Patch from Stephen Tweedie

"In looking at the fix for the ext3 Orlov double-accounting bug, I
 noticed a change to the sb->s_dir_count accounting, restoring a
 missing s_dir_count++ when we allocate a new directory.

 However, I can't find anywhere in the code where we decrement this
 again on directory deletion, neither in ext2 nor in ext3, in 2.4 nor
 in 2.5."

Locking is via lock_super().

There is a warning in there to detect when block_write_full_page()
attaches buffers to a blockdev page.  This is a bad thing because that
page's blocks may then overlap blocks from a different address_space.
So I disallowed it.

But the message can be triggered when an application is mmapping a
blockdev MAP_SHARED.  Apparently INND likes to do this.

So remove the warning.

Patch from Christopher Li <chrisl@vmware.com>

This little patch will fix two place in htree code which
forget the "cpu_to_le16" converting . This bug causes
incorrect record length on PPC.

Thanks Franz for report the problem.

Patch from Andreas Gruenbacher <agruen@suse.de>

The setxattr inode operation is defined like this in 2.4 and 2.5:

        int (*setxattr) (struct dentry *dentry, const char *name,
                         void *value, size_t size, int flags);

the original type of the value parameter was `const void *'; the const
obviously has been lost at some point. The definition should be:

        int (*setxattr) (struct dentry *dentry, const char *name,
                         const void *value, size_t size, int flags);

The page allocator has traditionally just gone BUG when it sees a page
in a bad state.  This is usually due to hardware errors, sometimes
software errors.

I'm proposing that we not go BUG() any more, but print lots (and lots)
of diagnostic info and try to continue.

Might be a bit controversial.

balance_dirty_pages() is too expensive to call once-per-page.  Use the
ratelimited version.

From Dipanker Sarma.

Before setting the ids->entries to the new array, there must be a wmb()
to make sure that the memcpyed contents of the new array are visible
before the new array becomes visible.

This patch fixes a problem which was discovered by Vladimir Saveliev
<vs@namesys.com>

Radix trees have a `height' field, which defines how far the pages are
from the root of the tree.  It starts out at zero and increases as the
trees depth is grown.

But it is never decreased.  It cannot be decreased without a full tree
traversal.

Because radix_tree_delete() does not decrease `height', we end up
returning inodes to their filesystem's inode slab cache with a non-zero
height.

And when that inode is reused from slab for a new file, it still has a
non-zero height.  So we're breaking the slab rules by not putting
objects back in a fully reinitialised state.

So the new file starts out life with whatever height the previous owner
of the inode had.  Which is space- and speed-inefficient.

The most efficient place to fix this would be in destroy_inode().  But
that only fixes the problem for inodes - there are other users of radix
trees.

So fix it in radix_tree_delete(): if the tree was emptied, reset
`height' to zero.

Patch from Hugh Dickins <hugh@veritas.com>

Fixes the Oracle startup problem reported by Alessandro Suardi.

Reverts a "simplification" to shmdt() which was wrong if subsequent
mprotects broke up the original VMA, or if parts of it were munmapped.

- I hit a BUG in end_swap_bio_read() under heavy load.  The page
  wasn't locked.  No idea how this can happen :(

  Add a BUG at submission time to catch a caller reading into an
  unlocked swapcache page.

- Remove a debug check from destroy_inode() - it was in the wrong leg
  of the `if' statement anyway.

This allows NFSv4 responses to cover move than one page.  There are
still limits though.  There can be at most one 'data' response which
includes READ, READLINK, READDIR.  For these responses, the interesting
data goes in a separate page or, for READ, list of pages.

All responses before the 'data' response must fit in one page, and all
responses after it must also fit in one (separate) page.

Now that nfsd uses a list of pages for requests instead of
one large buffer, NFSv4 need to know about this.

The most interesting part of this is that it is possible
that section of a request, like a path name, could span
two pages, so we need to be able to kmalloc as little bit
of space to copy them into, and make sure they get
freed later.

We don't implement the ancient stat syscalls on ppc64 since early libcs
wont run on ppc64 (they hardcode the incorrect cacheline size).

into penguin.transmeta.com:/home/penguin/torvalds/repositories/kernel/linux

into penguin.transmeta.com:/home/penguin/torvalds/repositories/kernel/linux

Here is the a pre-patch in the attempt to get rid of 'struct
nfs4_compound', and the associated horrible union in 'struct
nfs4_op'.

It splits out the fields that are meant to do buffer overflow checking
and iovec adjusting on the XDR received/sent data. It moves support
for that nto the dedicated structure 'xdr_stream', and the associated
functions 'xdr_reserve_space()', 'xdr_inline_decode()'.

The patch also expands out the all macros ENCODE_HEAD, ENCODE_TAIL,
ADJUST_ARGS and DECODE_HEAD, as well as most of the DECODE_TAILs.

linux/interrupt.h needs:
	asm/system.h: smb_mb()
	linux/linkage.h: asmlinkage/FASTCALL/etc.

This changes the return type of the verify and setpolicy functions from
void to int.  While doing this, I've changed the values for minimum and
maximum supported frequency to be per CPU, as UltraSPARC needs this.

Additionally, small cleanups in various drivers.

Traditional naming in pci/setup-xx code assumes that
pdev_*/pbus_* functions are private, everything visible
from outer world should be pci_*.

The most important changes are:
	- allocate buffers on open(), not module load;
	- correct some failed allocation paths;
	- use wait_event;
	- C99 structs inits;

The most important changes are:
	* add suspend/resume support to the sonypi driver (not
	  based on driverfs however) (Florian Lohoff);
	* add "Zoom" and "Thumbphrase" buttons (Francois Gurin);
	* add camera and lid events for C1XE (Kunihiko IMAI);
	* add a mask parameter letting the user choose what kind
	  of events he wants;
	* use ACPI ec_read/ec_write when available in order to
	  play nice when latest ACPI is enabled;
	* several source cleanups.

into penguin.transmeta.com:/home/penguin/torvalds/repositories/kernel/linux

Today we return EINVAL for fcntl with a lock with negative length.
POSIX-2001 says that the lock covers start .. start+len-1 if len >= 0
and start+len .. start-1 if len < 0.

into penguin.transmeta.com:/home/penguin/torvalds/repositories/kernel/linux

into nuts.ninka.net:/home/davem/src/BK/net-2.5

into groveronline.com:/root/bk/linux-acpi

The i_dev field is deleted and the few uses are replaced by i_sb->s_dev.

There is a single side effect: a stat on a socket now sees a nonzero
st_dev.  There is nothing against that - FreeBSD has a nonzero value as
well - but there is at least one utility (fuser) that will need an
update.

into penguin.transmeta.com:/home/penguin/torvalds/repositories/kernel/linux

into tp1.ruhr-uni-bochum.de:/scratch/kai/kernel/v2.5/linux-2.5.make

into penguin.transmeta.com:/home/penguin/torvalds/repositories/kernel/linux