From: John Rose <johnrose@austin.ibm.com>

Fixed NULL ptr deref in RTAS syscall ppc_rtas()

From: John Rose <johnrose@austin.ibm.com>

Added rtas_set_power_level()

From: Anton Blanchard <anton@samba.org>

Remove pci DMA exports we now access them via inline functions that
operate on pci_dma_ops.

From: Stephen Rothwell <sfr@canb.auug.org.au>

Dont enable interrupts during interrupt processing on iseries

From: Jake Moilanen <moilanen@austin.ibm.com>

In xics_get_irq(), for a real-to-virt irq lookup, go down the
slowpath by looking through the entire virt_irq_to_real_map array
if take a miss on the radix tree.  This is possible, when an
interrupt is taken before the driver has called request_irq() (eg IDE).

From: Anton Blanchard <anton@samba.org>

- export find_next_bit and move the other exports here
- fix a few minor style issues

From: Anton Blanchard <anton@samba.org>

update iseries default target

From: Stephen Rothwell <sfr@canb.auug.org.au>

After this the only iSeries specific EXPORT_SYMBOLS in ppc_ksyms.c are
the assembler ones ...

From: Dave Boutcher <boutcher@us.ibm.com>

Add some functions to make vio.h consistant with pci_dma.h and dma_mapping.h

From: Anton Blanchard <anton@samba.org>

- Merge some whitespace differences with the ameslab tree
- We check for CPU_MASK_ALL in xics to send irqs to all cpus.
  In some cases CPU_MASK_ALL is smaller than the cpumask (eg
  NR_CPUS == 32 and cpumask is a long), so we mask it here to
  be consistent.

From: Linas Vepstas <linas@austin.ibm.com>

This patch fixes multiple EEH-related bugs:

 - Fixes the eeh_check_failure() usage in an interrupt context.
   This routine is now safe to use in an interrupt. The fix was to
   build a cache of IO addresses and check that, instead of using
   the pci routines.
 - Merges in Olof Johansson's sizeof patch when checking for failure
 - Adds EEH tests to array/string reads
 - Fixes bugs with address resolution (some i/o addresses were handled
   incorrectly, resulting in EEH errors slipping by undetected.)
 - Adds EEH support to the PCI Hotplug system (so that devices that
   get added/removed get properly registered with the EEH subsystem.)
 - Fixes improper use of /proc filesystem.
 - Adds some misc statistics.

While merging Linas' patch I also converted the proc usage to
seq_single, used per cpu variables for the stats and removed the
eeh-force-off option.

From: Linda Xie <lxiep@us.ibm.com>

The changes in this patch are for multifunction cards insertions/removals
and  bug fixes:

1. fix up new nodes' linux_phandle field.
2. new nodes' phb, devfn(and so on) need to be fixed even the nodes don't
	have "interrupts".
3. change of_remove_node to non-recurisve func. The recursions will be done
	by the caller.
4. add a new function -- of_finish_dynamic_node_interrupts()

From: Anton Blanchard <anton@samba.org>

Add some missing EXPORT_SYMBOLs

From: Santiago Leon <santil@us.ibm.com>

Handle longbusy return codes in IBM VETH driver

From: Dave Boutcher <boutcher@us.ibm.com>

Add hypervisor busy return codes

From: Stephen Rothwell <sfr@canb.auug.org.au>

Make dma API handle PCI and VIO

From: Anton Blanchard <anton@samba.org>

Remove some unused ppc64 variables

From: Anton Blanchard <anton@samba.org>

Remove bogus sys_oldumount sign extension code. We were sign extending
the flags argument which doesnt make sense.

From: Anton Blanchard <anton@samba.org>

Reduce stack overflow check to 4096 bytes free, we were tripping it
too much at 8192.

From: Rick Lindsley <ricklind@us.ibm.com>

Fix bug #2230.

I've corresponded with the submitter and he did find a real bug -- when we
were merging I/O requests we didn't always take the oldest request start
time, which would cause a couple of the calculations like wait time and
average queue size to be too small.  He found it mathematically but having
done so, I think logic and inspection makes it easy to verify.

On a really small memory machine (or one with a monstrous kernel memory leak)
we can end up calling blk_congestion_wait() before the waitqueue_heads are set
up.

From: Matt Mackall <mpm@selenic.com>

This piece of the THREAD_SIZE cleanup got dropped.  If you make THREAD_SIZE
> 8k, the init thread overlaps the .init section and gets smashed.  I've
gone ahead and killed INIT_THREAD_SIZE throughout as it wasn't doing much.
This also saves 4k when we use 4k stacks.  Please apply.  Couple more minor
pieces remaining.

keventd and friends are currently holding /dev/console open three times.
It's all inherited from init.

Steal the relevant parts of daemonize() to fix that up.

From: Manfred Spraul <manfred@colorfullife.com>

print_objinfo() dumps the first few characters of an interesting object for
debugging.  It used the wrong object len (including debug padding, instead
of just the data area), which could cause an oops if DEBUG_PAGEALLOC is
enabled.

From: Manfred Spraul <manfred@colorfullife.com>

There are a few unchecked do_munmap()s in the shm code.  Manfred's comment
explains why they are OK.

From: BlaisorBlade <blaisorblade_spam@yahoo.it>, and me

- remove unused `file *' arg from do_write_mem()

- Add checking for copy_from_user() failures in do_write_mem()

- Return correct value from kmem writes() when a fault is encountered.  A
  write()-style syscall's return values are:

   0 when nothing was written and there was no error (someone tried to
   write zero bytes)

   >0: the number of bytes copied, whether or not there was an error.
   Userspace detects errors by noting that the write() return value is less
   than was requested.

   <0: there was an error and no bytes were copied

From: Chris Mason <mason@suse.com>

reiserfs can safely use the generic fs aio functions.

From: Chris Mason <mason@suse.com>

reiserfs_file_write() can use stale metadata after a schedule.

Two reiserfs_file_write bugs, where items can change during a schedule.

From: Chris Mason <mason@suse.com>

Make sure reiserfs uses a reasonable number when restarting long unbounded
transactions (creating holes or deleting files).

Without this patch, the number of blocks requested grows with each
transaction restart, until it hits MAX_BATCH_COUNT and starts forcing
commits with every new transaction.

Oleg Drokin tracked this bug down

From: Chris Mason <mason@suse.com>

Fix a bug in reiserfs search_by_key call, where it might not properly
detect a change in tree height during a schedule.  Originally from
vs@namesys.com

From: Chris Mason <mason@suse.com>

Add conditional schedules to reiserfs to help lower latencies.  Bits of
this orginated long ago in code akpm sent me.

From: Chris Mason <mason@suse.com>

From: Jeff Mahoney <jeffm@suse.de>

fsstress manages to setup a sequence of events that allow an attempt to
perform direct-io on a tail.  bh_result->b_page == NULL, which causes the
PageLocked and PageWriteback checks to perform a NULL deref, causing the
oops.

From: Michael Still <mikal@stillhq.com>

This is needed to get any of the SGML documentation to build with 2.6.4.

From: James Simmons <jsimmons@infradead.org>

This patch merges two of the drawing functions.  The patch uses aligned
transfers when possible even on displays where the characters are not byte
align.  Tested on my my laptop for 12 bit width fonts and 8 bit wide fonts.
It works very nicely.

There's no point in calling mark_page_accessed() here.  The page is never on
the LRU so all mark_page_accessed() will do is to set PG_referenced, which we
immediately clear again.

Add a debug check for workqueues nested more than three deep via the
direct-run-workqueue() path.

Because keventd is a resource which is shared between unrelated parts of the
kernel it is possible for one person's workqueue handler to accidentally call
another person's flush_scheduled_work().  thockin managed it by calling
mntput() from a workqueue handler.  It deadlocks.

It's simple enough to fix: teach flush_scheduled_work() to go direct when it
discovers that the calling thread is the one which should be running the
work.

Note that this can cause recursion.  The depth of that recursion is equal to
the number of currently-queued works which themselves want to call
flush_scheduled_work().  If this ever exceeds three I'll eat my hat.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch fixes a bug in the SELinux compute_av code; the current code
yields the right access computation but can cause unnecessary (but
harmless) processing to occur when transition permission wasn't granted in
the first place by the TE configuration.  Thanks to Chad Hanson of TCS for
reporting the bug.

From: Sam Ravnborg <sam@ravnborg.org>

modpost or to be more specific sumversion.c was not behaving correct when
used with O= and MODULE_VERSION was used.  Previously it failed to use
local .h when calculation the md-sum in case of a O= build.

The following patch introduces the following:

- A generic get_next_line()

- Check that the topmost part of the directory matches

- Using strrch when checking for file with suffix .o

- Use NOFAIL for allocations in sumversion

- Avoid memory leak in new_module

The generic get_next_line will pay off when Andreas implmentation of
storing symbol addresses in a seperate file is introduced.

From: Arnd Bergmann <arnd@arndb.de>

The recent "fbdev: monitor detection fixes" patch broke modular frame
buffer drivers.