into samba.org:/scratch/anton/tmp3

into samba.org:/scratch/anton/tmp3

into samba.org:/scratch/anton/tmp3

into penguin.transmeta.com:/home/torvalds/v2.5/linux

This patch reinstates the ability of tty devices to use dynamically
allocated major numbers yet specify the minor numbers statically.

The synclink drivers do this.

This patch adds some new vendor/product ids for the USB scanner
driver.

into kroah.com:/home/greg/linux/BK/gregkh-2.5

The recent writev() fix broke the invariant that ->commit_write _must_ be
called after a successful ->prepare_write().  It leaves ext3 with a
transaction stuck open and the filesystem locks up.

into home.transmeta.com:/home/torvalds/v2.5/linux

- Kill the bogus ret transformation in block/ioctl.c if we return
  -EINVAL, doesn't make any sense.

- Don't allow sg_reserved_size to be set bigger than a request we can
  deal with...

- timeout fixes.

- Cleanup of user access.

- Set SAM_STAT_CHECK_CONDITION, not CHECK_CONDITION which needs to be
  bit shifted 1 up.

- Set sense_len correctly.

- Account sense_len correctly, don't just increment by 1...

- Use the correct pointer in post transform.

- Fix oops in bio_map_user(), it must get the extra reference prior to
  calling bio_unmap_user() itself too.

According to http://www.torque.net/sg/p/sg_v3_ho.html, SG HOWTO,
SG_[GET|SET]_TIMEOUTs are measured in "jiffies," while timeout field
of SG_IO structure - in milliseconds. Inconsistent? Yes. Yet it's no
excuse to disregard the specification. "Jiffies" are USER_HZ, 10ms on
IA-32 platforms and has to be scaled to kernel "jiffies," as suggested
below. As for "(jiffies - start_time) * (1000 / HZ)" vs.
"((jiffies - start_time) * 1000) / HZ." Just think that HZ is 1024 on
some platforms...

Assorted small ide-cd fixes, found and fixed by Andy Polyakov
<appro@fy.chalmers.se>.

- CHECK_CONDITION really wants to be SAM_STAT_CHECK_CONDITION, the damn
  bit shift by one bit again

- Set sense_len correctly

- Do post_transform() on the right buffer.

From: Milton Miller <miltonm@bga.com>

Fix two problems related to list_head's (there are more, wip).
Second bug was uncovered by wli's list_head debugging patch, thanks wli!

- Remove ata_unused list and use &idedefault_driver->drives only,
  fixes list corruption (ata_unused will be later ressurected for hotplug).

- Do not add same device twice to &idedefault_driver->drives, triggered
  by first calling ide_unregister_subdriver() and later ata_attach().

Since Andries killed ide-geometry, remove "hdX=noremap"
parameter as it is no longer needed.

Allow a user to mark a device as for scsi
emulation at boot even with modular scsi/ide-scsi.
(from 2.4 patch by Matan Ziv-Av)

into kroah.com:/home/greg/linux/BK/gregkh-2.5

Linux 2.5.69-bk18 prints something strange to the kernel log when the USB
scanner is attached.  It turns out drivers/usb/image/scanner.c uses
uninitialized variable "name" in probe_scanner() in the printk() call.
That means that random memory is read and output to the kernel log.

Until my ambitious project gets going, this patch at least fixes the
problem of assigning a device's new address following a device reset.
The only change needed to David's original suggestion was to handle the
pathway involved in registering root hubs.

into shaggy.austin.ibm.com:/shaggy/bk/jfs-2.5

This is needed, as the file was deleted over a year ago...

into home.transmeta.com:/home/torvalds/v2.5/linux

into home.transmeta.com:/home/torvalds/v2.5/linux

From: Herbert Xu <herbert@gondor.apana.org.au>

This patch adds a pair of missing quotes.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

If writev() is passed a vector in which the second or later segment generates
a fault it will currently return -EFAULT.

It shouldn't.  It should write what it can and return the number of bytes
which were successfully copied.

Fix that up by writing the partial result and then returning the right value.

From: Neil Brown <neilb@cse.unsw.edu.au>

Extract ->stamp from skb *before* freeing it in svcsock.c

As we sometime copy and free an skb, and sometime us it in-place, we must
be careful to extract information from it *before* it might be freed, not
after.

Manfred's page-unmapping debug patch found this one.

From: Jes Sorensen <jes@wildopensource.com>

This is patch which provides support for 64 bit address allocations from
pci_alloc_consistent(), based on the address mask set through
pci_set_consistent_dma_mask().  This is necessary on some platforms which
are unable to provide physical memory in the lower 4GB block and do not
provide IOMMU support for cards operating in certain bus modes, such as
PCI-X on the SGI SN2.

The default mask for pci_alloc_consistent() is still 32 bit as there are 64
bit capable hardware out there that doesn't support 64 bit addresses for
descripters etc.  Likewise, platforms which provide IOMMU support in all
bus modes can ignore struct pci_dev->consistent_dma_mask and just return a
32 bit address as before.

The patch also includes changes to tg3.c to make it use the new api as well
as a documentation update.  I have done my best on the documentation part,
if anyone feel the can make my scribbles clearer, please do.

Thanks to Dave Miller, Grant Grundler, James Bottomley, Colin Ngam, and
Jeremy Higdon for input and code/documentation portions.

Replace

	rtnl_lock();
	register_netdevice(dev);
	rtnl_unlock();

with the equivalent

	register_netdev();

in numerous places.

The NR_OPEN check in F_DUPFD is unneeded.  viro says:

"We check the limits in locate_fd() (called by dupfd()).  Check for NR_OPEN
can (and should) be dropped - locate_fd() will never go beyond that
(expand_fd() will check it and refuse to go).

"IOW, simply lose the check.  We _might_ want to check signedness, but that's
it (IOW, check that arg will fit into 0..MAX_INT; second argument of dupfd()
is an int).  OTOH, we might actually make dupfd() et.al.  take unsigned long
and kill that crap completely."

And indeed, the signedness is suspicious, so make various things in there
unsigned too.

I'm not sure why I used igrab() in unlink().  igrab takes the oft-taken
inode_lock.

The caller has a ref, so a simple increment of i_count will suffice.

- set the number of pages to be written to "1".

- Don't test PG_writeback twice.

From: Andy Whitcroft <apw@shadowen.org>

There's a spot in i2o where we deliberately leak some memory when the
hardware plays up.  The alternative is to let the hardware scribble on it at
some unknown time in the future.

Things like the Stanford checker keep alleging that this is a bug.  So shut
them up with a comment

All we're doing in there is writing things into the inode.  I see no need for
the lock_kernel().

And holding lock_kernel() across mark_inode_dirty() hurts on big SMP.

From: Andi Kleen <ak@suse.de>

The logic is: the global variable is set to the magic value
IRQBALANCE_CHECK_ARCH.  It can be overwritten by a __setup function.  If
the magic value is still set when the irq balancer is started it asks the
subarchitecture using the NO_BALANCE_IRQ macro.  This is defined to a
genapic field in the generic architecture, otherwise constant.  Then the
global variable is set and when it is true no balancing happens.

Previously I had this wrong in that it always disabled it.

This part should be correct, but it still doesn't seem to work.

(I left the printk in there until the problem is debugged, could be removed
of course)

From: Hollis Blanchard <hollis@austin.ibm.com>

Fix a user pointer deref, found by the Stanford checker.

From: Manfred Spraul <manfred@colorfullife.com>

three build fixes for CONFIG_PROC_FS=n:

include/linux/procfs.h:

 - add missing proc_pid_unhash, proc_pid_flush declarations.  static
   inline functions that do nothing.

 - move semicolons around for kclist_{add,del}.  gcc-3.2.2 doesn't like
   the current syntax.

drivers/net/pppoe.c:

 - proc_net doesn't exist if CONFIG_PROC_FS=n.

drivers/scsi/scsi_priv.h:

 - add missing brackets to macro definition.