Andrea Arcangeli's fix to an ironic weakness with get_user_pages. 

try_to_unmap_one must check page_count against page->mapcount before unmapping
a swapcache page: because the raised pagecount by which get_user_pages ensures
the page cannot be freed, will cause any write fault to see that page as not
exclusively owned, and therefore a copy page will be substituted for it - the
reverse of what's intended.

rmap.c was entirely free of such page_count heuristics before, I tried hard to
avoid putting this in.  But Andrea's fix rarely gives a false positive; and
although it might be nicer to change exclusive_swap_page etc.  to rely on
page->mapcount instead, it seems likely that we'll want to get rid of
page->mapcount later, so better not to entrench its use.
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

For those arches (arm and parisc) which use the i_mmap tree to implement
flush_dcache_page, during split_vma there's a small window in vma_adjust when
flush_dcache_mmap_lock is dropped, and pages in the split-off part of the vma
might for an instant be invisible to __flush_dcache_page.

Though we're more solid there than ever before, I guess it's a bad idea to
leave that window: so (with regret, it was structurally nicer before) take
__vma_link_file (and vma_prio_tree_init) out of __vma_link.

vma_prio_tree_init (which NULLs a few fields) is actually only needed when
copying a vma, not when a new one has just been memset to 0.

__insert_vm_struct is used by nothing but vma_adjust's split_vma case:
comment it accordingly, remove its mark_mm_hugetlb (it can never create
a new kind of vma) and its validate_mm (another follows immediately).
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Fix vma_adjust adjust_next wrapping: Rajesh V.  pointed out that if end were
2GB or more beyond next->vm_start (on 32-bit), then next->vm_pgoff would have
been negatively adjusted.
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Rajesh Venkatasubramanian <vrajesh@umich.edu>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

The follow_page write-access case is relying on pte_page before checking
pfn_valid: rearrange that - and we don't need three struct page *pages.

(I notice mempolicy.c's verify_pages is also relying on pte_page, but I'll
leave that to Andi: maybe it ought to be failing on, or skipping over, VM_IO
or VM_RESERVED vmas?)
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Initialize swapper_space.i_mmap_nonlinear, so mapping_mapped reports false on
it (as it used to do).  Update comment on swapper_space, now more fields are
used than those initialized explicitly.
Signed-off-by: Hugh Dickins <hugh@veritas.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

This patch fixes the problem some people had with their systems crashing
early at boot.  Also fix a problem in the LDT/TSS setup noticed by Paul
Menage.  And some other random fixes.

- Update defconfig
- Remove some unnecessary printks
- Enlarge kernel mapping to 40MB
- Fix acpi=ht (Suresh Siddha)
- Use KERN_ALERT for more important oops lines
- Fix LDT/TSS limit (Paul Menage)
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Brown-paper bag time... I put a typo in the asm for _raw_write_trylock
(left in a spurious \n\).  This patch fixes it.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

into ppc970.osdl.org:/home/torvalds/v2.6/linux

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Patch from Toshihiro Kobayashi

do_translation_fault() in arch/arm/mm/fault.c will never resolve odd PMD.
This patch fixes that problem.

Patch from Catalin Marinas

arch/arm/mm/mmap.c: arch_get_unamapped_area() checks bit 9 in the cache type register for possible cache aliasing problems. Bit 11 should be checked instead.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

ioctl structure annotated

	The rest of ->ifr_data cleanups.  A bunch of drivers use address
of ifr->ifr_ifru, but spell that as &ifr->ifr_data, which expands to
&ifr->ifr_ifru.ifru_data.  ifr_ifru is a union and in effect they sneak in
a private field into that union; ifr_ifru.ifru_data is a field in that
union and it has nothing to do with the things they want to do.  Cleaned
up by explicit use of &ifr->ifr_ifru.

	Several places where we really use ->ifr_data (i.e. use its value
and use it as __user pointer) annotated.

From: Jeff Garzik

	Jeff's patch adds a helper for obtaining mii_ioctl_data from ifreq
and switches drivers to it.  It's almost a "move common expression into
inline helper", except that instead of

	(struct mii_ioctl_data *)&rq->ifr_ifru.ifru_data

it does

	(struct mii_ioctl_data *)&rq->ifr_ifru

- pointer to union instead of pointer to a field of union that has nothing
to do with mii_ioctl_data *and* adds confusion by being a pointer itself.

into nuts.davemloft.net:/disk1/BK/net-2.6

Here's an additional patch for ipvs, which also mangles packets via 
netfilter and was previously depending on the checksum helper in 
nf_hook_slow().
Signed-of-by: James Morris <jmorris@redhat.com>
Signed-of-by: David S. Miller <davem@redhat.com>

into nuts.davemloft.net:/disk1/BK/net-2.6

Some boards don't support C1 Halt Disconnect.
Signed-off-by: Bartlomiej Zolnierkiewicz <bzolnier@elka.pw.edu.pl>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

assorted minor bits in drivers/* - all independent, but there's
some limit to splitting stuff...

several pointers in ioctl structures marked as userland ones.

And that's it with this patchset.  A couple more of those and we'll
be done with the noise warnings ;-)

s2io.c: bogus initializer ({{"a"},{"b"}} has too many braces for
two-dimensional array of char - strings are arrays themselves).

de4x5.h: missing __user on a pointer in ioctl structure. 

airo.c: cleaned up and fixed procfs ->read() and ->write()

osst.c, st.c, scsi_debug.c annotated.