use-after-free races have been seen due to the workqueue timer in the tty
structure going off after the tty was freed.

Fix that up by using cancel_scheduled_work() and flush_scheduled_work().

The workqueue code currently has a notion of a per-cpu queue being "busy".
flush_scheduled_work()'s responsibility is to wait for a queue to be not busy.

Problem is, flush_scheduled_work() can easily hang up.

- The workqueue is deemed "busy" when there are pending delayed
  (timer-based) works.  But if someone repeatedly schedules new delayed work
  in the callback, the queue will never fall idle, and flush_scheduled_work()
  will not terminate.

- If someone reschedules work (not delayed work) in the work function, that
  too will cause the queue to never go idle, and flush_scheduled_work() will
  not terminate.

So what this patch does is:

- Create a new "cancel_delayed_work()" which will try to kill off any
  timer-based delayed works.

- Change flush_scheduled_work() so that it is immune to people re-adding
  work in the work callout handler.

  We can do this by recognising that the caller does *not* want to wait
  until the workqueue is "empty".  The caller merely wants to wait until all
  works which were pending at the time flush_scheduled_work() was called have
  completed.

  The patch uses a couple of sequence numbers for that.

So now, if someone wants to reliably remove delayed work they should do:


	/*
	 * Make sure that my work-callback will no longer schedule new work
	 */
	my_driver_is_shutting_down = 1;

	/*
	 * Kill off any pending delayed work
	 */
	cancel_delayed_work(&my_work);

	/*
	 * OK, there will be no new works scheduled.  But there may be one
	 * currently queued or in progress.  So wait for that to complete.
	 */
	flush_scheduled_work();


The patch also changes the flush_workqueue() sleep to be uninterruptible.
We cannot legally bale out if a signal is delivered anyway.

From: Philippe Elie <phil.el@wanadoo.fr>

- oprofile is currently only profiling one sibling.  Fix that with
  appropriate register settings.

- fix an oops which could occur if the userspace driver were to request a
  non-existent resource.

- in NMI handler counter_config[i].event is accessible from user space so
  user can change the event during profiling by echo xxx >
  /dev/oprofile/event

- event mask was wrong, the bit field is 6 bits length not 5, events
  SSE_INPUT_ASSIST and X87_SIMD_MOVES_UOP was affected by masking high bit of
  event number.

A few places were missing the rwlock->spinlock conversion.

macro argument, so that portability issues will be found in
a timely manner.

This fixes oopses when it and the hid core are compiled into the kernel.

Amiga Gayle IDE fixes: Set hwif->mmio to 2 to prevent the generic IDE core from
messing with our resources

Amiga keyboard: fix default keyboard mappings:
  - Map the parentheses keys on the numeric keypad to KPLEFTPAREN and
    KPRIGHTPAREN (was: NUMLOCK and SCROLLLOCK)
  - Map the Help key to HELP (was: F11)
  - Map the Amiga keys to LEFTMETA and RIGHTMETA (was: RESERVED)

IDE: Print IRQ number in decimal on m68k

M68k: Add module support (from Roman Zippel)

Atyfb fixes for Atari:
  - Add missing allocation of default_par
  - Kill warnings in assignments

function actually exists.

architecture is now just a 64-bit configuration option of the
basic s390 architecture.

Merge s390x and s390 to one architecture.

Merge s390x and s390 to one architecture.

Merge s390x and s390 to one architecture.

Merge s390x and s390 to one architecture.

Merge s390x and s390 to one architecture.

Merge s390x and s390 to one architecture.

Merge s390x and s390 to one architecture.

s390 dasd driver:
 - Coding style adaptions. Removed almost all typedefs from the dasd driver.

s390 dasd driver:
 - Coding style adaptions. Removed almost all typedefs from the dasd driver.

s390 dasd driver fixes:
 - Take request queue lock in dasd_end_request.
 - Make it work with CONFIG_DEVFS_FS=y.
 - Properly wait for the root device.
 - Cope with requests killed due to failed channel path.
 - Improve reference counting.
 - Remove devno from struct dasd_device.
 - Remove unnecessary bdget/bdput calls.

Fixes for s390 kernel configured with CONFIG_SMP=n.

s390 console fixes for 3215 and sclp.

Common i/o layer fixes:
 - Fix for path no operational condition in cio_start.
 - Fix handling of user interruption parameter.
 - Add code to wait for devices in init_ccw_bus_type.
 - Move qdio states out of main cio state machine.
 - Reworked chsc data structures.
 - Add ccw_device_start_timeout.
 - Handle path verification required flag.

Add support for system calls with numbers > 255.

s390 fixes:
 - Initialize timing related variables first and then enable the timer interrupt.
 - Normalize nano seconds to micro seconds in do_gettimeofday.
 - Add types for __kernel_timer_t and __kernel_clockid_t.
 - Fix ugly bug in switch_to: set prev to the return value of resume, otherwise
   prev still contains the previous process at the time resume was called and
   not the previous process at the time resume returned. They differ...
 - Add missing include to get the kernel compiled.
 - Get a closer match with the i386 termios.h file.
 - Cope with INITIAL_JIFFIES.
 - Define cpu_relax to do a cpu yield on VM and LPAR.
 - Don't reenable interrupts in program check handler.
 - Add pte_file definitions.
 - Fix PT_IEEE_IP special case in ptrace.
 - Use compare and swap to release the lock in _raw_spin_unlock.
 - Introduce invoke_softirq to switch to async. interrupt stack.

into home.transmeta.com:/home/torvalds/v2.5/linux

unmap_vmas() eventually calls tlb_start_vma(), where most architectures
flush caches as necessary.  The flush here seems to make the
flush_cache_range() in zap_page_range() redundant, and therefore can be
removed.

into home.transmeta.com:/home/torvalds/v2.5/linux

This contains the following changes:
 - export some driver parameters in sysfs
 - use new module parameter definitions

This contains the following changes:
 - EOT detection fixed when writing in fixed block mode
 - asynchronous writes in fixed block mode and write threshold removed
   to enable the EOT fixes (the parameter accepted for compatibility)

This contains the following changes:
 - ILI fixed to work with really old drives
 - message printed in case block larger than read()
 - long timeout used when creating a tape partition

I managed to add a bug to the local APIC NMI watchdog's
resume procedure in the driver model conversion for 2.5.67.
The problem is that the resume procedure simply calls the
enable procedure. If the NMI watchdog has been disabled by
another driver (like oprofile or perfctr), then the NMI
watchdog will incorrectly be re-enabled.

I discovered this when updating the perfctr driver for 2.5.67
and seeing unexpected NMIs after a resume from apm --suspend.

We can fix this by unregistering the NMI watchdog from the
driver model when disabling it (like the code did before the
driver model changes), or by remembering the previous state
at suspend and checking it at resume. The patch below uses
the second, simpler, approach. Tested, please apply.

into home.transmeta.com:/home/torvalds/v2.5/linux

into home.transmeta.com:/home/torvalds/v2.5/linux