Rusty Russell <rusty@rustcorp.com.au>: Oh, I feel so violated...:
  <sniff>

  This patch against 2.5.19 gets rid of some bogus casts in ide-cd.c
  In my opinion the casts as is are bugs waiting to happen.

  I found that 'max' pointer is not updated in proc_dointvec_minmax()
  and proc_doulongvec_minmax(), when I write smaller values than min to
  /proc/sys entry (and val<*min++ check becomes true.)
  This may lead to min/max checking of values with bogus maximum.

  Unrelated to my first dcache patch, this is something more crucial
  and should be applied first.

  fs/dcache.c:
   - handle d_alloc() returning NULL.

  Attached is a really trivial patch that changes an "unknown" PCI_DEVICE_ID
  0x3112 to PCI_DEVICE_ID_VIA_8361 in drivers/pci/quirks.c .

  It applies cleanly to 2.5.18 and 2.4.19-pre8.

  There is more of this janitorial work to come (eg General setup). I'm just
  piecemealing it

  [ Made applicable with -p1 by Rusty ]

  nlma fixes a call to netlink_broadcast with GFP_KERNEL ( passed to
  skb_clone ) while we are in_interrupt() ( catched by a BUG() in
  slab.c:1109 ).

  Missing include of asm_io.h in mm_bootmem.c:
  Submitted this trivial patch on May 14, but nothing has happened yet.
  Perhaps better chance if you took care of it.

  It's needed by phys_to_virt() but it happens to work on i386 etc.
  since dma.h includes io.h for that arch.

The following has been vetted with davem w.r.t. the change to
KM_SKB_DATA. Apologies for the bug...

include/asm-*/kmap_types.h:
   Replace the unused km_type slot KM_SKB_DATA with
   KM_SKB_SUNRPC_DATA.

net/sunrpc/xdr.c:
   Replace the use of KM_USER0 with KM_SKB_SUNRPC_DATA for copying
   data from an skb into the page cache when in the sk->data_ready()
   callback.

Fix queue plug locking.

This fixes two shift warnings on 64 bit archs.

  oom-loop fixes error handling after a netlink failure - it does not do a
  cleanup and it makes every next call to ip_fw_check to detect a
  loop and drop the packet.

into penguin.transmeta.com:/home/penguin/torvalds/repositories/kernel/linux

Looks like sys_sysinfo has not been touched in years.  Among other
things, it uses a global cli() for protection; I switched it to an
existing rwlock.  I also pulled it out of info.c and stuck it in timer.c
(I choose timer.c because it shares dependencies there already).

The details:

        - move sys_sysinfo to kernel/timer.c from kernel/info.c:
          why one small syscall got its own file is beyond me.

        - delete kernel/info.c

        - stop the global cli!  now grab a read_lock on xtime_lock.
          this is safe as we moved the write_unlock on xtime_lock
          down one line to cover the calculating of avenrun.

        - trivial code cleanup

The attached patch cleans up some per-CPU code in arch/i386/kernel/smp.c
that could be problematic under preemption.

The first I solve with the new get_cpu interface, for the second two I
explicitly disable preemption.  I also changed 1 to 1UL in the shift to
properly match the type.

Might as well make it explicit...

Patch is against 2.5.20, please apply.

	Robert Love

Resend of trivial bits from my scheduler tree...:

        - shift cpu by 1UL not 1 to match type
        - clarify various comments
        - remove the barrier from preempt_schedule.  This was here
          because I used to check need_resched before returning from
          preempt_schedule but we do not now (although should).  The
          barrier insured need_resched and preempt_count were in sync
          now and after an interrupt that could occur.

I started looking into a couple FIXMEs in kernel/capability.c and I
ended up with a fairly largish patch (although not quite so many changes
to object code).

First, it is unsafe to touch task->cap_* while not holding
task_capability_lock.  The most notable occurrence of this is sys_access
which saves the current cap_* values, changes them, does its business,
then restores them.  In between all this they can change and then be
restored to old values.  Unfortunately we cannot just grab the lock here
since the function can sleep - I marked this with a FIXME for now.

Second, I formalized the locking rules with task_capability_lock.  I
declared the lock in include/linux/capability.h so other code can grab
it.

Finally, there is a whole boatload of code cleanup:

        - remove conditional locking/unlocking - that is just gross
        - don't pointlessly grab the read_lock twice
        - add/remove/edit comments
        - change some types (int -> pid_t, etc)
        - static inline two small functions that are called only
          once each
        - remove two FIXMEs
        - general code cleanup for readability and performance

TODO:

        - fix sys_access and other cap_* accesses
        - do something about the annoying oddball 5-space indentation
          in kernel/capability.c !!

Patch is against 2.5.20, please apply.

        Robert Love

This patch removes the whole wq_lock_t abstraction, forcing the behavior
to be that of a standard spinlock and changes all the wq_lock code in
the tree appropriately.

Removes lots of code - always a Good Thing to me.  New behavior is same
as previous behavior (USE_RW_WAIT_QUEUE_SPINLOCK unset).

 - Remove last parameter from ide_dump_status. This information is now
   permanently present in device->staus field, so there is not need to pass it
   around.

 - Patch for DVD read through ide-scsi. There is the possibility that we can get
   request structures passed down, which don't have the queue field set.
   At lest on the BIO code path this seems to be something worth further
   investigation. Found by Adam J. Richter. (Jens?)

 - Revert my change to the hostdata handling. I did get it wrong about the way
   host structures are allocated by the generic SCSI layer. It plays
   tricks there.

 - piix driver updates by Vojtech Pavlik.

 - We have a ata_out_regfile, so we should have ata_in_regfile too.

Fix namespace clash with proc stuff an compilation warnings.

    
Add "drop_inode" VFS interface to make FS operations cleaner
and race-free.  Remove old force_delete interface, and update
filesystems that used it to use the new infrastructure.

drivers/cdrom/*
drivers/char/*

	Fix some copy_{to,from}_user and {put,get}_user error handling,
        get rid of some verify_area, copy_{to,from}_user already checks for errors.

into home.transmeta.com:/home/torvalds/v2.5/linux

explicitly.

 - Remove DEVICE_INTR and associated code from floppy driver.

 - Savlage s390 xpram code from kernel version dependant compilation disease.

 - Eliminate SET_INTR code from the places where it was used.

 - Eliminate bogous support for multiple sbpcd controllers. The driver didn't
   even compile right now before we could think about further supporting it at
   all we have to get rid of this hack first.
   Don't call invalidate_buffers in the release method there.
   Why should it be necessary?

 - Resurrect sonycd535 compilation.

 - Let CURRENT request macro use the same primitive at the remaining QUEUE macro
   in blk.h, which is still not quite right, but first things first :-).

Makes minixfs, sysvfs and ufs understand `mount -o dirsync'.

Fixes a pet peeve: the identifier "flushpage" implies "flush the page
to disk".  Which is very much not what the flushpage functions actually
do.

The patch renames block_flushpage and the flushpage
address_space_operation to "invalidatepage".

It also fixes a buglet in invalidate_this_page2(), which was calling
block_flushpage() directly - it needs to call do_flushpage() (now
do_invalidatepage()) so that the filesystem's ->flushpage (now
->invalidatepage) a_op gets a chance to relinquish any interest which
it has in the page's buffers.

A patch from Hugh Dickins which fixes a couple of error-path leaks
related to tmpfs (I think).

Also fixes a yield()-inside-spinlock bug.

It also includes code to clear the final page outside i_size on
truncate.  tmpfs should be returning zeroes when a truncated file is
later expanded and it currently is not.

Hugh is taking care of the 2.4 fix for this.

Replaces SetPageDirty() with set_page_dirty() in several places related
to in-memory filesystems.

SetPageDirty() is basically always the wrong thing to do.  Pages should
be moved to the ->dirty_pages list when dirtied so that writeback can
see them.

Without this change, dirty pages against in-memory filesystems would
churn around on the inactive list all the time, rather than getting
pushed away onto the active list.  A minor efficiency thing.

Fixes a race between unlink and writeback: on the sys_sync() and
pdflush paths the caller does not have a reference against the inode.

So run __iget prior to dropping inode_lock.

Oleg Drokin reported this and seems to believe that it fixes the
crashes he was observing.  But I was never able to reproduce them..

Fixes a few lock ranking bugs (and deadlocks) related to
swap_list_lock(), swap_device_lock(), mapping->page_lock and
mapping->private_lock.

- Cannot call block_flushpage->try_to_free_buffers() inside
  mapping->page_lock.  Because __set_page_dirty_buffers() takes
  ->page_lock inside ->private-lock.

- Cannot call swap_free->swap_list_lock/swap_device_lock inside
  mapping->page_lock because exclusive_swap_page() takes ->page_lock
  inside swap_info_get().


The patch also removes all the block_flushpage() calls from the swap
code in favour of a direct call to try_to_free_buffers().

The theory is that the page is locked, there is no I/O underway, nobody
else has access to the buffers so they MUST be freeable.  A bunch of
BUG() checks have been added, and unless someone manages to trigger
one, the "block_flushpage() inside spinlock" problem is fixed.

Give swapper_space a ->set_page_dirty() address_space_operation.

So swapcache pages do not need special-casing in
set_page_dirty_buffers().

Turn on direct-to-BIO writeback for ext3 in data=writeback mode.

block_symlink() is not a "block" function at all.  It is a pure
pagecache/address_space function.  Seeing driverfs calling it was
the last straw.

The patch renames it to `page_symlink()' and moves it into fs/namei.c

Remove i_wait from struct inode and hash it instead.

This is a pure space-saving exercise - 12 bytes from struct
inode on x86.

NFS was using i_wait for its own purposes.  Add a wait_queue_head_t to
the fs-private inode for that.  This change has been acked by Trond.