* git://git.kernel.org/pub/scm/linux/kernel/git/mason/btrfs-unstable:
  Btrfs: fix possible panic on unmount
  Btrfs: deal with NULL acl sent to btrfs_set_acl
  Btrfs: fix regression in orphan cleanup
  Btrfs: Fix race in btrfs_mark_extent_written
  Btrfs, fix memory leaks in error paths
  Btrfs: align offsets for btrfs_ordered_update_i_size
  btrfs: fix missing last-entry in readdir(3)

In free_unmap_area_noflush(), va->flags is marked as VM_LAZY_FREE first, and
then vmap_lazy_nr is increased atomically.

But, in __purge_vmap_area_lazy(), while traversing of vmap_are_list, nr
is counted by checking VM_LAZY_FREE is set to va->flags.  After counting
the variable nr, kernel reads vmap_lazy_nr atomically and checks a
BUG_ON condition whether nr is greater than vmap_lazy_nr to prevent
vmap_lazy_nr from being negative.

The problem is that, if interrupted right after marking VM_LAZY_FREE,
increment of vmap_lazy_nr can be delayed.  Consequently, BUG_ON
condition can be met because nr is counted more than vmap_lazy_nr.

It is highly probable when vmalloc/vfree are called frequently.  This
scenario have been verified by adding delay between marking VM_LAZY_FREE
and increasing vmap_lazy_nr in free_unmap_area_noflush().

Even the vmap_lazy_nr is for checking high watermark, it never be the
strict watermark.  Although the BUG_ON condition is to prevent
vmap_lazy_nr from being negative, vmap_lazy_nr is signed variable.  So,
it could go down to negative value temporarily.

Consequently, removing the BUG_ON condition is proper.

A possible BUG_ON message is like the below.

   kernel BUG at mm/vmalloc.c:517!
   invalid opcode: 0000 [#1] SMP
   EIP: 0060:[<c04824a4>] EFLAGS: 00010297 CPU: 3
   EIP is at __purge_vmap_area_lazy+0x144/0x150
   EAX: ee8a8818 EBX: c08e77d4 ECX: e7c7ae40 EDX: c08e77ec
   ESI: 000081fe EDI: e7c7ae60 EBP: e7c7ae64 ESP: e7c7ae3c
   DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
   Call Trace:
   [<c0482ad9>] free_unmap_vmap_area_noflush+0x69/0x70
   [<c0482b02>] remove_vm_area+0x22/0x70
   [<c0482c15>] __vunmap+0x45/0xe0
   [<c04831ec>] vmalloc+0x2c/0x30
   Code: 8d 59 e0 eb 04 66 90 89 cb 89 d0 e8 87 fe ff ff 8b 43 20 89 da 8d 48 e0 8d 43 20 3b 04 24 75 e7 fe 05 a8 a5 a3 c0 e9 78 ff ff ff <0f> 0b eb fe 90 8d b4 26 00 00 00 00 56 89 c6 b8 ac a5 a3 c0 31
   EIP: [<c04824a4>] __purge_vmap_area_lazy+0x144/0x150 SS:ESP 0068:e7c7ae3c

[ See also http://marc.info/?l=linux-kernel&m=126335856228090&w=2 ]
Signed-off-by: Yongseok Koh <yongseok.koh@samsung.com>
Reviewed-by: Minchan Kim <minchan.kim@gmail.com>
Cc: Nick Piggin <npiggin@suse.de>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'sh/for-2.6.33' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6:
  sh64: wire up sys_accept4.
  sh: unwire sys_recvmmsg.
  sh: ms7724: Correct sh-eth EEPROM polling timeout.

* master.kernel.org:/home/rmk/linux-2.6-arm:
  ARM: 5888/1: arm: Update comments in cacheflush.h and remove unnecessary V6 and V7 comments
  ARM: 5886/1: arm: Fix cpu_proc_fin() for proc-v7.S and make kexec work
  ARM: 5885/1: arm: Flush TLB entries in setup_mm_for_reboot()
  ARM: 5884/1: arm: Fix DCC console for v7
  ARM: 5883/1: Revert "disable NX support for OABI-supporting kernels"
  ARM: 5882/1: ARM: Fix uncompress code compile for different defines of flush(void)
  ARM: fix badly placed mach/plat entries in Kconfig & Makefile

The comments in cacheflush.h should follow what's in
struct cpu_cache_fns. The comments for V6 and V7 are
unnecessary.
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

The comments in arm_machine_restart() suggest that cpu_proc_fin()
will clean and disable cache and turn off interrupts. This does
not seem to be implemented for proc-v7.S, implement it the same
way as for proc-v6.S.

This also makes kexec work for v7. Note that a related TLB and
branch traget flush patch is also needed to avoid kexec
"crc error".

Note that there are still some issues that seem to be related
to L2 cache being on and causing occasional uncompress "crc error"
with kexec. Anyways, this gets kexec mostly working on V7 for now.
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

We need to do that if we tinker with the MMU entries.

This fixes the occasional bug with kexec where the new
fails to uncompress with "crc error". Most likely at
least kexec on v6 and v7 need this fix.
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Without this patch arch/arm/compressed/head.S defaults to generic
DCC code that does not work for v7.

For more information on the v7 DCC, see Cortex-A8 TRM
"12.11.1 Debug communications channel".

To use it with post 2.6.33-rc1 or later, you need to have:

CONFIG_DEBUG_LL=y
ONFIG_DEBUG_ICEDCC=y
CONFIG_EARLY_PRINTK=y

Earlier kernels need commit 93fd03a8
backported.

Tested on omap3430.
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

sh64 on the other hand provides both direct broken out syscalls as well
as socketcall access. As there are binaries that use both socketcall has
to stay around. The current ABI prefers direct syscalls.

It was pointed out that when sys_recvmmsg was added in, sys_accept4 was
overlooked. This takes care of wiring it up.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

sh32 at the moment only uses sys_socketcall to reach these, so unwire
recvmmsg for now. While we're at it, add it to the ignore list, as per
the s390 change.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
  [WATCHDOG] iTCO_wdt: Add Intel Cougar Point and PCH DeviceIDs

We can use logical flat mode if there are <= 8 logical cpu's
(irrespective of physical apic id values).  This will enable simplified
and efficient IPI and device interrupt routing on such platforms.

This has been tested to work on both Intel and AMD platforms.
Exceptions like IBM summit platform which can't use logical flat mode
are addressed by using OEM platform checks.
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Signed-off-by: Yinghai Lu <yinghai@kernel.org>
Cc: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
Cc: Chris McDermott <lcm@linux.vnet.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Chris McDermott from IBM confirmed that hurricane chipset in IBM summit
platforms doesn't support logical flat mode.  Irrespective of the other
things like apic_id's, total number of logical cpu's, Linux kernel
should default to physical mode for this system.

The 32-bit kernel does so using the OEM checks for the IBM summit
platform.  Add a similar OEM platform check for the 64bit kernel too.

Otherwise the linux kernel boot can hang on this platform under certain
bios/platform settings.
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
Tested-by: Ananth N Mavinakayanahalli <ananth@in.ibm.com>
Cc: Chris McDermott <lcm@linux.vnet.ibm.com>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6:
  ALSA: Remove warning message for invalid OSS minor ranges
  ALSA: hda - Fix capture on Sony VAIO with single input
  ALSA: hda - Fix mute led GPIO on HP dv-series notebooks
  ALSA: use subsys_initcall for sound core instead of module_init
  ALSA: hda - Fix missing capture mixer for ALC861/660 codecs
  ALSA: hda - Improved MacBook (Pro) 5,1 / 5,2 support
  ALSA: hda - Fix Toshiba NB20x quirk entry

* 'for-linus' of git://git.monstr.eu/linux-2.6-microblaze:
  microblaze: pci_controller->arch_data really is a struct device_node *
  microblaze: Add missing double apostrophe in Kconfig
  microblaze: Add PT_ macros for special purpose regs
  microblaze: Enable accept4 syscall
  microblaze: Wire up recvmmsg syscall

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6:
  mfd: Unlock mc13783 before subsystems initialisation, at probe time.
  mfd: WM835x GPIO direction register is not locked
  mfd: tmio_mmc hardware abstraction for CNF area
  mfd: WM8350 off by one bug
  mfd: Correct WM835x ISINK ramp time defines

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc: Move cpu hotplug driver lock from pseries to powerpc
  powerpc: Move /proc/ppc64 to /proc/powerpc update
  powerpc/8xx: Fix user space TLB walk in dcbX fixup
  powerpc: Fix decrementer setup on 1GHz boards
  powerpc/iseries: Initialise on-stack completion
  powerpc/hvc: Driver build breaks with !HVC_CONSOLE
  serial/pmac_zilog: Workaround problem due to interrupt on closed port
  powerpc/macintosh: Make Open Firmware device id constant
  powerpc: Use helpers for rlimits
  powerpc: cpumask_of_node() should handle -1 as a node
  powerpc/pseries: Fix dlpar compile warning without CONFIG_PROC_DEVICETREE
  powerpc/pseries: Fix xics interrupt affinity
  powerpc/swsusp_32: Fix TLB invalidation
  powerpc/8xx: Always pin kernel instruction TLB
  powerpc: 2.6.33 update of defconfigs for embedded 6xx/7xxx, 8xx, 8xxx
  powerpc: Use scripts/mkuboot.sh instead of 'mkimage'
  powerpc/5200: update defconfigs

* 'for-linus' of git://oss.sgi.com/xfs/xfs:
  xfs: xfs_swap_extents needs to handle dynamic fork offsets
  xfs: fix missing error check in xfs_rtfree_range
  xfs: fix stale inode flush avoidance
  xfs: Remove inode iolock held check during allocation
  xfs: reclaim all inodes by background tree walks
  xfs: Avoid inodes in reclaim when flushing from inode cache
  xfs: reclaim inodes under a write lock

* 'mantis' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (117 commits)
  V4L/DVB (13851): Fix Input dependency for Mantis
  V4L/DVB(13824a): mantis: Fix __devexit bad annotations
  V4L/DVB (13808b): mantis: replace DMA_nnBIT_MASK to DMA_BIT_MASK(32)
  V4L/DVB (13808): [Mantis/Hopper] Build update for Mantis/Hopper based cards
  V4L/DVB(13808a): mantis: convert it to the new ir-core register/unregister functions
  V4L/DVB (13812): [Mantis/Hopper] Update Copyright header
  V4L/DVB (13811): [MB86A16] Update Copyright header
  V4L/DVB (13810): [MB86A16] Use DVB_* macros
  V4L/DVB (13809): Fix Checkpatch violations
  V4L/DVB (13807): Fix: Free device in the device registration failure case
  V4L/DVB (13806): Register and Initialize Remote control
  V4L/DVB (13805): Fix: Unregister the frontend before detaching
  V4L/DVB (13804): Remove unused I2C Adapter ID
  V4L/DVB (13803): Remove unused dependency on CU1216
  V4L/DVB (13802): [Mantis/Hopper] Fix all build related warnings
  V4L/DVB (13801): [MB86A16] Use the search callback
  V4L/DVB (13800): [Mantis] I2C optimization. Required delay is much lesser than 1mS.
  V4L/DVB (13799): [Mantis] Unregister frontend
  V4L/DVB (13798): [Mantis] Enable power for all cards, use byte mode only on relevant devices
  V4L/DVB (13797): [Mantis/Hopper/TDA665x] Large overhaul,
  ...

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-2.6: (23 commits)
  V4L/DVB (13966): DVB-T regression fix for saa7134 cards
  V4L/DVB (13955): cx25821: fix double unlock in medusa_video_init()
  MAINTAINERS: ivtv-devel is moderated
  MAINTAINERS: Andy Walls is the new ivtv maintainer
  V4L/DVB (13941): rj54n1cb0c: remove compiler warning
  V4L/DVB sh_mobile_ceu: don't check platform_get_irq's return value against zero
  V4L/DVB mx1_camera: don't check platform_get_irq's return value against zero
  V4L/DVB (13934): tda8290: Fix FM radio easy programming standard selection for TDA8295
  V4L/DVB (13900): gspca - sunplus: Fix bridge exchanges.
  V4L/DVB (13887): tda8290: add autodetection support for TDA8295c2
  V4L/DVB (13882): gspca - stv06xx-vv6410: Ensure register STV_SCAN_RATE is zero
  V4L/DVB (13880): gspca - m5602-s5k4aa: Add vflip quirk for the Amilo Xi 2428
  V4L/DVB (13875): gspca - vc032x: Fix a possible crash with the vc0321 bridge.
  V4L/DVB (13868): gspca - sn9c20x: Fix test of unsigned.
  V4L/DVB (13858): ir-keytable: use the right header
  feature-removal-schedule: Add v4l1 drivers obsoleted by gspca sub drivers
  V4L/DVB (13622): gspca - ov534: Fix a compilation warning.
  V4L/DVB (13834): dib8000: fix compilation if !DVB_DIB8000
  V4L/DVB (13831): uvcvideo: Fix oops caused by a race condition in buffer dequeuing
  V4L/DVB (13829): uvcvideo: Fix alternate setting selection in isochronous mode
  ...

This patch adds the Intel Cougar Point and PCH DeviceIDs for iTCO Watchdog.
Signed-off-by: Seth Heasley <seth.heasley@intel.com>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>

we are follow powerpc change:
44ef3390Signed-off-by: Michal Simek <monstr@monstr.eu>

Signed-off-by: Michal Simek <monstr@monstr.eu>

PT_ macros are used by gdb and strace uses them too.
Signed-off-by: Michal Simek <monstr@monstr.eu>

We had wrong name in unistd.h + I wire up this syscall
in syscall table.
Signed-off-by: Michal Simek <monstr@monstr.eu>

Patch a2e27255 should
contain change in unistd.h too. The same problem
had MIPS.
Signed-off-by: Michal Simek <monstr@monstr.eu>

This reverts commit 14f0aa35.

That commit was needed earlier because system call restarting for
OABI (compat) required an executable stack and thus had problems
with NX.  Since ab72b007 ("ARM: Fix signal restart issues
with NX and OABI compat") has reworked the code to not require an
executable stack anymore, we can re-enable NX support for kernels
with OABI (compat) support.
Signed-off-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

When a card instance with a higher card number is registered, warning
messages are spewed eventually with stack traces due to the invalid minor
number for OSS device registration.  For example, thinkpad-acpi registers
the card number 29 as default, and you'll see always these messages.
This is rather confusing (and worries users), thus better to return
simply the error code.
Signed-off-by: Takashi Iwai <tiwai@suse.de>

Because of the include of the decompress_inflate.c file from
boot/compress/misc.c, there are different flush() defines:

In file included from arch/arm/boot/compressed/misc.c:249:
arch/arm/boot/compressed/../../../../lib/decompress_inflate.c:138:29: error: macro "flush" passed 2 arguments, but takes just 0

Fix this by removing the define of flush() in misc.c for
CONFIG_DEBUG_ICEDCC as it's already defined in mach/uncompress.h,
and that is being included unconditionally.

Also use a static inline function instead of define
for mach-mxc and mach-gemini to avoid similar bug
for those platforms.
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

This converts the cpu_relax() to a udelay(1), which fixes up issues with
the EEPROM polling occasionally timing out.
Signed-off-by: Kuninori Morimoto <morimoto.kuninori@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

With this, mc13783 subsystems drivers can configure the mc13783 chip
reading and writing registers.
Signed-off-by: Alberto Panizzo <maramaopercheseimorto@gmail.com>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

No need to set the security key when writing to it.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: stable@kernel.org
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

This patch abstracts out the CNF area code from tmio_mmc which
is not present in all hardware that can use this driver. This
is required so that we can support non-toshiba based hardware.

ASIC3 support by Philipp Zabel
Signed-off-by: Ian Molton <ian@mnementh.co.uk>
Signed-off-by: Magnus Damm <damm@opensource.se>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

If irq == WM8350_NUM_IRQ that would put us past the end of the array.
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

The constants used to specify ISINK ramp times for WM835x had the
wrong shifts so that the on times applied to the off ramp and vice
versa. The masks for the bitfields are correct.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: stable@kernel.org
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

We can race with the unmount of an fs and the stopping of a kthread where we
will free the block group before we're done using it.  The reason for this is
because we do not hold a reference on the block group while its caching, since
the allocator drops its reference once it exits or moves on to the next block
group.  This patch fixes the problem by taking a reference to the block group
before we start caching and dropping it when we're done to make sure all
accesses to the block group are safe.  Thanks,
Signed-off-by: Josef Bacik <josef@redhat.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

It is legal for btrfs_set_acl to be sent a NULL acl.  This
makes sure we don't dereference it.  A similar patch was sent by
Johannes Hirte <johannes.hirte@fem.tu-ilmenau.de>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

Currently orphan cleanup only ever gets triggered if we cross subvolumes during
a lookup, which means that if we just mount a plain jane fs that has orphans in
it, they will never get cleaned up.  This results in panic's like these

http://www.kerneloops.org/oops.php?number=1109085

where adding an orphan entry results in -EEXIST being returned and we panic.  In
order to fix this, we check to see on lookup if our root has had the orphan
cleanup done, and if not go ahead and do it.  This is easily reproduceable by
running this testcase

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <string.h>
#include <unistd.h>
#include <stdio.h>

int main(int argc, char **argv)
{
	char data[4096];
	char newdata[4096];
	int fd1, fd2;

	memset(data, 'a', 4096);
	memset(newdata, 'b', 4096);

	while (1) {
		int i;

		fd1 = creat("file1", 0666);
		if (fd1 < 0)
			break;

		for (i = 0; i < 512; i++)
			write(fd1, data, 4096);

		fsync(fd1);
		close(fd1);

		fd2 = creat("file2", 0666);
		if (fd2 < 0)
			break;

		ftruncate(fd2, 4096 * 512);

		for (i = 0; i < 512; i++)
			write(fd2, newdata, 4096);
		close(fd2);

		i = rename("file2", "file1");
		unlink("file1");
	}

	return 0;
}

and then pulling the power on the box, and then trying to run that test again
when the box comes back up.  I've tested this locally and it fixes the problem.
Thanks to Tomas Carnecky for helping me track this down initially.
Signed-off-by: Josef Bacik <josef@redhat.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

Fix bug reported by Johannes Hirte. The reason of that bug
is btrfs_del_items is called after btrfs_duplicate_item and
btrfs_del_items triggers tree balance. The fix is check that
case and call btrfs_search_slot when needed.
Signed-off-by: Yan Zheng <zheng.yan@oracle.com>
Signed-off-by: Chris Mason <chris.mason@oracle.com>