* 'agp-patches' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/agp-2.6:
  agp: AMD AGP is used on UP1100 & UP1500 alpha boxen
  intel_agp: really fix 945/965GME
  agp: don't lock pages
  AGP: document boot options
  Fix "use after free" / "double free" bug in ati_create_gatt_pages / ati_free_gatt_pages

* master.kernel.org:/home/rmk/linux-2.6-arm:
  [ARM] 4527/1: pxa: fix pxa27x ac97 cold reset in ASoC due to CKEN change
  [ARM] 4530/1: MXC: fix elf_hwcap compile breakage as in iop13xx
  [ARM] 4529/1: [HP Jornada 7XX] - Fix jornada720.c to use SSP driver
  [ARM] 4528/1: [HP Jornada 7XX] - Fix typo in jornada720_ssp.c
  [ARM] Remove CONFIG_IGNORE_FIQ
  [ARM] 4526/1: pxa: make ARCH_PXA select GENERIC_CLOCKEVENTS
  [ARM] setup_profiling_timer must not be __init

due to CKEN_xxx definition and pxa_set_cken() change,  the pxa27x
ac97 cold reset is broken in ASoC, fixed to use bit index instead
of bit mask
Signed-off-by: eric miao <eric.y.miao@gmail.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

MXC needs the same change as IOP.  See [ARM] 4494/1
or commit 7dea1b20

An undefined reference to elf_hwcap prevents linkage, due
to changes made by f884b1cf
and d1cbbd6b

Removing processor.h removes the extern definition of
elf_hwcap, which fixes the link issue, but forgets cpu_relax().
So, instead, we'll call barrier() directly.

Cc: Lennert Buytenhek <kernel@wantstofly.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Acked-by: Ross Wille <wille@freescale.com>
Signed-off-by: Quinn Jensen <quinn.jensen@freescale.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

This fixes the jornada720.c file :

* ifdef for CONFIG_SA1100_JORNADA720_SSP since we dont want to include anything not selected in menyconfig.
* add documentation for init for future reference
* change platform driver name from jornada720_mcu ->
jornada_ssp.
* change maintainer in file.
Signed-off-by: Kristoffer Ericson <Kristoffer.Ericson@gmail.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

When comparing a pointer, it's clearer to compare it to NULL than to 0.
Signed-off-by: Yoann Padioleau <padator@wanadoo.fr>
Signed-off-by: Tony Luck <tony.luck@intel.com>

b716395e added code to handle
a compatability issue with 32bit quota tools, but the new compat
routines are only needed when CONFIG_COMPAT=y (and with this set
to 'n' there are compilation problems since some new typedefs are
not visible).

Reported by Doug Chapman.  Fix tuned by a cast of thousands (Andi,
Andreas, Arthur, HPA, Willy)
Signed-off-by: Tony Luck <tony.luck@intel.com>

Forgot to adjust this one with the acpi autoloading patches
in commit 8c8eb78fAcked-by: Myron Stowe <myron.stowe@hp.com>
Acked-by: Len Brown <len.brown@intel.com>
Signed-off-by: Thomas Renninger <trenn@suse.de>
Signed-off-by: Tony Luck <tony.luck@intel.com>

Signed-off-by: Dave Airlie <airlied@redhat.com>

Fix some missing places to check with device id info, which
should probe the device gart correctly.
Signed-off-by: Wang Zhenyu <zhenyu.z.wang@intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

AGP should not need to lock pages. They are not protecting any race
because there is no lock_page calls, only SetPageLocked.

This is causing hangs with d00806b1.
Signed-off-by: Nick Piggin <npiggin@suse.de>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Add documentation for AGP boot options.
Signed-off-by: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Hi,

Coverity spotted a "use after free" bug in
drivers/char/agp/ati-agp.c::ati_create_gatt_pages().

The same one that was in
  drivers/char/agp/amd-k7-agp.c::amd_create_gatt_pages()

The problem is this:
       If "entry = kzalloc(sizeof(struct ati_page_map), GFP_KERNEL);"
fails, then there's a loop in the function to free all entries
allocated so far and break out of the allocation loop. That in itself
is pretty sane, but then the (now freed) 'tables' is assigned to
ati_generic_private.gatt_pages and 'retval' is set to -ENOMEM which
causes ati_free_gatt_pages(); to be called at the end of the function.
The problem with this is that ati_free_gatt_pages() will then loop
'ati_generic_private.num_tables' times and try to free each entry in
tables[] - this is bad since tables has already been freed and
furthermore it will call kfree(tables) at the end - a double free.

This patch removes the freeing loop in ati_create_gatt_pages() and
instead relies entirely on the call to ati_free_gatt_pages() to free
everything we allocated in case of an error. It also sets
ati_generic_private.num_tables to the actual number of entries
allocated instead of just using the value passed in from the caller -
this ensures that ati_free_gatt_pages() will only attempt to free
stuff that was actually allocated.

Note: I'm in no way intimate with this code and I have no way to
actually test this patch (besides compile test it), so while I've
tried to be careful in reading the code and make sure the patch
does the right thing an ACK from someone who actually knows the
code in-depth would be very much appreciated.
Signed-off-by: Jesper Juhl <jesper.juhl@gmail.com>
Signed-off-by: Dave Airlie <airlied@linux.ie>

Fix wrong return value in parse_vector_domain().
Signed-off-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

The ia64's acpi_gsi_to_irq() function assumes irq == vector. But in
fact irq can be different from vector. This patch fix this wrong
assumption.
Signed-off-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

Add some sanity checks into __bind_irq_vector().
Signed-off-by: Kenji Kaneshige <kaneshige.kenji@jp.fujitsu.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/drzeus/mmc:
  drivers/mmc/core/: make 3 functions static
  mmc: add missing printk levels
  mmc: remove redundant debug information from sdhci and wbsd
  mmc: proper debugging output in core
  mmc: be more verbose about card insertions/removal
  mmc: Don't hold lock when releasing an added card
  mmc: add a might_sleep() to mmc_claim_host()
  mmc: update kerneldoc
  mmc: update header file paths
  sdhci: add support to ENE-CB714
  mmc: check error bits before command completion

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/paulus/powerpc: (21 commits)
  [POWERPC] spusched: Fix initial timeslice calculation
  [POWERPC] spufs: Fix incorrect initialization of cbe_spu_info.spus
  [POWERPC] Fix Maple platform ISA bus
  [POWERPC] Make pci_iounmap actually unmap things
  [POWERPC] Add function to check if address is an IO port
  [POWERPC] Fix Pegasos keyboard detection
  [POWERPC] iSeries: Fix section mismatch warning in lpevents
  [POWERPC] iSeries: Fix section mismatch warnings
  [POWERPC] iSeries: We need vio_enable_interrupts
  [POWERPC] Fix RTC and device tree on linkstation machines
  [POWERPC] Add of_register_i2c_devices()
  [POWERPC] Fix loop with unsigned long counter variable
  [POWERPC] Fix register labels on show_regs() message for 4xx/Book-E
  [POWERPC] Only allow building of BootX text support on PPC_MULTIPLATFORM
  [POWERPC] Fix the ability to reset on MPC8544 DS and MPC8568 MDS boards
  [POWERPC] Fix mpc7448hpc2 tsi108 device_type bug
  [POWREPC] Fixup a number of modpost warnings on ppc32
  [POWERPC] Fix ethernet PHY support on MPC8544 DS
  [POWERPC] Don't try to allocate resources for a Freescale POWERPC PHB
  Revert "[POWERPC] Don't complain if size-cells == 0 in prom_parse()"
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/mingo/linux-2.6-sched:
  [PATCH] sched: debug feature - make the sched-domains tree runtime-tweakable
  [PATCH] sched: add above_background_load() function
  [PATCH] sched: update Documentation/sched-stats.txt
  [PATCH] sched: mark sysrq_sched_debug_show() static
  [PATCH] sched: make cpu_clock() not use the rq clock
  [PATCH] sched: remove unused rq->load_balance_class
  [PATCH] sched: arch preempt notifier mechanism
  [PATCH] sched: increase SCHED_LOAD_SCALE_FUZZ

It's a totally independent decision for the user whether he wants
suspend and/or hibernation support, and ACPI shouldn't care.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Commit bd804eba ("PM: Introduce
pm_power_off_prepare") caused problems in the poweroff path, as reported by
YOSHIFUJI Hideaki / 吉藤英明.

Generally, sysdev_shutdown() should be called after the ACPI preparation for
powering the system off.  To make it happen, we can separate sysdev_shutdown()
from device_shutdown() and call it directly wherever necessary.
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Tested-by: YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This reverts most of commit 19d36ccd.

The way to DEBUG_RODATA interactions with KPROBES and CPU hotplug is to
just not mark the text as being write-protected in the first place.
Both of those facilities depend on rewriting instructions.

Having "helpful" debug facilities that just cause more problem is not
being helpful.  It just adds complexity and bugs. Not worth it.
Reported-by: Rafael J. Wysocki <rjw@sisk.pl>
Cc: Andi Kleen <ak@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

These are manual fixups after running Lindent.  No functional change.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: Len Brown <lenb@kernel.org>
Cc: Adam Belay <ambx1@neo.rr.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Run Lindent on all PNP source files.

Produced by:

    $ quilt new pnp-lindent
    $ find drivers/pnp -name \*.[ch] | xargs quilt add
    $ quilt add include/linux/{pnp.h,pnpbios.h}
    $ scripts/Lindent drivers/pnp/*.c drivers/pnp/*/*.c include/linux/pnp*.h
    $ quilt refresh --sort
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: Len Brown <lenb@kernel.org>
Cc: Adam Belay <ambx1@neo.rr.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

tsc_unstable is declared twice.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change INT0 trigger mode from edge-sense mode to level-sense mode,
in order to fix the following timeout error:
  'NETDEV WATCHDOG: eth0: transmit timed out'.

This patch is required only for the Mappi platform.
Signed-off-by: Hirokazu Takata <takata@linux-m32r.org>
Cc: Hitoshi Yamamoto <hitoshiy@linux-m32r.org>
Cc: Jeff Garzik <jeff@garzik.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

With the introduction of kernelcore=, a configurable zone is created on
request.  In some cases, this value will be small enough that some nodes
contain only ZONE_MOVABLE.  On some NUMA configurations when this occurs,
arch-independent zone-sizing will get the size of the memory holes within
the node incorrect.  The value of present_pages goes negative and the boot
fails.

This patch fixes the bug in the calculation of the size of the hole.  The
test case is to boot test a NUMA machine with a low value of kernelcore=
before and after the patch is applied.  While this bug exists in early
kernel it cannot be triggered in practice.

This patch has been boot-tested on a variety machines with and without
kernelcore= set.
Signed-off-by: Mel Gorman <mel@csn.ul.ie>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix link errors below by selecting FW_LOADER
  LD      .tmp_vmlinux1
drivers/built-in.o: In function `cyz_load_fw':
drivers/char/cyclades.c:4908: undefined reference to `request_firmware'
drivers/char/cyclades.c:4979: undefined reference to `release_firmware'

Cc: <toralf.foerster@gmx.de>
Signed-off-by: Jiri Slaby <jirislaby@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix the following two section mismatch warnings:

WARNING: vmlinux.o(.text+0x1ce84): Section mismatch: reference to .init.text:free_bootmem (between 'free_tce_table' and 'build_tce_table')
WARNING: vmlinux.o(.text+0x1d04d): Section mismatch: reference to .init.text:__alloc_bootmem_low (between 'alloc_tce_table' and 'kretprobe_trampoline_holder')

In both cases the functions was used only from __init
context so mark them __init.
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Cc: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fixed 'depends on PPC_PASEMI' in EDAC Kconfig.  Module PASEMI depends ONLY on
the PASEMI on PPC.

Was previously enabled for ALL PPC

Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Egor N. Martovetsky <egor@pasemi.com>
Signed-off-by: Doug Thompson <dougthompson@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

EDAC has a foundation to perform software memory scrubbing, but it requires a
per architecture (atomic_scrub) function for performing an atomic update
operation.  Under X86, this is done with a

lock:  add  [addr],0

in the file asm-x86/edac.h

This patch provides the MIPS arch with that atomic function, atomic_scrub() in

asm-mips/edac.h

Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Doug Thompson <dougthompson@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This patch fixes sysfs exit code for the EDAC PCI device in a similiar manner
and the previous fixes for EDAC_MC and EDAC_DEVICE.

It removes the old (and incorrect) completion model and uses reference counts
on per instance kobjects and on the edac core module.

This pattern was applied to the edac_mc and edac_device code, but the EDAC PCI
code was missed.  In addition, this fixes a system hang after a low level
driver was unloaded.  (A cleanup function was called twice, which really
screwed things up)

Cc: Greg KH <greg@kroah.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Doug Thompson <dougthompson@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This fixes a deadlock that could occur on a 'setup' and 'teardown' sequence of
the workq for a edac_mc control structure instance.  A similiar fix was
previously implemented for the edac_device code.

In addition, the edac_mc device code there was missing code to allow the workq
period valu to be altered via sysfs control.

This patch adds that fix on the code, and allows for the changing of the
period value as well.

Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Doug Thompson <dougthompson@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Nathan Lynch <ntl@pobox.com> reported:
2.6.23-rc1 breaks the build for 64-bit powerpc for me (using
maple_defconfig):

  LD      vmlinux.o
powerpc64-unknown-linux-gnu-ld: dynreloc miscount for
kernel/built-in.o, section .opd
powerpc64-unknown-linux-gnu-ld: can not edit opd Bad value
make: *** [vmlinux.o] Error 1

However, I see a possibly related binutils patch:
http://article.gmane.org/gmane.comp.gnu.binutils/33650

It was tracked down to be caused by the weak prototype
declaration in mm.h:
__attribute__((weak)) const char *arch_vma_name(struct vm_area_struct *vma);

But there is no need to make the declaration weak - only the definition
needs to be marked weak.  So drop the weak declaration.  And in the process
drop the duplicate definition in page.h for powerpc.

Note: the arch_vma_name fix for x86_64 needs to be applied first to avoid
breaking x86_64
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Cc: Nathan Lynch <ntl@pobox.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The function arch_vma_name() is declared weak and thus it was
not noticed that x86_64 had two almost identical implementations.

It was introduced in syscall32.c by: c633090e
It was introduced in mm/init.c by: 2aae950bSigned-off-by: Roland McGrath <roland@redhat.com>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Cc: Andi Kleen <ak@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

chipsfb.c shouldn't use PM_SUSPEND_MEM in there, but PM_EVENT_SUSPEND.

Cc: Cedric Le Goater <clg@fr.ibm.com>
Cc: "Antonino A. Daplas" <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

ext[234]_check_descriptors sanity checks block group descriptor geometry at
mount time, testing whether the block bitmap, inode bitmap, and inode table
reside wholly within the blockgroup.  However, the inode table test is off
by one so that if the last block in the inode table resides on the last
block of the block group, the test incorrectly fails.  This is because it
tests the last block as (start + length) rather than (start + length - 1).

This can be seen by trying to mount a filesystem made such as:

 mkfs.ext2 -F -b 1024 -m 0 -g 256 -N 3744 fsfile 1024

which yields:

 EXT2-fs error (device loop0): ext2_check_descriptors: Inode table for group 0 not in group (block 101)!
 EXT2-fs: group descriptors corrupted!

There is a similar bug in e2fsprogs, patch already sent for that.

(I wonder if inside(), outside(), and/or in_range() should someday be
used in this and other tests throughout the ext filesystems...)
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Cc: <linux-ext4@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This patch fixes an obvious use-after-free spotted by the Coverity checker.
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Jeremy Fitzhardinge <jeremy@goop.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

drivers/edac/edac_stub.c:15:22: asm/edac.h: No such file or directory

was it even supposed to work?

Cc: Douglas Thompson <dougthompson@xmission.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

ia64:

drivers/i2c/chips/ds1682.c: In function `ds1682_show':
drivers/i2c/chips/ds1682.c:78: warning: long long unsigned int format, long unsigned int arg (arg 3)
drivers/i2c/chips/ds1682.c:78: warning: long long unsigned int format, long unsigned int arg (arg 3)

Cc: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>