The RFCOMM TTY code don't leak reference counting, because the TTY layer
will call the ->close() method even if open fails and the reference count
is decreased there.

Patch from David Woodhouse <dwmw2@infradead.org>

A poll on a non-blocking listen socket signals readable too early. The
first time the socket should be readable is if a child is in connected
state. And don't signal writeable if the socket is in config state.

Noticed by Jean Tourrilhes <jt@hpl.hp.com>

This patch corrects the error handling of copy_to_user() and adds more
error checks. It also fixes two reference counting bugs.

Noticed by Andi Kleen <ak@suse.de>

This patch adds the missing fput() call for the BNEP and CMTP protocol
layers in case the user submits a not connected socket.

Noticed by Andi Kleen <ak@suse.de>

This patch fixes a racing condition in accepting incoming RFCOMM
connections. If a SABM command frame occurs in data packet right
after L2CAP configuration request packet and there is no active
session yet then the kernel RFCOMM thread wakes up only once and
creates a new session. But it does not process SABM frame from
second data packet waiting in the queue. Connection setup hangs
and the other side is waiting for UA frame response, but the
kernel thread keeps sleeping. A possible solution is to force
additional thread wakeup right after successful creation of the
new session.

Patch from Dmitri Khokhlov <dkhokhlov@hotmail.com>

This patch makes sure that the Bluetooth core layer always knows the
current voice setting. It will be read on device initialization and
then stored in the hci_dev structure.

See http://www.cse.unsw.edu.au/~gernot/persona/hobbies/dunnart.html
for more information about Dunnarts, in case you've never heard of
them before. Courtesy of Gernot Heiser.

the size to "vsnprintf()".

That's a pretty clear case of overflow.

into home.osdl.org:/home/torvalds/v2.5/linux

into home.osdl.org:/home/torvalds/v2.5/linux

into kernel.bkbits.net:/home/davem/tg3-2.6

  http://bugzilla.kernel.org/show_bug.cgi?id=1766

into kernel.bkbits.net:/home/davem/tg3-2.6

sparc_do_fault assumes that pmd_val(*pmd) = pmd_val(*pmd_k) will
duplicate a PMD entry.  With large soft-PMDs this doesn't work.

Align the pkmap area on a 4MB region so that a single
large pagetable can be used.  Fixes random killing of
processes which used high memory.

This has been in -mm since 2.6.1-mm5

 - IDE can be used as module again (compiles and works),
   this fixes bugzilla bugs #576 and #1700
 - separate module for probing is no longer required
 - generic/default host driver is available as ide_generic module

This contains the build fixes by Adrian Bunk and Andrew Morton.

Thanks to Eric Brower for spotting this.

into nuts.davemloft.net:/disk1/davem/BK/sparc-2.6

From: Davin McCall <davmac@ozonline.com.au>

Set hwif->chipset to ide_forced if it was forced by kernel parameters.

Set hwif->chipset to ide_generic for hwifs controlled by generic IDE
code, so they wont be taken by setup_pci.c:ide_match_hwif().

Patch also fixes /proc/ide/ideX/model to report "generic" instead of
"(none)" for default hwifs.

This has been in -mm since 2.6.1-mm1.

You can't just cast cpumasks.  It doesn't compile if NR_CPUS is greater than
4 * BITS_PER_LONG.

into home.osdl.org:/home/torvalds/v2.5/linux

into nuts.davemloft.net:/disk1/davem/BK/sparc-2.6

This should fix some picky USB devices.

From Tom Rini <trini@kernel.crashing.org>

On the MBX the kernel made an assumption about where the MAC address would
be in the VPD (Vital Product Data).  However, the documentation for the
firmware (EPPC-Bug) describes the format of the VPD and makes no
guarrantees about the location of any VPD record.  It does however describe
the format of each record type and the MAC address record will be of type
'08' and of size 6.  This changes the code so that instead of assuming a
position, it searches for the record, which I assume is also what EPPC-Bug
does.

From: "H. Peter Anvin" <hpa@zytor.com>

Apparently, on x86-64, the stack isn't always aligned properly (16 bytes)
in the kernel at the moment.  This causes the RAID-6 code to crash the
system.  This patch is a workaround for that; the right thing is to muck
with the assembly entrypoints to enforce proper stack alignment.  However,
that's not anything I feel comfortable doing in an evening, especially
since I don't have a machine on which I can test the resulting kernels.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

SCLP console/tty fixes:

- Fix incorrect state change of SCLP_RUNNING flag in interrupt handler

- Suppress emission of empty buffers to prevent stack overflow

- Fix off by one error in sclp_write (used to return # of chars written + 1)

- Prevent sclp_tty_write_string from waiting in interrupt (during flush)

- Fix deadlock after TIOCSCLPSNL ioctl

- Fix sclp_tty_chars_in_buffer calculation

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

s390 inline assembly bug-fixes:

- Add memory barriers to spinlocks, atomic variable functions and to
  test_and_{set,clear,change}_bit.

- Add "=m" and "m" contraints to tell gcc that the content of a variable
  is in fact used.

- Replace "+m" constraints by "=m" on the output and "m" on the input list.

- Use c-implemtation for ffz and __ffs.

- Use generic c-implemtation for ffs and fls.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

s390 general update:

- Add archhelp for "make image".

- 32-bit execve fix.

- Export some symbols: sys_ioctl, put_files_struct & ccw_device_work.

- Minor cleanups in arch/s390/mm/init.c & drivers/s390/net/ctctty.c.

From: David Gibson <david@gibson.dropbear.id.au>

These are some trivial cleanups to the hugepage ppc64 support

From: Anton Blanchard <anton@samba.org>

From: Anton Blanchard <anton@samba.org>

The current SLB handling code has a number of problems:

- We loop trying to find an empty SLB entry before deciding to cast one
  out.  On large working sets this really hurts since the SLB is always full
  and we end up looping through all 64 entries unnecessarily.

- During castout we currently invalidate the entry we are replacing.  This
  is to avoid a nasty race where the entry is in the ERAT but not the SLB and
  another cpu does a tlbie that removes the ERAT at a critical point.  If
  this race is fixed the SLB can be removed.

- The SLB prefault code doesnt work properly

The following patch addresses all the above concerns and adds some more
optimisations:

- feature nop out some segment table only code

- slb invalidate the kernel segment on context switch (avoids us having to
  slb invalidate at each cast out)

- optimise flush on context switch, the lazy tlb stuff avoids it being
  called when going from userspace to kernel thread, but it gets called when
  going to kernel thread to userspace.  In many cases we are returning to the
  same userspace task, we now check for this and avoid the flush

- use the optimised POWER4 mtcrf where possible

From: Anton Blanchard <anton@samba.org>

From: Anton Blanchard <anton@samba.org>