I was going through the code looking for bits and pieces to pull across
into the new LSI Logic beta megaraid driver /sys fs code and came across
this one.

LSI Logic have already fixed this issue for the 2.4 driver, and the new
beta driver does not use the /proc filesystem at all, so no problem
there.

The problem is that resources are not freed upon certain error
conditions in the in-kernel megaraid driver, to quote from Lester
Hightower (who originally found the issue):

   "The problem occurs only in the circumstance where one reads one of
    the /proc/megaraid/hba<X>/diskdrives-ch<N> files where the card <X>
    does not have channel <N> on it.  Most people would likely not
    notice this leak in normal operation, but due to the way that we
    monitor our MegaRaid cards in our company (we read these /proc
    entries every 180s) so we found the leak rather quickly, and
    unpleasantly (when your kernel eats all your RAM)."

Anyway, here is the fix, compiled and tested OK for me.

From: Alan Cox <alan@redhat.com>, Arjan van de Ven <arjanv@redhat.com>

 - calculate drive->wcache for non-removable disks too
 - flush the cache before unlocking the door on removable media,
   otherwise you have a small race with the human

This replaces some usages of sempahores on the stack with completions.

We think we have had at least one bug report that could be caused by the
inherent race in the semaphore usage.

There is an bug in bigsmp sub-architecture, due to which it will not
enable all the CPUs when the BIOS-APICIDs are not 0 to n-1 (where n is
total number of CPUs). Particularly, only 2 CPU comes up on a system
that has 4 CPUs with BIOS APICID as (0, 1, 6, 7).=20

The bug is root caused to check_apicid_present(bit) call in smpboot.c,
when bigsmp is expecting apicid in place of bit.
check_apicid_present(bit) in bigsmp subarchitecture checks the bit with
phys_id_present_map (which is actually map representing all apicids and
not bit).

One solution is to change check_apicid_present(bit) to
check_apicid_present(apicid), in smp_boot_cpus().  But, it can affect
all the other subarchitectures in various subtle ways.  So, here is a
simple alternate fix (Thanks to Martin Bligh), which solves the above
problem. 

[ Confirmation from Martin:

     Looks fine, it's exactly the same fix we use for Summit.  Since
     we're using the other method instead of the bitmap, this check
     isn't needed, so we can just bypass it.  This way also has the
     great advantage of being isolated to the bigsmp subarch, so it only
     needs testing there ;-)
 ]

From: <mikem@beardog.cca.cpqcorp.net>

This patch adds support for 2 new controllers.  The first is a PCI-Express
version of the 6400.  The second is actually a SATA controller using the cciss
interface.

   Accept negative level3cnt value in register_application
   for special b-channel calculation. Necessary to work with
   capidrv.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Based on information provided by "Allen Martin" <AMartin@nvidia.com>:

A hang is caused when the CPU generates a very fast CONNECT/HALT cycle
sequence.  Workaround is to set the SYSTEM_IDLE_TIMEOUT to 80 ns.
This allows the state-machine and timer to return to a proper state within
80 ns of the CONNECT and probe appearing together.  Since the CPU will not
issue another HALT within 80 ns of the initial HALT, the failure condition
is avoided.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into debian.org:/usr/src/kernel/ieee1394-2.6

Here is an updated lapic NMI ownership tracking patch which
should address the issues that were raised with the first one:

- Simplified the API function names to {reserve,release}_lapic_nmi().

- Rewrote the ownership tracking code to use two individually named
  flags instead of using arithmetic and the sign. The code is now
  simple enough that no "hiding" macros are needed. (Thanks Albert
  for that suggestion.)

degerrit@web.de wrote:
   "I caused an oops in unusual circumstances by accidentally "forcing" a
    video device number which was too high or already taken (don't know
    which). I assume this probably shouldn't give an oops (though it was my
     fault), so here's a bugreport..."

Fixed by adding a range check for the number passed in by the driver.

From: Hugh Dickins <hugh@veritas.com>

Remove this development-only debug code - Hugh thinks that its BUG_ON() can
trigger by accident.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

This adds some initial support for the latest model of iBook G4 (still
need some work on the clock chip at least and some radeonfb updates that
I'll send later along with other fixes for this driver). 

It also removes a useless delay and fixes detection of the airport card
on the "Windtunnel" class desktop G4 machines.

Those were missing from ppc32, please apply.

Heh, I moved 6 month ago, time to update CREDITS ;)

This cleans up the code used to initialize the 970 CPU.

More specifically, it adds support for the 970FX, makes sure we don't
touch registers we aren't supposed to when running in LPAR mode, and
stop blindly zeroing out HID4 and HID5, we just clear the bits we really
want clear in there and leave the rest to the firmware.

During mqueue_get_inode(), it's possible that kmalloc() of the
info->messages array will fail.  This failure mode will cause the
queues_count to be (incorrectly) decremented twice.  This patch uses
info->messages on mqueue_delete_inode() to determine whether the
mqueue was every truly created, and hence proper accounting is needed
on destruction.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Patch from Bjorn Helgaas

This adds efi_uart_console_only() so we can default to using a serial
console if the EFI console path only contains UARTs.

Patch from Alex Williamson

Here's a trivial patch that makes 8250_hcdp setup the correct flags
when IRQ sharing is enabled for serial ports.

The HCDP table tells us if the device is a PCI UART.  We can use this
to set the shared interrupt flag as well as program the interrupt with
the correct polarity/trigger (should get rid of "changing vector <x>
from IO-SAPIC-edge to IO-SAPIC-level" messages at bootup).  This also
allows non-PCI UARTs to be left un-shareable, which is likely much
more safe (edge triggered).

The bit that I'm keying on is still part of the older 1.0a HCDP spec,
so should be implemented (it was on all the boxes I tested).  If
there's firmware out there that doesn't set this bit or the interrupt
supported flag, the HCDP UART may run in polling mode, but should
still be functional.

Patch from Slawomir Kolodynski

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Patch from Daniel Ritz.

This patch clears an almost undocumented EnE specific test register
that makes sound on RME Hammerfall DSP Carbus work...should even work
after suspend.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

This fixes a potential oops/use after free bug, and removes an unused
variable warning.

From: <Andries.Brouwer@cwi.nl>

In the old days the printk log buffer had a constant size, and dmesg asked
for the 4096, later 8192, later 16384 bytes in there.  These days the
printk log buffer has variable size, and it is not easy for dmesg to do the
right thing, especially when doing a "read and clear".  The patch below
adds a syslog subfuntion that reports the buffer size.

Move error handling to capture all three possible error conditions on
sending to a full queue.  Without this fix any unprivileged user can
leak arbitrary amounts of kernel memory.

into nuts.davemloft.net:/disk1/BK/sparc-2.6

into ppc970.osdl.org:/home/torvalds/v2.6/linux