Dumb Typo(tm) - the first bug caught by 0/NULL checks (arg is
really a kernel pointer there, so memset() is actually OK - results
will be copied to userland by caller.  Or would be, if we would not
oops  ;-)

	ipc compat code switched to compat_alloc_user_space() and annotated.

	ss_sp in struct sigaltstack made __user
	->si_addr and ->sival_ptr made __user
	your ->sa_restorer and ->sa_handler changes propagated
	users of these guys annotated on i386/amd64/alpha/sparc/sparc64

	Missing bits of cpumask_t conversion

	* added usual CHECK assignment in Makefile
	* switched uaccess.h to __check_uptr()
	* added L on long constants (ones missed earlier)
	* added __user in osf_sys.c (duh - I've added __user to cast in
the initializer, but forgot to add it in declaration)

	a) vfc is not 64bit-clean, marked as such in Kconfig
	b) aurora is simply broken - still uses tqueues.  Marked as broken.
	c) vfc does dereferencing of userland pointer, right after having
carefully copied the data to kernel space ;-)  Fixed.
	d) vfc ->mmap() had missed prototype change.  Fixed.
	e) BPP ioctls are misdeclared - they should've been _IO(...) instead
of _IOR(..., void).  Too late to fix, but we can at least make them
_IOR(..., char) - same value, but doesn't try to find sizeof(void).

	tms380tr is used both by ISA and PCI drivers.  Enabling/disabling
DMA is done only for ISA ones (it's protected by if (dev->dma > 0) and
PCI ones leave it 0), but it's compiled unconditionally.  Which breaks
on platforms that don't have that ISA crap at all, but support PCI just
fine.  Code in question placed under ifdef CONFIG_ISA.

bitrot strikes again...

direct write to userland pointer.

	Division by zero is an ugly thing...  We are safe wrt overflows,
since the maximal value we ever pass is 10000 - not enough to overflow
unless you've got a platform with HZ > 200000.

	usb ioctls in compat_ioctl.c switched to compat_alloc_user_space()
and cleaned up; ioctl structures annotated.

In handling of VIDIOCSWIN for 32bit on 64bit platforms:
	* switched to compat_alloc_user_space()
	* fixed memory corruption in copying arguments from userland
	* fixed arithmetic overflows
	* added missing checks for get_user() results
	  and corresponding returns with -EFAULT.

 - afs and rxrpc switched to kvec; definition of kvec moved to uio.h (duh).
 - afs/mntpt.c got missing cast added.

at that point afs is sparse-clean and rxrpc has only one remaining warning
(setsockopt from local variable, protected by set_fs()).

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Signed-off-by: Steve French (sfrench@us.ibm.com)

Fixing problem mentioned by Jeremy Allison

remove spurious warning message logged on mount with credentials file (pointed 
out by Richard Hughes)

Signed-off-by: Steve French (sfrench@us.ibm.com)

Signed-off-by: Steve French (sfrench@us.ibm.com)

into hostme.bitkeeper.com:/repos/c/cifs/linux-2.5cifs

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Patch from Ben Dooks

Fixes calculation of how many bytes in the RX/TX FIFOs.

Previous code failed to check wether the full flags 
where set before returning the byte counter. This
should ensure that the serial driver behaves correctly
when the FIFO fills, and not just ignore the input
data

into ppc970.osdl.org:/home/torvalds/v2.6/linux

Patch from Ben Dooks

Place correct machine name for VR1000 in machine
support file.

Patch from John Lenz

make collie use the new INIT_MACHINE macro instead of arch_initcall.

into ppc970.osdl.org:/home/torvalds/v2.6/linux

This patch adds an architecture-specific callout after explicit
processor migrations.  The callout allows architectures (or platforms)
to update TLB specific information (ex., cpu_vm_mask).
Signed-off-by: Jack Steiner <steiner@sgi.com>
Signed-off-by: David Mosberger <davidm@hpl.hp.com>

into tiger.hpl.hp.com:/data1/bk/lia64/to-linus-2.5

into nuts.davemloft.net:/disk1/BK/sparc-2.6

Make mca.c build again with debug enabled.
Signed-off-by: Keith Owens <kaos@sgi.com>
Signed-off-by: David Mosberger <davidm@hpl.hp.com>

copy_from_user() moved from dvb_ringbuffer_{write,pkt_write}() to callers;
these functions are always getting kernel pointer now.  "usermem" argument
killed, code annotated.