Currently, to be able to send a reset in the FORWARD chain of iptables
for bridged traffic, ip forwarding must be enabled. This causes confusion
and in some situations people really don't want to enable ip forwarding.
The patch below lets the user send reset packets for bridged frames in
the FORWARD chain, with ip forwarding disabled (as long as there is a
route).

This backs out Maneesh's sysfs patch that was recently added to the
kernel.

In its defense, the original patch did solve some fixes that could be
duplicated on SMP machines, but the side affect of the patch caused lots
of problems.  Basically it caused kobjects to get their references
incremented when files that are not present in the kobject are asked for
(udev can easily trigger this when it looks for files call "dev" in
directories that do not have that file).  This can cause easy oopses
when the VFS later ages out those old dentries and the kobject has its
reference finally released (usually after the module that the kobject
lived in was removed.)

I will continue to work with Maneesh to try to solve the original bug,
but for now, this patch needs to be applied.

From: Ivan Kokshaysky <ink@jurassic.park.msu.ru>

The memory reserved for PCI probe is not freed properly in some cases,
for instance with a 3.5Gb of RAM.

Forward port from 2.4.

Oops, there was two different code path affected by this
bug (strace and normal) and I fixed only one. Here's the
other one:

For the same reason as ppc32, we need to ensure that all stores
done on a CPU has reached the coherency domain and are visible
to loads done by another CPU when context switching as the same
thread may be rescheduled almost right away there.

This updates the ppc32 PCI mmap facility to allow mmap'ing of space
outside of the actual devices, using the host bridge resources instead. 

This allow userland to map things like legacy IO space by either using
the bridge device itself, or simply any PCI device on the same bus
domain

On ppc32, CONFIG_PREEMPT wasn't settable along with CONFIG_SMP
for historical reasons (smp_processor_id() races). Those races have
been fixes since then (well, should have been at least) so it's now
safe to allow both options.

This fixes a few issues with context switch on ppc32:

 - Makes sure we properly flush out all stores to the coherency domain
   when switching out, since the same thread could be switched back in
   on another CPU right away, those stores must be visible to all other
   CPUs. 

 - Remove dssall in the assembly calls and do it now once in switch_mm
   (stop vmx streams).  Assume the G5 doesn't need a sync after dssall. 

 - Remove bogus isync in the loop setting the userland segment registers

 - Do not switch the userland segments when the mm stays the same

enable_kernel_fp is exported both in ppc_ksyms and near it's
definition in process.c, remove the former.

Add a warning if enable_kernel_{fp,altivec} is called with preempt
enabled since this is always an error, and make sure the alignement
exception handler properly disables preempt when doing FP operations.

We don't set the task state to TASK_INTERRUPTIBLE _before_ checking for
kthread_should_stop in do_stop.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

From Dave Jones.

Oops.

   Check for valid application pointer inside api spinlock
   in diva_send_message().

Since pdflush was converted to be launched by the kthread infrastructure it
has inherited keventd's `nice -10' setting.  That hurts interactivity when
pdflush is doing lots of work writing back through the dm-crypt layer.

So set pdflush back to `nice 0'.

From: Mike Christie <michaelc@cs.wisc.edu>

A couple of drivers can sometimes fail the first segments in a bio then
requeue the rest of the request.  In this situation, if the last part of
the bio completes successfully bio_pair_end_* will miss that the beginging
of the bio had failed becuase they just return one when bi_size is not yet
zero.  The attached patch moves the error value test before the bi_size to
catch the above case.

From: Jens Axboe <axboe@suse.de>

Samuel Rydh wrote:

If a MODE_SENSE(6) command is sent to an IDE cd using the CDROM_SEND_PACKET
ioctl, then the kernel freezes solidly. To reproduce this, one can take the
SCSI cmd [1a 08 31 00 10 00] and a 16 byte data buffer.

After some bug hunting, I found out that the following is what happens:

- ide-cd recognizes that MODE_SENSE(6) isn't supported and tries
  to abort the request from ide_cdrom_prep_pc by returning BLKPREP_KILL.

- in elv_next_request(), the kill request is handled by
  the following code:

	while (end_that_request_first(rq, 0, rq->nr_sectors))
		;
	end_that_request_last(rq);

The while loop never exits. The end_that_request_first() doesn't do anything
since rq->nr_sectors is 0; it just returns "not-done" after handling those 0
bytes (rq->bio->bi_size is 16).

into nuts.davemloft.net:/disk1/BK/net-2.6

We've now narrowed down the issue of kernel oopses in combination with
'LIST_DELETE' syslog messages happening in certain setups.

Apparently people who do not enable CONFIG_IP_NF_NAT_LOCAL and do
DNAT/REDIRECT and want to connect locally from the gateway via DNAT to
the DNAT'ed address experience the bug ;)

Patch courtesy of KOVACS Krisztian and Henrik Nordstrom

Acked by Grant Grundler and Matthew Wilcox.

Acked by David Miller.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Here's one for -rc...  either this bit is assumed on most modern drives,
or nobody uses the 6-byte commands for read/write (which is very
likely).  Either way it definitely wants fixing.

Since we use the modern "LBA" method of addressing sectors, this bit
must be present in the Device register when issuing a read or write. 
There are three code paths that need this bit, and only two of them
actually set it.  This patch fixes the third (and apparently never used)
code path.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Acorn decided to use an esoteric method for handling the year.
Update RTC implementation to follow this method.

- Since the coherent DMA allocator is not currently compatible with
  HUGETLB, ensure that we fail at compile time should this option be
  selected.
- Move struct device/dma mask handling into consistent_alloc().
- Complain if someone tries to allocate coherent memory larger than
  their DMA mask will permit.
- Rename consistent_alloc() to __dma_alloc() to ensure that there
  is no confusion that consistent_alloc() has gone.
- Ensure warnings and errors report the correct function name.

Since we've eliminated users of these functions, we can unexport
them.  Instead, drivers should use the DMA API interfaces.

This is mainly for ARM framebuffer drivers, some of which are
presently either open-coding this functionality, or using some
internal ARM architecture function to get what they want.

It's a bit late in 2.6.5-rc for this, but it does fix a significant bug: for
the first five minutes after boot, prior to the jiffy wrap, /bin/sync doesn't
write all of the dirty data.

We currently record an inode's time-of-first-dirtying in the address_space.
This causes a few problems with dirty block special inodes: when the device
node for /dev/hda1 needs to be written back we bogusly inspect the timestamp
for the address_space, which belongs to a different inode.

So move the inode's dirtying time up into the inode itself.

This means that for block-special inodes, inode->dirtied_when represents the
time at which the inode itself was dirtied.

For regular files it represents the time at which the inode or its pages were
dirtied.

For blockdevs, the time-of-first-dirtying is recorded in the kernel-internal
blockdev inode.  Only I_DIRTY_PAGES makes sense on these inodes.

The reason all this works is that when dirtying a page we always run

	__mark_inode_dirty(page->mapping->host);

which refers to the kernel-internal blockdev inode.