This patch has two small fixes for issues that people
reported to me yesterday:

  - One of the out-of-tree drivers sees odd things
    happening when dma chaining is enabled.  (The
    in-tree drivers seem fine with it.)  So disable
    for now; it's easily enabled if needed.

  - Zero Length Packets (ZLPs):

     * Should now read/write ok with PIO.

     * On DMA endpoints, explicit ZLPs need PIO.
       Until they do, don't allow queuing zero length
       buffers onto DMA endpoints.

If the host writes OUT packets using URB_ZERO_PACKET
(or its analogue on other USB host systems), then the
loopback configuration should set req->zero, to use that
same transfer termination policy when it writes the
response back IN to the host.

> can you get rid of all of the #ifdef HAVE_DRIVER_MODEL stuff?

Done.  Now this code "knows" it's running in a 2.5
environment, and needs modifications to run on 2.4.

I also changed the file modes in the module_parm()
calls so the parameters will be writable when they
eventually show up in sysfs; and fixed a typo.

Compile-tested with and without DEBUG enabled.

This patch adds kconfig/kbuild support for the preceding
code, so that an EXPERIMENTAL option appears in the
USB part of the config menus.

Once a USB device controller driver is configured (which
just now means net2280, but sa11x0 and pxa25x options
are just waiting for updates!), gadget driver options
are also available.

This adds utility code that gadget drivers can use to manage
string descriptors (drivers/usb/gadget/usbstring.c) in the
common case that the ISO-8859/1 character set is in use.

Both "Gadget Zero" and the Ethernet gadget code use this.

This patch adds an "Ethernet Gadget" driver, implementing
the CDC Ethernet model (drivers/usb/gadget/ether.c).

It interops with the current CDC Ether drivers on Linux,
both 2.4 (CDCEther, using Marcelo's latest) and 2.5
(cdc-ether with recent patches, or on 2.5.68 "usbnet")

On a net2280, this has successfully streamed dozens of
megabytes per second using "ttcp" (high speed, and using
"usbnet" on the host side), for days at a time.  And no
problems using SSH/NFS/etc in lighter duty testing.

It's possible this will need tweaking to cope with UDC
bugs on Intel's pxa25x controllers, presenting itself
as a non-CDC device. (I'm told altsettings are even
more broken than originally specified to be.)

This patch adds "Gadget Zero" (drivers/usb/gadget/zero.c).

Gadget Zero is a simple gadget driver that's useful for
testing controller drivers, and as an example to be used
for clone/modify style development.

This driver implements two configurations, and needs only
two bulk endpoints (in addition to ep0) ... so pretty much
any USB device controller should be usable with it in
one configuration or another.  It (optionally) supports
high speed devices, and has passed the USB-IF "chapter 9"
device model conformance tests.

It's worth noticing the kinds of hardware differences that
gadget drivers need to cope with.  Endpoints differ, in
ways that must be reflected various ways in descriptors.
And sometimes chip errata cause interoperability problems;
for example, an sa1100 can't change configurations after
enumerating.

This patch creates drivers/usb/gadget/net2280.[hc],
providing a driver for NetChip's "Net2280 PCI USB 2.0
High Speed Peripheral Controller".

It implements the API included in the first patch.

The driver has behaved well with chiprev 0100 under
stress tests with Gadget Zero and the ethernet model
driver, and has passed sanity tests for chiprev 0110.

This patch createss <linux/usb_gadget.h>, the gadget API
and inlined implementation.

There's additional kerneldoc, which I won't submit at
this time, available.

From: Grzegorz Jaskiewicz <gj@pointblue.com.pl>

gcc-2.94 fails to compile this code, alleging an invalid lvalue.
An equivalent transformation fixes it up.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch against 2.5.69 adds a security_inode_post_setxattr hook so that
security modules can update the inode security structure after a successful
setxattr, and it moves the existing security_inode_setxattr hook call after
the taking the inode semaphore so that atomicity is provided for the
security check and the update to the inode security structure.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch against 2.5.68 implements an xattr handler for ext2 to support the
use of extended attributes by security modules for storing file security
labels.  As per the earlier discussion of extended attributes for security
modules, this handler uses a "security." prefix and allows for per-module
attribute names.  Security checking on userspace access to these attributes
can be performed by the security module using the LSM hooks in fs/xattr.c,
and the security module is free to internally use the inode operations
without restriction for managing its security labels.  Unlike the trusted
namespace, these labels are used internally for access control purposes by
the security module, and controls over userspace access to them require finer
granularity than capable() supports.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch against 2.5.68 implements an xattr handler for ext3 to support the
use of extended attributes by security modules for storing file security
labels.  As per the earlier discussion of extended attributes for security
modules, this handler uses a "security." prefix and allows for per-module
attribute names.  Security checking for userspace access to these attributes
can be performed by the security module using the LSM hooks in fs/xattr.c,
and the security module is free to internally use the inode operations
without restriction for managing its security labels.  Unlike the trusted
namespace, these labels are used internally for access control purposes by
the security modules, and controls over userspace access to them require
finer granularity than capable() supports.

From: Stephen Smalley <sds@epoch.ncsc.mil>

This patch moves the security_d_instantiate hook calls in d_instantiate and
d_splice_alias after the inode has been attached to the dentry.  This
change is necessary so that security modules can internally call the
getxattr inode operation (which takes a dentry parameter) from this hook to
obtain the inode security label.

From: Christoph Hellwig <hch@infradead.org>

Originally by David Mosberger, testing by Roger Luethi.  From the ia64 tree.

Basically, it avoids going to memory all the time.  What this does is make
life a lot easier for gcc, so it can actually do a decent amount of
optimization.  The restructuring clearly is less important for out-of-order
CPUs, but even there it gives some benefits.

More specifically, the loop is now structured to operate one "unsigned long"
at a time, rather than one bit at a time.  Of course, you still need to
process all the bits, but most of the relevant state in the inner loop can be
kept in registers.

Roger Luethi measured the routine on a bunch of different machines (mostly
x86, IIRC: P5, P6, Crusoe, Athlons) and performance improved there, too (and
it should definitely improve performance on any RISC-like architecture).


Roger's benchmarking results (vs number of fd's):

                                       File                   TCP
Numbfer of fd's:                  10   250  500          10   250   500

UP, Pentium MMX 233MHz original	 8.2 108.5 212.8	11.0 180.0 356.5
UP, Pentium MMX 233MHz w/patch	 7.4  87.6 171.1	10.4 163.6 323.4

MP, Pentium MMX 233MHz original	15.7 283.8 562.8	18.9 354.4 705.5
MP, Pentium MMX 233MHz w/patch	14.6 255.6 506.5	17.8 332.8 664.1

UP, Athlon 1394 MHz original	 1.3  13.4  26.1	 1.9  24.7  48.6
UP, Athlon 1394 MHz w/patch	 1.2  11.0  21.5	 1.6  22.3  43.8

MP, Athlon 1394 MHz original	 1.6  22.4  44.6	 1.9  30.9  60.5
MP, Athlon 1394 MHz w/patch	 1.5  21.2  41.7	 1.9  30.2  59.6

Ed Tomlinson has a machine on which some other device grabs IRQ12 first, and
the 8042 doesn't work.  Enabling shared iRQs in the 8042 driver fixes it up.
Alan has confirmed that this is OK.

From: Dipankar Sarma <dipankar@in.ibm.com>


fget() shows up on profiles, especially on SMP.  Dipankar's patch
special-cases the situation wherein there are no sharers of current->files.

In this situation we know that no other process can close this file, so it
is not necessary to increment the file's refcount.

It's ugly as sin, but makes a substantial difference.

The test is

	dd if=/dev/zero of=foo bs=1 count=1M

On 4CPU P3 xeon with 1MB L2 cache and 512MB ram:

	kernel           sys time     std-dev
	------------     --------     -------

	UP - vanilla     2.104        0.028
	UP - file        1.867        0.019

	SMP - vanilla    2.976        0.023
	SMP - file       2.719        0.026

From: Manfred Spraul <manfred@colorfullife.com>

below is the promised patch for better slab debugging, against 2.5.68-mm4:

Changes:

- enable redzoning and last user accounting even for large objects, if
  that doesn't waste too much memory

- document why FORCED_DEBUG doesn't enable redzoning&last user accounting
  for some caches.

- check the validity of the bufctl chains in a slab in __free_blocks.
  This detects double-free error for the caches without redzoning.

try_to_free_pages() currently fails to notice that it successfully freed slab
pages via shrink_slab().  So it can keep looping and eventually call
out_of_memory(), even though there's a lot of memory now free.

And even if it doesn't do that, it can free too much memory.

The patch changes try_to_free_pages() so that it will notice freed slab pages
and will return when enough memory has been freed via shrink_slab().

Many options were considered, but must of them were unacceptably inaccurate,
intrusive or sleazy.  I ended up putting the accounting into a stack-local
structure which is pointed to by current->reclaim_state.

One reason for this is that we can cleanly resurrect the current->local_pages
pool by putting it into struct reclaim_state.

(current->local_pages was removed because the per-cpu page pools in the page
allocator largely duplicate its function.  But it is still possible for
interrupt-time allocations to steal just-freed pages, so we might want to put
it back some time.)

From: Dave Hansen <haveblue@us.ibm.com>, Bill Irwin

With PAE on, there are only 4 PGD entries.  The kernel ones never change,
so there is no need to copy them when a vmalloc fault occurs.  This was
this was causing problems with the split pmd patches, but it is still
correct for mainline.

Tested with and without PAE.  I ran it in a loop turning on and off 10 swap
partitions, which is what excited the original bug.
http://bugme.osdl.org/show_bug.cgi?id=640

If a swapfile is ftruncated while in use, subsequent swapout will scribble on
the filesystem.

This is a case of root-shoot-foot, but wrecking the fs is a fairly rude
response.  And it's easy to fix: hold i_sem across the life of the swapon.

From: Manfred Spraul <manfred@colorfullife.com>

Real 80386 cpus ignore the write protected bit in the page tables when
running in supervisory mode.  Thus the write protected bit must be checked by
software.  The current implementation does that check during access_ok().
This can result in data corruptions, if kswapd starts a swap-out between the
access_ok and the actual write operation.

To fix this, the patch moves the check from access_ok() into
__copy_to_user_ll(), and redirects all user space writes into
__copy_to_user_ll().  The patch only affects kernels build for 80386 cpus.
Additionally, the patch removes the dead prototypes for __put_user_{1,2,4,8}.

Due to the uninlining of access_ok, the .text segment is now ~ 8 kB shorter.

From: Monchi Abbad <kernel@axion.demon.nl>

I found a mistake in the dvbdev.c file when creating the dvb /devfs files,
it created /dev/dvb/adapter0device0 instead of /dev/dvb/adapter0/device0.
But here is a simple fix.

From: Christoph Hellwig <hch@lst.de>

This is a pretty huge patch, but splitting it doesn't make a lot
of sense..

(USB may still need work)

From: Christoph Hellwig <hch@lst.de>

partition_name() is a variant of __bdevname() that caches results and
returns a pointrer to kmalloc()ed data instead of printing into a buffer.
Due to it's caching it gets utterly confused when the name for a dev_t
changes (can happen easily now with device mapper and probably in the
future with dynamic dev_t users).

It's only used by the raid code and most calls are through a wrapper,
bdev_partition_name() which takes a struct block_device * that maybe be
NULL.

The patch below changes the bdev_partition_name() to call bdevname() if
possible and the other calls where we really have nothing more than a dev_t
to __bdevname.

Btw, it would be nice if someone who knows the md code a bit better than me
could remove bdev_partition_name() in favour of direct calls to bdevname()
where possible - that would also get rid of the returns pointer to string
on stack issue that this patch can't fix yet.

From: Christoph Hellwig <hch@lst.de>

Some people may already have noticed that I've been revamping the devfs API
recently.  The worst offender still left is devfs_register, it's prototype
is:

	 devfs_handle_t devfs_register(devfs_handle_t dir,
		const char *name, unsigned int flags,
		unsigned int major, unsigned int minor,
		umode_t mode, void *ops, void *info)

Of these:

 - dir and flags are always zero
 - the return value is never used
 - info is only used in one driver which doesn't even need it for
   operation
 - umode_t always describes a character device
 - name very often comes from a stack buffer we sprintf'ed into

so obviously we really want a much simpler API instead.  My first draft for
this was:

	int devfs_mk_cdev(dev_t dev, umode_t mode,
		struct file_operations *fops, void *info,
		const char *fmt, ...)

this removes the unused argumens, switches to a proper dev_t for the device
number and allows to directly use a printf-like expression as name, getting
rid of the temporary buffers.

Now Al has reappeared and put the first steps of his CIDR for charater device
on public ftp and we'll soon have a similar lookup object + fops mechanism in
generic code as we already habe for blockdevices, i.e.  the devfs code to
assign fops from an entry will become superflous as generic code already does
it.  That means the fops and info arguments are obsolete before they were
introduced, so I'd like to propose the following API instead:

	int devfs_mk_cdev(dev_t dev, umode_t mode, const char *fmt, ...)

which is much nicer anyway.  The educated reader will notice that this is
exactly the same prototype devfs_mk_bdev has so I'll probably get suggestions
to merge those two into some kind of devfs_mk_node soon.  Personally I don't
like that as character and blockdevices are two really separate entinities
and I'll like to keep them as separate as possible.

Example patch that introduces the API and converts drivers/input attached.

Every driver which calls devfs_mk_cdev (about 50) needs conversion.  Note
that the transition can happen in pieces - devfs_register continues to work
after this patch, it's just the plan to get rid of it in the end.

From: Christoph Hellwig <hch@lst.de>

disk_name() (and hence bdevname()) are now returning devfs-style device names
when devfs is enabled.

This is nice, but these names are very long, and they overflow the 32-char
buffers which these functions use.

The choices are:

a) Use a bigger buffer (increase BDEVNAME_SIZE).

   This might be practical.  But how big?

b) return the name in kmalloced memory, make caller free it up.   Yuk.

c) Add a print_bdevname() thing and intersperse that amongst the printk's.
   This would work.

d) Just print the non-devfs device name.   That's what this patch does.

From: Chris Heath <chris@heathens.co.nz>

This patch fixes the PrintScreen key when CONFIG_MAGIC_SYSRQ is enabled.  It
allows you to use that key normally when Alt is not being pressed.  Patch is
against kernel 2.5.68.

From: Zwane Mwaikambo <zwane@linuxpower.ca>

update pcmcia drivers for new IRQ API

From:  Stewart Smith <stewartsmith@mac.com>

Remove the UPDATE_ATIME() macro, use update_atime() directly.

From: Christoph Hellwig <hch@lst.de>

Change sysrq sync/remount from a magic bdflush hook to proper pdflush
operations.  The sync operation reuses most of the regular sys_sync path now
instead of implementing it's own superblock walking and (broken) local disk
detection, the remount implementation has been moved to super.c, cleaned up
and updated for the last two years locking changes.  It also shares some code
with the regular remount path now.

From: Manfred Spraul <manfred@colorfullife.com>

attached is the promised cleanup/bugfix patch for the slab bootstrap:

- kmem_cache_init & kmem_cache_sizes_init merged into one function,
  called after mem_init().  It's impossible to bring slab to an operational
  state without working gfp, thus the early partial initialization is not
  necessary.

- g_cpucache_up set to FULL at the end of kmem_cache_init instead of the
  module init call.  This is a bugfix: slab was completely initialized,
  just the update of the state was missing.

- some documentation for the bootstrap added.

The minimal fix for the bug is a two-liner: move g_cpucache_up=FULL from
cpucache_init to kmem_cache_sizes_init, but I want to get rid of
kmem_cache_sizes_init, too.

The timer is being initialised too late (in ->open()).  If modprobe fails we
get an uninitialised timer warning.

From: Michael Buesch <fsdeveloper@yahoo.de> and Paul Schroeder.

mwavedd.h needs <linux/wait.h> and smapi.h

- ifdef fix in kmap_types.h (Oleg Drokin)

- remove redundant ext3 inclusions (Burton Windle)

- Fix misidentified warning printk in vmalloc.c

- radeon_cp printk warning fix (Randy Dunlap)

- Update minimum binutils version for the ".incbin" thing in vsyscall.S

- update raw driver to recent module API.

- update my email address

From: Zwane Mwaikambo <zwane@linuxpower.ca>

There was a 2.4 merge from Alan Cox, but a few #ifdef's got shuffled around
in the process, resulting in a broken build for !CONFIG_PM

From: Andi Kleen <ak@muc.de>

This driver was bogusly relying on the dropping of the __exit section at link
time.  cpia_exit() is calling proc_cpia_destroy(), which doesn't even exist
if !CONFIG_MODULE.

From: Andi Kleen <ak@muc.de>

Some configs didn't link anymore because they got references from
.altinstructions to __exit functions.  Fixing it at the linker level is not
easily possible.  This patch just discards .text.exit at runtime instead of
link time to avoid this.

It will also fix a related problem with .eh_frame in modern gcc (so far only
observed on x86-64, but could happen on i386 too)

From: Andi Kleen <ak@muc.de>

This patch adds an generic x86 subarchitecture. It is intended to provide
an dynamic interface for APIC drivers. There are already three subarchitectures
(bigsmp, summit, default) that only differ in how they drive the local APIC.
A fourth - Unisys ES7000 - is scheduled to be merged soon.

The subarchitecture concept separated this nicely, but it has the big
drawback that they are compile time options. A Linux vendor cannot
ship own binary kernel rpms for all of these machines. Runtime probing
is needed instead.

This patch adds a new "generic" subarchitecture that just acts as a
dynamic switching layer for APIC drivers. It only tries to virtualize
the APICs, no attempt is made to cover further incompatiblities.
This means machines like the Visual Workstation, pc9800 or
Voyager are not covered; but these are unlikely to be supported by
binary distributions anyways.

The generic arch reuses the existing interface in mach_ipi / mach_mpparse.h /
mach_apic.h and just pulls it using some macros into an "struct genapic"
object. The main APIC code does not recognize it, it is all hidden
in the mach-generic include files.

Auto detection of APIC types is supported in the usual way used by
existing ports like Summit - checking ACPI or mptables for specific
signatures - or it can be specified by the user using a new "apic="
boot option. I also moved the DMI scan to before the generic
subarchitecture probe, so DMI could be used in future too to probe
specific machines.

Some minor hacks were needed to avoid circular declaration of a few
symbols, but overall it's fairly clean.

The patch has been tested on a Summit machine, an generic 4 virtual CPUs
Xeon and on an ES7000.