Finally nailed this sucker.

con_close() checks the tty->count and then sleeps in acquire_console_sem().
But another process can come in and grab a ref against the tty while
con_close() dropped the BKL.  But con_close() then proceeds to deallocate the
tty->driver_data anyway, even though the tty now has ->count == 2.

Fix that by moving the check for ->tty_count inside console_sem.

There were some nasty bugs in the x86-64 code, including one race that
could cause random reboots, especially on Intel machines, with the NMI
watchdog.  This patch fixes them and also includes some harmless
cleanups.

Main fixes were for some buglets in the IOMMU code and the plugging of a
race in the exception stack handling.  Also disables an broken MCE on K8
explicitely.

Also finally the preempt compile issues are fixed.

 - Declare hpet interrupt separately in drivers/char/rtc.c
 - Fix rtc.h/hpet.h to not depend on interrupt.h
 - Finally include smp_lock.h in hardirq.h
 - Update defconfig
 - Export bad_dma_address
 - Merge with 2.6.5rc2
 - Never schedule on interrupt stacks.
 - Add option to force software iotlb (iommu=soft)
 - Add ifdefs to gsi patch to match i386 (Bjorn Helgaas)
 - Fix K8 GART TLB MCE workaround to actually work
 - Fix dwarf2 unwind table in SAVE_ARGS (Jim Houston)
 - Disable APIC on VIA/NVidia even with acpi=off (Gwenole Beauchesne)
 - Fix parsing bug in "apic" option (Gwenole Beauchesne)
 - Fix dma mask handling in pci_alloc_consistent
 - Make pci_alloc_consistent more robust in low memory situations.
 - Print version number in oopses (from i386)
 - ACPI GSI cleanup (Bjorn Helgaas)
 - Disable K8 GART TLB walk error MCE explicitely
 - Add support to disable individual MCEs in the various banks.

From: "Colin Leroy" <colin@colino.net>

The fan driver I wrote for adt746x looks like it only handles the adt7467
chip found in iBooks G4; but it also handles the adt7460 chip found in the
Powerbook G4 Alu.  Here's a patch that updates therm_adt7467.c, Kconfig and
Makefile.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into kernel.bkbits.net:/home/davem/net-2.6

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

This rolls up Marc Zyngier's EISA correction (first two) and adds a missed
netdev_priv() conversion that was causing an oops on module removal.

Noticed by Jan Glauber, confirmed by Stephen Hemminger.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into kroah.com:/home/greg/linux/BK/pci-2.6

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Call pci_claim_resources() so we can see what PCI resources are being used.

On ia64, the parent resources are not necessarily PCI resources and
so won't get found by pci_find_parent_resource.  Use the shiny new
insert_resource() function instead, which I think we would have used
here had it been available at the time.

If we start again, we can return an error even if we were successful.
Reset the result to 0 before beginning again.  Why don't we use a
tailcall here?

This prevents the "optimize && ?" message appearing when the kernel
configuration tool is run.  The message could be eliminated from the
tool, but I'd rather fix the needlessly over-complicated expression:

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

We no longer have a CPU_OFFLINE notifier: we freeze the machine and
kill the CPU atomically.  Remove it.

Various files keep per-cpu caches which need to be freed/moved when a
CPU goes down.  All under CONFIG_HOTPLUG_CPU ifdefs.

scsi.c: drain dead cpu's scsi_done_q onto this cpu.

buffer.c: brelse the bh_lrus queue for dead cpu.

timer.c: migrate timers from dead cpu, being careful of lock order vs
	__mod_timer.

radix_tree.c: free dead cpu's radix_tree_preloads

page_alloc.c: empty dead cpu's nr_pagecache_local into nr_pagecache, and
	free pages on cpu's local cache.

slab.c: stop reap_timer for dead cpu, adjust each cache's free limit, and
	free each slab cache's per-cpu block.

swap.c: drain dead cpu's lru_add_pvecs into ours, and empty its committed_space
	counter into global counter.

dev.c: drain device queues from dead cpu into this one.

flow.c: drain dead cpu's flow cache.

Keep track of kswapds: it's OK that they get moved off a node when the
last CPU goes down, but when a CPU comes back, we should try to move
the kswapd back onto its node.

Workqueues need to bring up/destroy the per-cpu thread on cpu up/down.

1) Add a global list of workqueues, and keep the name in the structure
   (to name the newly created thread).

2) Remove BUG_ON in run_workqueue, since thread is dragged off CPU when
   it goes down.

3) Lock out cpu up/down in flush_workqueue, create_workqueue and
   destroy_workqueue.

4) Add notifier to add/destroy workqueue threads, and take over work.

Change ksoftirqd not to assume it's on the CPU: when a cpu goes down,
it will be rudely dragged off.  Since do_softirq() uses
smp_processor_id(), it's easiest to disable preemption, check that the
cpu is still up, then call do_softirq().

If the cpu is actually offline, wait for the notifier, which kills us.

Take over tasklets from dead cpu in the notifier.

Clean up redundant double assignment in CPU_UP callback.

Add hook for RCU to handle jobs on dead cpu.  Requires new
tasklet_kill_immediate for RCU to clean up its tasklet (which might
have been about to run, so tasklet_kill won't work).

Change the migration thread to directly use its cpu arg, rather than
smp_processor_id(): if a cpu goes up then down rapidly, it can be on
the wrong cpu just before it is stopped.

Add code to stop the migration thread on CPU_DEAD and CPU_UP_CANCELED.

Remove the (bogus) priority of the notifier.

We need the migration thread to be RT as soon as the CPU comes online:
for example, stop_machine() (another RT task) expects to yield to it.
Extract the core of setscheduler() and do that when the migration
thread is created.  rq lock is a precaution against the (theoretical)
possibility of someone else doing setscheduer on this thread at the
same time.

Currently the migration thread re-enables irqs, then calls
move_task_away which disables IRQs again and actually does the move.
This means there is a race where the migration thread gets preempted,
and the target CPU can go down.

Hold irqs disabled in migration thread across move_task_away(), which
now doesn't need to save flags (the other caller is the hotplug CPU
code, where irqs are also disabled).

Grab cpu lock around sched_migrate_task() and sys_sched_setaffinity().
This is a noop without CONFIG_HOTPLUG_CPU.

The sched_migrate_task may have a performance penalty on NUMA if lots
of exec rebalancing is happening, however this only applies to
CONFIG_NUMA and CONFIG_HOTPLUG_CPU, which noone does at the moment
anyway.

Also, the scheduler in -mm solves the race another way, so this will
vanish then.

Don't move tasks onto offline cpus in load_balance and wake_task (the
latter is caused by a completion run from stop_machine).

Note that cpu_is_offline() is a noop when CONFIG_HOTPLUG_CPU=n.

Add "online" sysfs attribute to cpus to bring them up and down.

Again, only under CONFIG_HOTPLUG_CPU.

Implement cpu_down(): uses stop_machine to freeze the machine, then
uses (arch-specific) __cpu_disable() and migrate_all_tasks().

Whole thing under CONFIG_HOTPLUG_CPU, so doesn't break archs which
don't define that.