From Matthew Wilcox.

 - Remove sysfs_bin_buffer.  It's a security hole.
 - Remove checks for permissions; the VFS does that.
 - Validate offset & count at the top level.
 - Allow lower levels to return less data than was asked for.
 - Allocate buffer at open & free it at close, not on each read/write.

From Steve Hemminger (shemminger@osdl.org)

From Geert Uytterhoeven

This one gets rid of sys32_{get,set}affinity in favor of a unified
compat implementation.

From: Trond Myklebust <trond.myklebust@fys.uio.no>

The patch fixes some problems with NFS under heavy writeout.

NFS pages can be in a clean but unreclaimable state.  They are unreclaimable
because the server has not yet acked the write - we may need to "redirty"
them if the server crashes.

These are referred to as "unstable" pages.  We need to count them alongside
dirty and writeback pages when making flushing and throttling decisions.
Otherwise the machine can be flooded with these pages and the VM has
problems.

The MCE code is setting up a timer whose handler uses the workqueue code
before workqueue is initialised.  If you boot slowly it oopses.

Convert the MCE code to use an initcall.

From: george anzinger <george@mvista.com>

The MAJOR problem was a hang in the kernel if a user tried to delete a
repeating timer that had a signal delivery pending. I was putting the
task in a loop waiting for that same task to pick up the signal. OUCH!

A minor issue relates to the need by the glibc folks, to specify a
particular thread to get the signal.  I had this code in all along,
but somewhere in 2.5 the signal code was made POSIX compliant, i.e.
deliver to the first thread that doesn't have it masked out.

This now uses the code from the above mentioned clean up.  Most
signals go to the group delivery signal code, however, those
specifying THREAD_ID (an extension to the POSIX standard) are sent to
the specified thread.  That thread MUST be in the same thread group as
the thread that creates the timer.

drivers/md/xor.c needs kernel_fpu_begin() for the mmx checksumming functions.
 So export that to GPL modules.

use `unsigned long' for a jiffies-holding type.

use-after-free races have been seen due to the workqueue timer in the tty
structure going off after the tty was freed.

Fix that up by using cancel_scheduled_work() and flush_scheduled_work().

The workqueue code currently has a notion of a per-cpu queue being "busy".
flush_scheduled_work()'s responsibility is to wait for a queue to be not busy.

Problem is, flush_scheduled_work() can easily hang up.

- The workqueue is deemed "busy" when there are pending delayed
  (timer-based) works.  But if someone repeatedly schedules new delayed work
  in the callback, the queue will never fall idle, and flush_scheduled_work()
  will not terminate.

- If someone reschedules work (not delayed work) in the work function, that
  too will cause the queue to never go idle, and flush_scheduled_work() will
  not terminate.

So what this patch does is:

- Create a new "cancel_delayed_work()" which will try to kill off any
  timer-based delayed works.

- Change flush_scheduled_work() so that it is immune to people re-adding
  work in the work callout handler.

  We can do this by recognising that the caller does *not* want to wait
  until the workqueue is "empty".  The caller merely wants to wait until all
  works which were pending at the time flush_scheduled_work() was called have
  completed.

  The patch uses a couple of sequence numbers for that.

So now, if someone wants to reliably remove delayed work they should do:


	/*
	 * Make sure that my work-callback will no longer schedule new work
	 */
	my_driver_is_shutting_down = 1;

	/*
	 * Kill off any pending delayed work
	 */
	cancel_delayed_work(&my_work);

	/*
	 * OK, there will be no new works scheduled.  But there may be one
	 * currently queued or in progress.  So wait for that to complete.
	 */
	flush_scheduled_work();


The patch also changes the flush_workqueue() sleep to be uninterruptible.
We cannot legally bale out if a signal is delivered anyway.

From: Philippe Elie <phil.el@wanadoo.fr>

- oprofile is currently only profiling one sibling.  Fix that with
  appropriate register settings.

- fix an oops which could occur if the userspace driver were to request a
  non-existent resource.

- in NMI handler counter_config[i].event is accessible from user space so
  user can change the event during profiling by echo xxx >
  /dev/oprofile/event

- event mask was wrong, the bit field is 6 bits length not 5, events
  SSE_INPUT_ASSIST and X87_SIMD_MOVES_UOP was affected by masking high bit of
  event number.

A few places were missing the rwlock->spinlock conversion.

macro argument, so that portability issues will be found in
a timely manner.

This fixes oopses when it and the hid core are compiled into the kernel.

Amiga Gayle IDE fixes: Set hwif->mmio to 2 to prevent the generic IDE core from
messing with our resources

Amiga keyboard: fix default keyboard mappings:
  - Map the parentheses keys on the numeric keypad to KPLEFTPAREN and
    KPRIGHTPAREN (was: NUMLOCK and SCROLLLOCK)
  - Map the Help key to HELP (was: F11)
  - Map the Amiga keys to LEFTMETA and RIGHTMETA (was: RESERVED)

IDE: Print IRQ number in decimal on m68k

M68k: Add module support (from Roman Zippel)

Atyfb fixes for Atari:
  - Add missing allocation of default_par
  - Kill warnings in assignments

function actually exists.

architecture is now just a 64-bit configuration option of the
basic s390 architecture.

Merge s390x and s390 to one architecture.

Merge s390x and s390 to one architecture.

Merge s390x and s390 to one architecture.

Merge s390x and s390 to one architecture.

Merge s390x and s390 to one architecture.

Merge s390x and s390 to one architecture.

Merge s390x and s390 to one architecture.

s390 dasd driver:
 - Coding style adaptions. Removed almost all typedefs from the dasd driver.

s390 dasd driver:
 - Coding style adaptions. Removed almost all typedefs from the dasd driver.

s390 dasd driver fixes:
 - Take request queue lock in dasd_end_request.
 - Make it work with CONFIG_DEVFS_FS=y.
 - Properly wait for the root device.
 - Cope with requests killed due to failed channel path.
 - Improve reference counting.
 - Remove devno from struct dasd_device.
 - Remove unnecessary bdget/bdput calls.

Fixes for s390 kernel configured with CONFIG_SMP=n.

s390 console fixes for 3215 and sclp.

Common i/o layer fixes:
 - Fix for path no operational condition in cio_start.
 - Fix handling of user interruption parameter.
 - Add code to wait for devices in init_ccw_bus_type.
 - Move qdio states out of main cio state machine.
 - Reworked chsc data structures.
 - Add ccw_device_start_timeout.
 - Handle path verification required flag.

Add support for system calls with numbers > 255.

s390 fixes:
 - Initialize timing related variables first and then enable the timer interrupt.
 - Normalize nano seconds to micro seconds in do_gettimeofday.
 - Add types for __kernel_timer_t and __kernel_clockid_t.
 - Fix ugly bug in switch_to: set prev to the return value of resume, otherwise
   prev still contains the previous process at the time resume was called and
   not the previous process at the time resume returned. They differ...
 - Add missing include to get the kernel compiled.
 - Get a closer match with the i386 termios.h file.
 - Cope with INITIAL_JIFFIES.
 - Define cpu_relax to do a cpu yield on VM and LPAR.
 - Don't reenable interrupts in program check handler.
 - Add pte_file definitions.
 - Fix PT_IEEE_IP special case in ptrace.
 - Use compare and swap to release the lock in _raw_spin_unlock.
 - Introduce invoke_softirq to switch to async. interrupt stack.