I think we should make it explicit that PCI IRQs shouldn't be relied
upon until after pci_enable_device().  This patch:

    ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.7-rc3/2.6.7-rc3-mm1/broken-out/bk-acpi.patch

does PCI interrupt routing (based on ACPI _PRT) and IRQ allocation
at pci_enable_device()-time.

(To avoid breaking things in 2.6, the above patch still allocates
all PCI IRQs in pci_acpi_init(), before any drivers are initialized.
But that shouldn't be needed by correct drivers, and I'd like to
remove it in 2.7.)
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Fixes interrupt routing on acer travelmate 360 notebooks.  it looks like
the bios assigned the wrong pirq value for the cardbus bridge.  just
assigning irq 10 to all devices with pirq 0x63 would break second usb port.
pirq 0x68 seems to be right one for cardbus.
Signed-off-by: Daniel Ritz <daniel.ritz@gmx.ch>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

Here is the updated patch (against 2.6.7-rc1) for the shpchp and pciehp
drivers that fixes the following issues:
- proper LED status when latch is open or card is not present while the
  user tries to power up the slot; (reported by D. Keck)
- check if kmalloc() return NULL before proceeding in acpi_get__hpp();
  (provided by L. Capitulino)
- add up(&ctrl->crit_sect) before return in error cases in several
  places;
- proper handling of resources when there are other onboard devices
  behind the p2p bridge that has the hot-plug capabaility;
- need to check negotiated link width in check_lnk_status();
- cleanup board_added() in pciehp
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

assorted minor bits in drivers/* - all independent, but there's
some limit to splitting stuff...

several pointers in ioctl structures marked as userland ones.

And that's it with this patchset.  A couple more of those and we'll
be done with the noise warnings ;-)

s2io.c: bogus initializer ({{"a"},{"b"}} has too many braces for
two-dimensional array of char - strings are arrays themselves).

de4x5.h: missing __user on a pointer in ioctl structure. 

airo.c: cleaned up and fixed procfs ->read() and ->write()

osst.c, st.c, scsi_debug.c annotated.

selinuxfs.c annotated

	b44.c: ->ioctl() is broken, since it uses &ifr->ifr_data instead of
ifr->ifr_data itself.  Surprise, surprise, copy_from_user() on that address
doesn't do any good...

	baycom_epp.c: does get_user() of the first word of structure, then
immediately does copy_from_user() on the entire thing and completely ignores
the value read by get_user() (it uses the same value in copied structure
instead).  Bogus get_user() call removed.

->ifr_data users annotated.

Some code that is used on iSeries (do_hash_page_DSI in head.S) was
clearing the RI (recoverable interrupt) bit in the MSR when it
shouldn't.  We were getting SLB miss interrupts following that which
were panicking because they appeared to have occurred at a bad place.
This patch fixes the problem.  In fact it isn't necessary for
do_hash_page_DSI to do anything to RI, so the patch changes the code
to not set or clear it.
Signed-off-by: Paul Mackerras <paulus@samba.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

net/bridge partially annotated.

There are nasty problems with net/bridge/netfilter/* and they'll need to
be dealt with at some point - it mixes kernel and userland pointers a
lot and while it seems to avoid obvious breakage, it's not a nice code.

econet partially annotated.

It's still badly broken - it mixes userland and kernel chunks in the
same iovec, then does set_fs(KERNEL_FS) and sends that to
sock_sendmsg().  Do we still want to support that protocol family,
anyway?