeon 700, 1x Celeron 550 and 32x
PIII 500 NUMAQ (hardware courtesy of OSDL)

From: Andrey Borzenkov <arvidjaar@mail.ru>

The floppy driver doesn't remove /dev/floppy when floppy_init fails.

From: Andrey Borzenkov <arvidjaar@mail.ru>

_devfs_walk_path does not check if de it is about to scan is a directory.
Next step is spinlock on non-spinlock memory.  It requires either artificial
setup or really broken driver but fairly easy to reproduce once you know how.

It is likely to exist in 2.4 as well.

From: Andrey Borzenkov <arvidjaar@mail.ru>

devfs_mk_dir freed wrong de and incorrectly passed to devfsd already freed
de.  Besides it did not even check if entry found was actually directory.

From: Ramn Rey Vicente <ramon.rey@hispalinux.es>

Fix the config issue with the hotplug firmware loader.  The firmware loader
use hotplug, so this must be included as a dependency.

When we changed try_name() to handle new-style printable dev_t formatting we
broke lots of people's setups.  Lilo, grub, etc.

Fix that by trying new-style formatting first, then fall back to old-style.

People should generally use new-style %u:%u major:minor formatting in the
future.

From: Vinay K Nallamothu <vinay-rc@naturesoft.net>

The patch below fixes two pointer reference bugs (shows up as compile
time warnings given below) which wrongly take the address of "struct
usb_interface*".

	drivers/bluetooth/hci_usb.c: In function `hci_usb_probe':
	drivers/bluetooth/hci_usb.c:786: warning: assignment from incompatible pointer type
	drivers/bluetooth/hci_usb.c:810: warning: assignment from incompatible pointer type

From: Mikael Pettersson <mikpe@csd.uu.se>

This patch fixes ide-scsi.c for the ide_drive_t->queue type change
in 2.6.0-test3.

Without the patch you'll get these new warnings in -test3:

drivers/scsi/ide-scsi.c: In function `idescsi_abort':
drivers/scsi/ide-scsi.c:875: warning: passing arg 1 of `elv_queue_empty' from incompatible pointer type
drivers/scsi/ide-scsi.c: In function `idescsi_reset':
drivers/scsi/ide-scsi.c:902: warning: passing arg 1 of `elv_next_request' from incompatible pointer type

Bug 1065 (http://bugme.osdl.org/show_bug.cgi?id=1065) points out that there
is a risk that UDF will accidentally mount a reiserfs partition, which would
prevent a successful boot.

Andries points out that probing is unreliable and that users/admins should
always specify the root filesystem type on the kernel boot command line with
"rootfstype=resierfs".

But nobody does that, so we should be trying reiserfs before UDF.

From: Manfred Spraul <manfred@colorfullife.com>

(We think this might be the mystery bug which has been hanging about for
months)


We found a [the?] task struct refcount error: A task that dies sets
tsk->state to TASK_ZOMBIE.  The next scheduled task checks prev->state, and
if it's ZOMBIE, then it decrements the reference count of prev.  The
prev->state & _ZOMBIE test is not atomic with schedule, thus if prev is
scheduled again and dies between dropping the runqueue lock and checking
prev->state, then the reference it dropped twice.

This is possible with either preemption [schedule_tail is called by
ret_from_fork with preemption count 1, finish_arch_switch drops it to 0] or
profiling [profile_exit_mmap can sleep on profile_rwsem, called by
mmdrop()] enabled.

Several comparisons which can never be true because they're comparing u8's
with numbers which are greater than 255.

ic_servaddr is accessible after boot via /proc/net/pnp.  So it cannot be
__initdata.

davej says that other varibles there are treated the same way, so move them
all into the regular data section.

From: Paul Clements <Paul.Clements@SteelEye.com>

Here's the updated patch to fix several race conditions in nbd. It
requires reverting the already included (but incomplete)
nbd-race-fix.patch that's in -mm5.

This patch fixes the following race conditions:

1) adds an increment of req->ref_count to eliminate races between
do_nbd_request and nbd_end_request, which resulted in the freeing of
in-use requests -- there were races between send/receive, send/shutdown
(killall -9 nbd-client), and send/disconnect (nbd-client -d), which are
now all fixed

2) adds locking and properly orders the code in NBD_CLEAR_SOCK to
eliminate races with other code

3) adds an lo->sock check to nbd_clear_que to eliminate races between
do_nbd_request and nbd_clear_que, which resulted in the dequeuing of
active requests

4) adds an lo->sock check to NBD_DO_IT to eliminate races with
NBD_CLEAR_SOCK, which caused an Oops when "nbd-client -d" was called

From: Zwane Mwaikambo <zwane@arm.linux.org.uk>

The P4 thermal interrupt vector was only getting set on SMP builds.

From: Oleg Drokin <green@namesys.com>

This patch fixes a problem in reiserfs' handling of immutable attribute,
where every user (not just root) can unset it.  Also it adds "append-only"
attribute "support" (all the support is in VFS anyway, we only recognise the
bit now).  Also misleading comment in reiserfs_fs.h is removed.

From: Oleg Drokin <green@namesys.com>

There is a leftover kunmap in reiserfs_unprepare_pages() which was not
deleted after conversion to kmap_atomic.  This path is virtually never
executed, that's why it was not caught earlier.  Please apply.

The pipe code's mtime and ctime updates are causing writes to read-only
mounted filesystems.

Fix that up by teaching inode_update_time() to honour readonly mounts, and
call it from the pipe code.

From: Nick Piggin <piggin@cyberone.com.au>

Following patch seperates elevator noop, and allows it to be treated
like the other schedulers.

From: Mark Haverkamp <markh@osdl.org>

Properly implement elevator_t..elevator_requeue_req_fn for the anticipatory
scheduler.

This fixes some rarely-occurring oops in the IO scheduler.

From: Nick Piggin <piggin@cyberone.com.au>

Gets rid of the silly (and undocumented) trinary stateness of
ad->changed_batch.

Kernel style flags field could now save 20 bytes per asd (request queue) and
4 per arq.  But I figure that change can wait until I do autotuning...

From: Nick Piggin <piggin@cyberone.com.au>

The crazy HASH_VALID stuff now makes no difference now.  It was there to
try to enforce no merging over a barrier, but it turned out that requests
can just be reordered.  Jens picked this up a a while ago and fixed
deadline (and I AS) by simply dispatching all reqs on the queue on
encountering a barrier.  The hash valid stuff didn't get cleaned up.

From: Ingo Molnar <mingo@elte.hu>

It unifies the functionality of add_timer() and mod_timer(), and makes any
combination of the timer API calls completely SMP-safe.  del_timer() is still
not using the timer lock.

this patch fixes the only timer bug in 2.6 i'm aware of: the del_timer_sync()
+ add_timer() combination in kernel/itimer.c is buggy.  This was correct code
in 2.4, because there it was safe to do an add_timer() from the timer handler
itself, parallel to a del_timer_sync().

If we want to make this safe in 2.6 too (which i think we want to) then we
have to make add_timer() almost equivalent to mod_timer(), locking-wise.  And
once we are at this point i think it's much cleaner to actually make
add_timer() a variant of mod_timer().  (There's no locking cost for
add_timer(), only the cost of an extra branch.  And we've removed another
commonly used function from the icache.)