From: Rusty Russell <rusty@rustcorp.com.au>

Doesn't compile with CONFIG_BLK_DEV_INITRD=n.  Be more careful with the
conditionals.

Spotted by Dave Boutcher...

From: Rusty Russell <rusty@rustcorp.com.au>

This patch moves the initrd when "make_room" runs out of space, rather than
stepping over it.  The problem with stepping over it is that it gets copied
with the kernel when this happens, which wastes space.

Also ensures that the initrd isn't where the kernel wants to be moved to: if
it is, it gets moved out the way.

From: Rusty Russell <rusty@rustcorp.com.au>

Clean up initrd handling.

1) Expose initrd_start and initrd_end to prom.c (replacing its local
   initrd_start and initrd_len).

2) Don't hand mem (aka klimit) through functions which don't need it.

3) Add more debugging under DEBUG_PROM in case we broke anything.

From: Rusty Russell <rusty@rustcorp.com.au>

1) Define PROM_ERROR: checks for call_prom() < 0 are bogus (returns ulong)
2) All OF access functions should be marked __init.
3) prom_strtoul isn't used at all.

From: Rusty Russell <rusty@rustcorp.com.au>

Ben Herrenschmidt made this actually boot.

From: Rusty Russell <rusty@rustcorp.com.au>

copy_device_tree calls inspect_node() which recurses to copy the Open Firmware
device tree.  It just copied into memory above the kernel for about 8MB, which
can overwrite the initrd, and/or get truncated on big machines.

The real solution is to allocate memory properly for all the prom_init memory
users.  However, that's quite a change.  This patch introduces a "make_room"
macro which inspect_node uses to get memory.  This does the same as before,
except skips over the initrd if neccessary.

From: Rusty Russell <rusty@rustcorp.com.au>

finish_device_tree simply allocates nodes by incrementing klimit (ie.  using
memory on top of the kernel).  Change it to figure out how much memory it
needs, then use lmb_alloc to allocate that, then fill it in.

This gets rid of the only manipulation of klimit after prom_init.

From: Rusty Russell <rusty@rustcorp.com.au>

Rather than pre-declaring static functions, order them so it's not neccessary.
This makes the code easier to navigate and patch.

From: Rusty Russell <rusty@rustcorp.com.au>

Rather than pre-declaring static functions, order them so it's not neccessary.
This makes the code easier to navigate and patch.

From: Rusty Russell <rusty@rustcorp.com.au>

Rather than pre-declaring static functions, order them so it's not neccessary.
This makes the code easier to navigate and patch.

From: Rusty Russell <rusty@rustcorp.com.au>

Rather than pre-declaring static functions, order them so it's not neccessary.
This makes the code easier to navigate and patch.

From: Rusty Russell <rusty@rustcorp.com.au>

Move all the functions that run normally (ie.  with the kernel in the correct
address) to the bottom of prom.c, and keep all the functions which use RELOC()
to the top, above "prom_init()" which calls them.

Also, make prom_initialize_dart_table and prom_initialize_tce_table static.

From: Jan Kara <jack@ucw.cz>

It fixes a memory leak when turning journalled quotas off.

We're testing the nullness of `sb' potentially after rereferencing it
(although the compiler will have reordered things to avoid such a bug).

Just remove the test - the superblock pointer shouldn't be null in there.

From: Jan Kara <jack@ucw.cz>

When there are lots of dirty dquots the vfs_quota_sync() is too slow (it has
O(N^2) behaviour).  Attached patch implements list of dirty dquots for each
superblock and quota type.  Using this lists sync is trivially linear.
Attached patch is against 2.6.5 with journalled quota and previous patch for
hash table size.

(Jan had a test which went from 8 minutes to 0.8 seconds...)

From: Jan Kara <jack@ucw.cz>

I found out that quota uses hash table with just 43 entries to hash dquot
entries.  I guess that we can afford using one page for that
(quotactl(Q_GETQUOTA...), got faster like 3x for 4000 users).  Attached patch
implements that.

From: Jan Kara <jack@ucw.cz>

I've attached a fix for a problem in ext3 journalled quota patch - the problem
is that detecting whether dqput() sleeps was wrong and so we could possibly
schedule when holding a spinlock.

From: Chris Wright <chrisw@osdl.org>

Contributions from:
Stephen Smalley <sds@epoch.ncsc.mil>
Andy Lutomirski <luto@stanford.edu>

During exec the LSM bprm_apply_creds() hooks may tranisition the program to a
new security context (like setuid binaries).  The security context of the new
task is dependent on state such as if the task is being ptraced.  

ptrace_detach() doesn't take the task_lock() when clearing task->ptrace.  So
there is a race possible where a process starts off being ptraced, the
malicious ptracer detaches and if any checks agains task->ptrace are done more
than once, the results are indeterminate.

This patch ensures task_lock() is held while bprm_apply_creds() hooks are
called, keeping it safe against ptrace_attach() races.  Additionally, tests
against task->ptrace (and ->fs->count, ->files->count and ->sighand->count all
of which signify potential unsafe resource sharing during a security context
transition) are done only once the results are passed down to hooks, making it
safe against ptrace_detach() races.

Additionally:

- s/must_must_not_trace_exec/unsafe_exec/
- move unsafe_exec() call above security_bprm_apply_creds() call rather than
  in call for readability.
- fix dummy hook to honor the case where root is ptracing
- couple minor formatting/spelling fixes

From: Chris Mason <mason@suse.com>

block_write_full_page might see and lock clean metadata buffers, which leads
to bogus vs-12339 messages.  Change the message to ignore bh locked.

From: Rusty Russell <rusty@rustcorp.com.au>

call_usermodehelper uses keventd to create a thread, guaranteeing a nice,
clean kernel thread.  Unfortunately, there is a case where
call_usermodehelper is called with &bus->subsys.rwsem held (via
bus_add_driver()), but keventd could be running bus_add_device(), which is
blocked on the same lock.  The result is deadlock, and it comes from using
keventd for both.

In this case, it can be fixed by using a completely independent thread for
call_usermodehelper, or an independent workqueue.  Workqueues have the
infrastructure we need, so we use one.

Move EXPORT_SYMBOL while we're there, too.

akpm fixes: Make it compile with !CONFIG_KMOD

From: Rusty Russell <rusty@rustcorp.com.au>

Workqueues are a great primitive for running things from user context from
a completely clean environment.  Unfortunately, they currently insist on
creating one thread per CPU, which is overkill for many situations, so the
more generic keventd workqueue is used for these.  Recently deadlocks using
keventd were demonstrated, showing that it is not suitable for all uses.

1) Clean up CPU iterators.  Always a nice touch.

2) Add __create_workqueue() and create_singlethread_workqueue(),
   keeping source compatibility.

3) Put workqueues in workqueue list even if !CONFIG_HOTPLUG_CPU (means
   we need a lock to protect that list).  Now we can tell if a wq is
   single-threaded using list_empty(&wq->list).

4) For single-threaded workqueues, override CPU in queue_work,
   delayed_work_timer_fn and flush_workqueue to be 0.  flush_workqueue
   now does redundant passes for single-threaded workqueues, but the
   code remains simple.

5) Make create_workqueue_thread return the thread, so we can easily
   kthread_bind for multi-threaded workqueues.


akpm fixes:

- Fix up is_single_threaded() handling

- single-threaded wq thread does not have "/0" appended.

Here's another fix it'd be good to merge ...

No changes to the Linux code at all, but it'll makes the Windows
configuration of a Linux device running the Ethernet/RNDIS gadget behave
correctly on more versions of Windows.  (It might prevent some
Bluescreening too.)

into ppc970.osdl.org:/home/torvalds/v2.6/linux

There's an obsolete check in sn_init_pdas() left over from the 2.4
days that panics if the cpu PDA and cpu_data area span more than a page.
With 2.6, we're not limited to a page, so remove the check entirely.

I just ran into a bug introduced by the most recent iosapic.c patch.
The scenario is a builtin driver is up and running happily.  A module
loads for a devices that happens to share the same interrupt vector,
in this case a network driver.  The module calls pci_enable_device()
as it should, which eventually lands in iosapic_enable_intr().  We
then proceed to mask the interrupt and kill the device that's already
running.  As a bonus, request_interrupt() doesn't fix the problem
because we only call the startup for the interrupt handler on the
first action attached to the interrupt.

I think the best way out of this is simply to detect when an action is
already attached to a vector and leave it alone.  This also prevents
interrupts from moving to other cpus (on boxes w/o irq redirection)
for no good reason.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

The logic got a little foo-bar'ed in the last patch, we should have keep
the old logic.  Ie LoEj bit (2nd) must always be set, just clear it for
known non-capable of loading drives.

This fixes a oops in the current kernel tree.

This is an old bug that often confuses people, rightfully.

For some laptop and server type cdroms, the drives advertise themselves
as tray loading even if they are caddy-like or slot-in loaders.  This
means they cannot insert the media on their own, and this generates a
5/24/00 error to START_STOP_UNIT.

This prevents the logging of such a failure, and also fixes the
generation of such a bad command in case the mech type was correctly set
by the drive.

Fix race conditions of ISDN CAPI's internal ncci list handling by using
a per capidev semaphore.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

 - [V4L] follow changes in saa7146 driver: mxb, dpc7146, hexium_orion,
   hexium_gemini

 - [DVB] ttusb-dec:
   - Add a parameter to dvb_filter_pes2ts function to specify whether
     the packet is a payload unit start or not
   - Use the hotplug firmware loader for 2.6 kernels instead of
     compiling the firmware into the module. 
   - Correct the USB id of the DEC3000-s, add basic support

 - [DVB] ttusb-budget:
    - Remove spurious discontinuity message when starting streaming

 - [DVB] follow changes in dvb-core for frontend drivers (ves1x93,
   ves1820, nxt6000, sp887x, tda1004x, stv0299, mt312, alps_tdlb7,
   alps_tdmb7, at76c651, cx24110, dst, dvb_dummy_fe, grundig_29504-401,
   grundig_29504-491)
 - [DVB] tda1004x: updated timeout to 800ms, implemented FE_SLEEP
 - [DVB] cx24110: add FE_CAN_RECOVER to reduce kdvb-fe CPU load
 - [DVB] grundig_29504-401: added 200ms delay after first FE_INIT,
   Implemented FE_GET_FRONTEND
 - [DVB] alps_tdlb7, alps_tdmb7: upped tuning delays to fix tuning

 - [DVB] av7110 update:
   - speed up firmware loading
   - follow internal API changes in saa7146 driver
   - introduced some symbolic constants for a/v dec cmds
   - change default for hw_sections to 0 to enable crc checks

 - [DVB] remove superflous memset() which caused section data to be
   overwritten when a) there are two sections in one TS packet, and b)
   the first section was smaller than 18 bytes; thanks to Jean-Claude
   Repetto for tracking this down
 - [DVB] starting a ts filter on a running section filter's pid did
   break the section filter; fixed. 
 - [DVB] integrate ULE Decapsulation code, thanks to gcs - Global
   Communication & Services GmbH.  and Institute for Computer Sciences
   Salzburg University.  Hilmar Linder <hlinder@cosy.sbg.ac.at> and
   Wolfram Stering <wstering@cosy.sbg.ac.at>
 - [DVB] fix the module use count bugs, thanks to Hernan A.Perez Masci
   for his initial work on this problem
 - [DVB] if dvb_frontend_internal_ioctl() returns an error code, be sure
   to deliver it to the calling application, don't ignore it (fixes the
   bug that the frontend0 doesn't respond properly to unknown ioctls...)
 - [DVB] major frontend code clean up, rewritten core tuning loop.
   Thanks to Andrew de Quincey.
 - [DVB] follow changes in dvb-core in skystar2, dvb-bt8xx

 - [DVB] add generic functions for EN50221 CAM interfaces