The follow_page write-access case is relying on pte_page before checking
pfn_valid: rearrange that - and we don't need three struct page *pages.

(I notice mempolicy.c's verify_pages is also relying on pte_page, but I'll
leave that to Andi: maybe it ought to be failing on, or skipping over, VM_IO
or VM_RESERVED vmas?)
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Initialize swapper_space.i_mmap_nonlinear, so mapping_mapped reports false on
it (as it used to do).  Update comment on swapper_space, now more fields are
used than those initialized explicitly.
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch fixes the problem some people had with their systems crashing
early at boot.  Also fix a problem in the LDT/TSS setup noticed by Paul
Menage.  And some other random fixes.

- Update defconfig
- Remove some unnecessary printks
- Enlarge kernel mapping to 40MB
- Fix acpi=ht (Suresh Siddha)
- Use KERN_ALERT for more important oops lines
- Fix LDT/TSS limit (Paul Menage)
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Brown-paper bag time... I put a typo in the asm for _raw_write_trylock
(left in a spurious \n\).  This patch fixes it.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Patch from Toshihiro Kobayashi

do_translation_fault() in arch/arm/mm/fault.c will never resolve odd PMD.
This patch fixes that problem.

Patch from Catalin Marinas

arch/arm/mm/mmap.c: arch_get_unamapped_area() checks bit 9 in the cache type register for possible cache aliasing problems. Bit 11 should be checked instead.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

ioctl structure annotated

	The rest of ->ifr_data cleanups.  A bunch of drivers use address
of ifr->ifr_ifru, but spell that as &ifr->ifr_data, which expands to
&ifr->ifr_ifru.ifru_data.  ifr_ifru is a union and in effect they sneak in
a private field into that union; ifr_ifru.ifru_data is a field in that
union and it has nothing to do with the things they want to do.  Cleaned
up by explicit use of &ifr->ifr_ifru.

	Several places where we really use ->ifr_data (i.e. use its value
and use it as __user pointer) annotated.

From: Jeff Garzik

	Jeff's patch adds a helper for obtaining mii_ioctl_data from ifreq
and switches drivers to it.  It's almost a "move common expression into
inline helper", except that instead of

	(struct mii_ioctl_data *)&rq->ifr_ifru.ifru_data

it does

	(struct mii_ioctl_data *)&rq->ifr_ifru

- pointer to union instead of pointer to a field of union that has nothing
to do with mii_ioctl_data *and* adds confusion by being a pointer itself.

into nuts.davemloft.net:/disk1/BK/net-2.6

Here's an additional patch for ipvs, which also mangles packets via 
netfilter and was previously depending on the checksum helper in 
nf_hook_slow().
Signed-of-by: James Morris <jmorris@redhat.com>
Signed-of-by: David S. Miller <davem@redhat.com>

into nuts.davemloft.net:/disk1/BK/net-2.6

Some boards don't support C1 Halt Disconnect.
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@elka.pw.edu.pl>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

assorted minor bits in drivers/* - all independent, but there's
some limit to splitting stuff...

several pointers in ioctl structures marked as userland ones.

And that's it with this patchset.  A couple more of those and we'll
be done with the noise warnings ;-)

s2io.c: bogus initializer ({{"a"},{"b"}} has too many braces for
two-dimensional array of char - strings are arrays themselves).

de4x5.h: missing __user on a pointer in ioctl structure. 

airo.c: cleaned up and fixed procfs ->read() and ->write()

osst.c, st.c, scsi_debug.c annotated.

selinuxfs.c annotated

	b44.c: ->ioctl() is broken, since it uses &ifr->ifr_data instead of
ifr->ifr_data itself.  Surprise, surprise, copy_from_user() on that address
doesn't do any good...

	baycom_epp.c: does get_user() of the first word of structure, then
immediately does copy_from_user() on the entire thing and completely ignores
the value read by get_user() (it uses the same value in copied structure
instead).  Bogus get_user() call removed.