The current code has a subtle race where 2 hash PTEs can be inserted
for the same virtual address for a short period of time. There should
not be a stale one as the "old" one ultimately gets flushed, but the
architecture specifies that having two hash PTE is illegal and can
result in undefined behaviour.

This patch fixes it by never clearing the _PAGE_HASHPTE bit when
doing test_and_clear_{young,dirty}. That means that subsequent faults
on those pages will have a bit more overhead to "discover" that the
hash entry was indeed evicted.

It also adds a small optisation to avoid doing the atomic operation
and the hash flush in test_and_clear_dirty when the page isn't dirty
or when setting write protect while it's already set.

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

The new message queue interface needs the following patch to get it working
on s390 (31-bit, 64-bit and 31-bit compat).

From: Martin Schwidefsky <schwidefsky@de.ibm.com>

This patch adds the TIF_SYSCALL_AUDIT option to the s390 ptrace interface.

From: Andi Kleen <ak@suse.de>

Add POSIX mqueue support to x86-64.

From: Jan Kara <jack@ucw.cz>

Journalled quota support for ext3: The patch consists of two parts - ext3
changes and changes in generic quota code.  The main idea of the changes is
that a transaction is always started before any operation which changes quota
file and dirtifying of the quota causes its write to disk.  These two changes
assure that quota change is journalled into the same transaction as the file
change and hence after journal replay quota is consistent with the filesystem
state.  As during journal replay inodes from orphan list are deleted/truncated
we have to do quota_on before the replay of the orphan list - this problem is
solved by additional mount options to ext3 with quota file names and format.

Some changes in generic code were also needed to assure that quota structure
in file is always allocated and so ordinary quota operations (like
adding/deleting a block/inode) need only a few blocks from the transaction.

From: Chris Wright <chrisw@osdl.org>

SUSv3 doesn't seem to specify one way or the other.  I don't have the POSIX
specs, and the old docs I have suggest that mq_open() creates an object
which is to be closed upon exec.

Jakub said:

  I think it is valid and required:

    http://www.opengroup.org/onlinepubs/007904975/functions/exec.html

    All open message queue descriptors in the calling process shall be
    closed, as described in mq_close()

  I'll add a new test for this into glibc testsuite.

Fix various bogons and outright lies.

From: Jakub Jelinek <jakub@redhat.com>

	mq_notify (q, NULL)

and
	struct sigevent ev = { .sigev_notify = SIGEV_NONE };
	mq_notify (q, &ev)

are not the same thing in POSIX, yet the kernel treats them the same.  Only
the former makes the notification available to other processes immediately,
see

	http://www.opengroup.org/onlinepubs/007904975/functions/mq_notify.html

Without the patch below,

	http://sources.redhat.com/ml/libc-hacker/2004-04/msg00028.html

glibc test fails.

I looked at mq in Solaris and they behave the same in this regard as Linux
with this patch.  Kernel with this patch passes both Intel POSIX testsuite
(with testsuite fixes from Ulrich) and glibc mq testsuite.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into redhat.com:/spare/repo/net-drivers-2.6

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Patch from Deepak Saxena

Supersedes 1809/1

This adds support for the AMBA PL011 UART primecell, and moves the
existing AMBA UART support to indicate it covers the AMBA PL010
primecell.

Some TI cardbus bridges found in notebooks and PCI add-on cards are
uninitialized.  This means the interrupt mode and the interrupt routing
is wrong in most cases, ending up in non working PCI interrupts.

This makes the TI Yenta driver probe the PCI interrupt and adjust the
interrupt setting if no interrupts are delivered.  It's done in a safe
way, that doesn't hurt working setups.

Function 1 on two slot devices is handled differently from function 0
since both share the settings.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Patch from Deepak Saxena

Okay, now while we are at fixing security holes, is there any chance we
can _finally_ get the attached patch in?

The Vicam USB driver in all Linux Kernels 2.6 mainline does not use the
copy_from_user function when copying data from userspace to kernel space,
which crosses security boundaries and allows local users to cause a denial
of service.

Already ACKed by Greg. Only complaint was inproper coding style which is done
with attached patch ;)

ciao, Marc

The directory .tmp_versions/ was deleted during make vmlinux.

This eliminated the list of modules used for moudles_install.
The effect was that the following scenario failed:

	make
	make install
	make modules_install

The solution is to only cleanup .tmp_versions when building modules.

into kroah.com:/home/greg/linux/BK/i2c-2.6

This one line patch fixes voltage rounding in the asb100 chip driver.
It's very similar to a patch I submitted for the lm80 a few days ago.

into kroah.com:/home/greg/linux/BK/usb-2.6

Corrects isapnp_read_resources so that it gets MEM32 information properly.

This patch prevents /proc/bus/pnp/devices from requesting on-boot node
information.  Dynamic information is used instead.

The ASUS p4p800 motherboard's BIOS has a broken PnPBIOS implementation.  This 
patch will disable PnPBIOS support if this hardware is detected by DMI.

This patch ensures the proper count is returned in pnp_set_current_resources.

This patch fixes a bug in pnp_auto_config_dev in which it wouldn't always report 
allocation failures.  It also corrects the return codes.

This patch fixes the unknown tag warning by adding support for the asci text 
tag.

The RCU code was missing cpus_empty() in one place, required with large
cpumasks.

Fix a corruption bug, we were copying too much information back off
the signal frame.

While in the area help with gccs sign extension optimisation problems
and convert some things to long. (Saves about 30 instructions in signal.c)

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Merged in 2.4, and various vendor kernels..

  iDefense reported a buffer overflow flaw in the ISO9660 filesystem code.
  An attacker could create a malicious filesystem in such a way that they
  could gain root privileges if that filesystem is mounted. The Common
  Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name
  CAN-2004-0109 to this issue.

Ernie Petrides came up with the following patch which I fixed up a slight
reject in to apply to 2.6. Otherwise, unchanged from the 2.4 patch.

I just want to explain the changes I've made, since I tried to adhere to the
more organized structure in the 2.6 visor module to incorporate my changes.

I didn't want to pollute this with some ugly hack.

I created a new device id table with name clie_id_5_table to cleanly separate
the UX50/TH55 from the rest.

Along with this I added a new usb_serial_device_type which is essentially a
copy of handspring_device but has its own attach function.

This new attach function ( clie_5_attach ) will do the actual magic.

I think it is justified to introduce a new type ( which I called clie_5 )
since I suspect that Sony is intentionally changing the interface spec ( As
it has done so in the past ). I dare to predict that we will see more clie
devices coming this year which will require this new attachment procedure. At
the moment I am only aware of the UX50 and TH55 to implement that weird
configuration.

Hi Greg, this patch bumps the speedtouch driver's version number.
It also adds the version number to the module description, so people
can see it with modinfo.  I also added a MODULE_VERSION line (why?
because it was there...)  The patch is against your 2.6 kernel tree.