It contains the thread info pointer. That's not something that
user mode can really use for anything interesting, but it's also
not something that user mode should ever really see.

Pointed out by Brad Spender as being in PaX.

It's a purely theoretical bug, since the kmalloc() failure that
might "leak" file descriptors cannot actually happen (we do not
ever fail small GFP_KERNEL allocations), but it's good to do
things properly.

Noted by Brad Spender.

Noted by Georgi Guninski

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Description: Bug 387 (http://bugzilla.kernel.org/show_bug.cgi?id=387)
is fixed by the attached patch, which sends waitqueue wake-ups to all
the appropriate wait-queue entries when a device is removed from
the system.
Signed-off-by: Nishanth Aravamudan <nacc@us.ibm.com>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

This patch provides a new "sl811-hcd" driver, which should replace the older
one from Cypress (which has been broken for ages, even on SA-1100).

Key features of this new driver:

 - Small, relatively tight code;
 - Uses the 2.6 platform_device and usbcore HCD infrastructures;
 - Compiles (x86, ARM) and works (ARM/PXA255);
 - Passed a day's worth of "usbtest" stress testing (on 2.6.9).

I've enumerated over a dozen different devices with it, and actually tested
mice, hubs, keyboards, and usb-storage.  There's a hardware erratum that
prevents this chip from working with certain external hubs.  There's scope
yet for some performance work here; and some IRQ quirks linger.

This PIO-only driver should serve as a model for some other non-DMA USB host
controllers (like isp1161, isp1362, td243) used in embedded Linuxes ... in
particular, showing how to maintain async and periodic schedules without
pointless emulation of OHCI DMA queues and/or registers.

The driver should handle ISO, but since it doesn't implement the special
urb->iso_frame_desc[] "pseudo-queue" model (and since Linux can't guarantee
low enough IRQ latencies!), ISO is disabled.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

I noticed an SMP deadlock when connecting devices to
an autosuspended root hub.

This fix just makes the OHCI hub status reporting logic (used
exclusively by khubd) be a NOP until after the worker task
(keventd) finishes resuming the port, so they can't deadlock.
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

The patch below removes an unused function from
drivers/usb/host/uhci-debug.c
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

This makes the EHCI driver stop trying to update a live QH ... it's
not like OHCI, that can't be done safely because of a hardware race.
The fix:

    - Unlinks the QH before updating it; only the tail can safely be
      updated "live", not the queue head.  The async schedule (all
      control/bulk QHs) and periodic schedule (interrupt QH) work a
      bit differently ... high bandwidth transfers will hiccup.

    - Moves "update QH" and "clear toggle" logic into one new
      qh_refresh() routine, used in several places.

The race shows readily enough under load with the right hardware.
The controller silicon might be relatively slow, or maybe it's the
bus that's slow/busy:

	Host			Controller
	---			----------
				reads two TD pointers
	update two TD pointers
	wmb()
	activate QH
				reads rest of QH

Net result is that the HC treated old TD pointers as valid, and things
started misbehaving.  Busy controllers would misbehave worse; some systems
wouldn't notice more than a slowdown, especially with light USB loads.

This affects behavior in two cases.  The uncommon one is when an endpoint
gets an error and halts.  The more common one happens when the controller
runs off the end of its queue and overlays an inactive "dummy" TD into
the QH ... something the spec says shouldn't happen, but which more
silicon seems to be doing.  (Presumably to reduce DMA chatter.)
Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

This patch fixes two small problems in the port suspend/resume handling
for the UHCI driver.  There were a couple of spots where I neglected to
store I/O addresses in unsigned _long_ variables (required for 64-bit
architectures).  And it turns out the host controller will continue to
indicate a resume is in progress for a few microseconds after it has been
turned off, so an extra delay is needed.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Fix (most of) x64-64 kernel build for CONFIG_PCI=n.  Fixes these 2 errors:

1. arch/x86_64/kernel/built-in.o(.text+0x8186): In function `quirk_intel_irqbalance':
: undefined reference to `raw_pci_ops'

Kconfig change:
2. arch/x86_64/kernel/pci-gart.c:194: error: `pci_bus_type' undeclared (first use in this function)

Still does not fix this one:
drivers/built-in.o(.text+0x3dcd8): In function `pnpacpi_allocated_resource':
: undefined reference to `pcibios_penalize_isa_irq'
Signed-off-by: Randy Dunlap <rddunlap@osdl.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Fixes faulty IRQ_NONE value returning by VM86 irq_handler().

The IRQ source is blocked as well until userspace confirms processing.
This should enable to use VM86 code even for level triggered interrupt
sources. 
Signed-off-by: Pavel Pisa <pisa@cmp.felk.cvut.cz>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Signed-off-by: David S. Miller <davem@davemloft.net>

We were using 0x08000000 instead of TASK_UNMAPPED_BASE
so that running something like "/lib/ld-linux.so.2 emacs"
would work.

The issue there was that wherever /lib/ld-linux.so.2 gets
mapped (controlled by ELF_ET_DYN_BASE), that is where the
BSS start for the process ends up.  Now, emacs allocates
dynamic memory for LISP objects from the BSS, and needs
the top 4 bits of the virtual address to be clear so that
it can encode LISP type and GC marking information there.

But making this obscure emacs case work breaks lots of other
stuff.  For example, programs with a reasonably large data
section fail to load via direct ld.so interpreter execution
because the data section is large enough to begin overlapping
with the ELF_ET_DYN_BASE area.

The /lib/ld-linux.so.2 emacs case does not work on a lot of
platforms due to this issue, including i386, so it is not
worth making work on sparc either.  It is indeed useful
sometimes when debugging a new experimental build of glibc
for example, but people doing that can hack the value of
ELF_ET_DYN_BASE in their kernels.  Perhaps at some point
we will make a sysctl controllable value.
Signed-off-by: David S. Miller <davem@davemloft.net>

The patch is from Horms <horms@vergenet.net>
Signed-off-by: Horms <horms@verge.net.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

into nuts.davemloft.net:/disk1/BK/net-2.6

Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

We forget to check the BRK condition in
the interrupt status register when deciding
to call receive_chars() or not, which is where
BRK handling occurs.
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

The version of netem in 2.6.10 moves packets from the delayed queue
to the qdisc in a timer interrupt. But it forgot to force the device to
pick them up.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch fixes an oops when the ipt action is used with a
non-existant iptables target. It tries to log
t->u.kernel.target->name, u.kernel.target is part of a union
and as long as the target wasn't successfully loaded contains
the name of the target, using it as a pointer results in a
crash.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

* change comment about Sigmatel now that there is a driver
* convert to new module_param
* places where urb is unlinked synchronously, use usb_kill_urb
  because that is now a runtime warning.

Original patch from Stephen Hemminger
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

USB changed behaviour of unlink_urb so that it gives warning and backtrace when
being used synchronously. The correct current behaviour is to us kill_urb
in that case.

Original patch from Stephen Hemminger
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Bugfix suggested by Arkadiusz Miskiewicz.
Signed-off-by: Jean Tourrilhes <jt@hpl.hp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Noticed by Bob Breuer.
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: David S. Miller <davem@davemloft.net>

Noticed by Georgi Guninski.
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

If the user makes ip_cmsg_send call ip_options_get
multiple times, we leak kmalloced IP options data.

Noticed by Georgi Guninski.
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Fix an oops in sched_domain_debug when using the isolcpus= option.

Also move a debug check for validating groups into the "for-each-group"
loop, where it should be.
Signed-off-by: Nick Piggin <nickpiggin@yahoo.com.au>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The real bug was in the debugging code, not the actual domain data
structure setup.

Cset exclude: sivanich@sgi.com[torvalds]|ChangeSet|20041207160443|30564

into ppc970.osdl.org:/home/torvalds/v2.6/linux