From 8368ea5c80c40774b23ac42fc2fead51df833ad0 Mon Sep 17 00:00:00 2001
From: Andrea Gelmini <andrea.gelmini@gelma.net>
Date: Thu, 5 Aug 2010 15:51:25 +0200
Subject: [PATCH] --- yaml --- r: 211285 b: refs/heads/master c:
 eefc3f329d93404bfe1285d5b2f4380fede42e89 h: refs/heads/master i:   211283:
 6ef57f26ca9ed2a19b225cd0a4a2d004c080f6f9 v: v3

---
 [refs]                                        |  2 +-
 trunk/arch/arm/oprofile/common.c              |  7 +--
 trunk/arch/avr32/kernel/module.c              |  3 +-
 trunk/arch/h8300/kernel/module.c              |  3 +-
 trunk/arch/mips/kernel/kgdb.c                 |  2 +-
 trunk/arch/mn10300/kernel/module.c            |  3 +-
 trunk/arch/parisc/kernel/module.c             |  3 +-
 trunk/arch/powerpc/kernel/module.c            |  6 ++
 trunk/arch/powerpc/platforms/512x/clock.c     |  2 +-
 trunk/arch/powerpc/platforms/52xx/efika.c     |  9 +--
 .../powerpc/platforms/52xx/mpc52xx_common.c   |  8 +--
 trunk/arch/s390/kernel/module.c               |  3 +-
 trunk/arch/sh/kernel/module.c                 |  2 +
 trunk/arch/um/drivers/net_kern.c              | 17 ++++-
 .../arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c | 18 ++----
 trunk/arch/x86/kernel/cpu/perf_event_p4.c     |  6 +-
 trunk/arch/x86/kernel/module.c                |  3 +-
 trunk/arch/x86/oprofile/nmi_int.c             |  1 -
 trunk/arch/x86/xen/time.c                     |  5 +-
 trunk/drivers/gpu/drm/i915/i915_dma.c         |  6 +-
 trunk/drivers/gpu/drm/i915/i915_gem.c         | 46 ++++++--------
 trunk/drivers/gpu/drm/i915/i915_gem_evict.c   | 45 ++++++++------
 trunk/drivers/gpu/drm/i915/intel_display.c    | 62 +++++++------------
 trunk/drivers/gpu/drm/i915/intel_dp.c         | 19 +++---
 trunk/drivers/gpu/drm/i915/intel_drv.h        |  1 +
 trunk/drivers/hwmon/f71882fg.c                | 32 ++++------
 .../net/wireless/iwlwifi/iwl-agn-lib.c        |  2 +-
 .../net/wireless/iwlwifi/iwl3945-base.c       |  2 +-
 trunk/drivers/regulator/core.c                |  6 +-
 trunk/drivers/regulator/max8649.c             |  2 +-
 trunk/drivers/spi/spi.c                       |  5 --
 trunk/drivers/spi/spi_gpio.c                  |  2 +-
 trunk/drivers/spi/spi_mpc8xxx.c               | 10 +--
 trunk/drivers/xen/xenbus/xenbus_probe.c       |  9 +--
 trunk/fs/fs-writeback.c                       | 19 ++++--
 trunk/fs/fuse/dev.c                           |  2 +-
 trunk/include/linux/module.h                  |  5 +-
 trunk/include/linux/rcupdate.h                |  2 +-
 trunk/include/linux/wait.h                    |  1 -
 trunk/kernel/module.c                         |  4 --
 trunk/kernel/smp.c                            | 17 +----
 trunk/lib/bug.c                               |  6 +-
 trunk/mm/ksm.c                                |  6 +-
 trunk/mm/rmap.c                               |  8 +--
 trunk/net/8021q/vlan_core.c                   | 14 ++---
 trunk/net/ipv4/Kconfig                        |  1 -
 trunk/net/ipv4/tcp_timer.c                    | 24 +++----
 trunk/net/mac80211/rx.c                       |  4 ++
 trunk/net/phonet/pep.c                        |  3 +-
 trunk/sound/core/control.c                    |  5 --
 trunk/sound/i2c/other/ak4xxx-adda.c           |  2 +-
 trunk/tools/perf/Makefile                     |  2 +-
 trunk/tools/perf/util/trace-event-scripting.c |  4 +-
 trunk/tools/perf/util/ui/browsers/hists.c     |  2 +-
 54 files changed, 214 insertions(+), 269 deletions(-)

diff --git a/[refs] b/[refs]
index a1a14263fcbc..94c023caf8ad 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 089eed29b4021f8b68ec3d1746a1f9b9c4f04783
+refs/heads/master: eefc3f329d93404bfe1285d5b2f4380fede42e89
diff --git a/trunk/arch/arm/oprofile/common.c b/trunk/arch/arm/oprofile/common.c
index 72e09eb642dd..0691176899ff 100644
--- a/trunk/arch/arm/oprofile/common.c
+++ b/trunk/arch/arm/oprofile/common.c
@@ -102,7 +102,6 @@ static int op_create_counter(int cpu, int event)
 	if (IS_ERR(pevent)) {
 		ret = PTR_ERR(pevent);
 	} else if (pevent->state != PERF_EVENT_STATE_ACTIVE) {
-		perf_event_release_kernel(pevent);
 		pr_warning("oprofile: failed to enable event %d "
 				"on CPU %d\n", event, cpu);
 		ret = -EBUSY;
@@ -366,7 +365,6 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
 	ret = init_driverfs();
 	if (ret) {
 		kfree(counter_config);
-		counter_config = NULL;
 		return ret;
 	}
 
@@ -404,6 +402,7 @@ void oprofile_arch_exit(void)
 	struct perf_event *event;
 
 	if (*perf_events) {
+		exit_driverfs();
 		for_each_possible_cpu(cpu) {
 			for (id = 0; id < perf_num_counters; ++id) {
 				event = perf_events[cpu][id];
@@ -414,10 +413,8 @@ void oprofile_arch_exit(void)
 		}
 	}
 
-	if (counter_config) {
+	if (counter_config)
 		kfree(counter_config);
-		exit_driverfs();
-	}
 }
 #else
 int __init oprofile_arch_init(struct oprofile_operations *ops)
diff --git a/trunk/arch/avr32/kernel/module.c b/trunk/arch/avr32/kernel/module.c
index a727f54d64d6..98f94d041d9c 100644
--- a/trunk/arch/avr32/kernel/module.c
+++ b/trunk/arch/avr32/kernel/module.c
@@ -314,9 +314,10 @@ int module_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
 	vfree(module->arch.syminfo);
 	module->arch.syminfo = NULL;
 
-	return 0;
+	return module_bug_finalize(hdr, sechdrs, module);
 }
 
 void module_arch_cleanup(struct module *module)
 {
+	module_bug_cleanup(module);
 }
diff --git a/trunk/arch/h8300/kernel/module.c b/trunk/arch/h8300/kernel/module.c
index db4953dc4e1b..0865e291c20d 100644
--- a/trunk/arch/h8300/kernel/module.c
+++ b/trunk/arch/h8300/kernel/module.c
@@ -112,9 +112,10 @@ int module_finalize(const Elf_Ehdr *hdr,
 		    const Elf_Shdr *sechdrs,
 		    struct module *me)
 {
-	return 0;
+	return module_bug_finalize(hdr, sechdrs, me);
 }
 
 void module_arch_cleanup(struct module *mod)
 {
+	module_bug_cleanup(mod);
 }
diff --git a/trunk/arch/mips/kernel/kgdb.c b/trunk/arch/mips/kernel/kgdb.c
index 1f4e2fa64140..f4546e97c60d 100644
--- a/trunk/arch/mips/kernel/kgdb.c
+++ b/trunk/arch/mips/kernel/kgdb.c
@@ -283,7 +283,7 @@ static int kgdb_mips_notify(struct notifier_block *self, unsigned long cmd,
 	struct pt_regs *regs = args->regs;
 	int trap = (regs->cp0_cause & 0x7c) >> 2;
 
-	/* Userpace events, ignore. */
+	/* Userspace events, ignore. */
 	if (user_mode(regs))
 		return NOTIFY_DONE;
 
diff --git a/trunk/arch/mn10300/kernel/module.c b/trunk/arch/mn10300/kernel/module.c
index 196a111e2e29..6aea7fd76993 100644
--- a/trunk/arch/mn10300/kernel/module.c
+++ b/trunk/arch/mn10300/kernel/module.c
@@ -206,7 +206,7 @@ int module_finalize(const Elf_Ehdr *hdr,
 		    const Elf_Shdr *sechdrs,
 		    struct module *me)
 {
-	return 0;
+	return module_bug_finalize(hdr, sechdrs, me);
 }
 
 /*
@@ -214,4 +214,5 @@ int module_finalize(const Elf_Ehdr *hdr,
  */
 void module_arch_cleanup(struct module *mod)
 {
+	module_bug_cleanup(mod);
 }
diff --git a/trunk/arch/parisc/kernel/module.c b/trunk/arch/parisc/kernel/module.c
index 6e81bb596e5b..159a2b81e90c 100644
--- a/trunk/arch/parisc/kernel/module.c
+++ b/trunk/arch/parisc/kernel/module.c
@@ -941,10 +941,11 @@ int module_finalize(const Elf_Ehdr *hdr,
 	nsyms = newptr - (Elf_Sym *)symhdr->sh_addr;
 	DEBUGP("NEW num_symtab %lu\n", nsyms);
 	symhdr->sh_size = nsyms * sizeof(Elf_Sym);
-	return 0;
+	return module_bug_finalize(hdr, sechdrs, me);
 }
 
 void module_arch_cleanup(struct module *mod)
 {
 	deregister_unwind_table(mod);
+	module_bug_cleanup(mod);
 }
diff --git a/trunk/arch/powerpc/kernel/module.c b/trunk/arch/powerpc/kernel/module.c
index 49cee9df225b..477c663e0140 100644
--- a/trunk/arch/powerpc/kernel/module.c
+++ b/trunk/arch/powerpc/kernel/module.c
@@ -63,6 +63,11 @@ int module_finalize(const Elf_Ehdr *hdr,
 		const Elf_Shdr *sechdrs, struct module *me)
 {
 	const Elf_Shdr *sect;
+	int err;
+
+	err = module_bug_finalize(hdr, sechdrs, me);
+	if (err)
+		return err;
 
 	/* Apply feature fixups */
 	sect = find_section(hdr, sechdrs, "__ftr_fixup");
@@ -96,4 +101,5 @@ int module_finalize(const Elf_Ehdr *hdr,
 
 void module_arch_cleanup(struct module *mod)
 {
+	module_bug_cleanup(mod);
 }
diff --git a/trunk/arch/powerpc/platforms/512x/clock.c b/trunk/arch/powerpc/platforms/512x/clock.c
index 3dc2a8d262b8..5b243bd3eb3b 100644
--- a/trunk/arch/powerpc/platforms/512x/clock.c
+++ b/trunk/arch/powerpc/platforms/512x/clock.c
@@ -57,7 +57,7 @@ static struct clk *mpc5121_clk_get(struct device *dev, const char *id)
 	int id_match = 0;
 
 	if (dev == NULL || id == NULL)
-		return clk;
+		return NULL;
 
 	mutex_lock(&clocks_mutex);
 	list_for_each_entry(p, &clocks, node) {
diff --git a/trunk/arch/powerpc/platforms/52xx/efika.c b/trunk/arch/powerpc/platforms/52xx/efika.c
index 18c104820198..45c0cb9b67e6 100644
--- a/trunk/arch/powerpc/platforms/52xx/efika.c
+++ b/trunk/arch/powerpc/platforms/52xx/efika.c
@@ -99,7 +99,7 @@ static void __init efika_pcisetup(void)
 	if (bus_range == NULL || len < 2 * sizeof(int)) {
 		printk(KERN_WARNING EFIKA_PLATFORM_NAME
 		       ": Can't get bus-range for %s\n", pcictrl->full_name);
-		goto out_put;
+		return;
 	}
 
 	if (bus_range[1] == bus_range[0])
@@ -111,12 +111,12 @@ static void __init efika_pcisetup(void)
 	printk(" controlled by %s\n", pcictrl->full_name);
 	printk("\n");
 
-	hose = pcibios_alloc_controller(pcictrl);
+	hose = pcibios_alloc_controller(of_node_get(pcictrl));
 	if (!hose) {
 		printk(KERN_WARNING EFIKA_PLATFORM_NAME
 		       ": Can't allocate PCI controller structure for %s\n",
 		       pcictrl->full_name);
-		goto out_put;
+		return;
 	}
 
 	hose->first_busno = bus_range[0];
@@ -124,9 +124,6 @@ static void __init efika_pcisetup(void)
 	hose->ops = &rtas_pci_ops;
 
 	pci_process_bridge_OF_ranges(hose, pcictrl, 0);
-	return;
-out_put:
-	of_node_put(pcictrl);
 }
 
 #else
diff --git a/trunk/arch/powerpc/platforms/52xx/mpc52xx_common.c b/trunk/arch/powerpc/platforms/52xx/mpc52xx_common.c
index 41f3a7eda1de..6e905314ad5d 100644
--- a/trunk/arch/powerpc/platforms/52xx/mpc52xx_common.c
+++ b/trunk/arch/powerpc/platforms/52xx/mpc52xx_common.c
@@ -325,16 +325,12 @@ int mpc5200_psc_ac97_gpio_reset(int psc_number)
 	clrbits32(&simple_gpio->simple_dvo, sync | out);
 	clrbits8(&wkup_gpio->wkup_dvo, reset);
 
-	/* wait for 1 us */
-	udelay(1);
+	/* wait at lease 1 us */
+	udelay(2);
 
 	/* Deassert reset */
 	setbits8(&wkup_gpio->wkup_dvo, reset);
 
-	/* wait at least 200ns */
-	/* 7 ~= (200ns * timebase) / ns2sec */
-	__delay(7);
-
 	/* Restore pin-muxing */
 	out_be32(&simple_gpio->port_config, mux);
 
diff --git a/trunk/arch/s390/kernel/module.c b/trunk/arch/s390/kernel/module.c
index f7167ee4604c..22cfd634c355 100644
--- a/trunk/arch/s390/kernel/module.c
+++ b/trunk/arch/s390/kernel/module.c
@@ -407,9 +407,10 @@ int module_finalize(const Elf_Ehdr *hdr,
 {
 	vfree(me->arch.syminfo);
 	me->arch.syminfo = NULL;
-	return 0;
+	return module_bug_finalize(hdr, sechdrs, me);
 }
 
 void module_arch_cleanup(struct module *mod)
 {
+	module_bug_cleanup(mod);
 }
diff --git a/trunk/arch/sh/kernel/module.c b/trunk/arch/sh/kernel/module.c
index ae0be697a89e..43adddfe4c04 100644
--- a/trunk/arch/sh/kernel/module.c
+++ b/trunk/arch/sh/kernel/module.c
@@ -149,11 +149,13 @@ int module_finalize(const Elf_Ehdr *hdr,
 	int ret = 0;
 
 	ret |= module_dwarf_finalize(hdr, sechdrs, me);
+	ret |= module_bug_finalize(hdr, sechdrs, me);
 
 	return ret;
 }
 
 void module_arch_cleanup(struct module *mod)
 {
+	module_bug_cleanup(mod);
 	module_dwarf_cleanup(mod);
 }
diff --git a/trunk/arch/um/drivers/net_kern.c b/trunk/arch/um/drivers/net_kern.c
index 47d0c37897d5..2ab233ba32c1 100644
--- a/trunk/arch/um/drivers/net_kern.c
+++ b/trunk/arch/um/drivers/net_kern.c
@@ -255,6 +255,18 @@ static void uml_net_tx_timeout(struct net_device *dev)
 	netif_wake_queue(dev);
 }
 
+static int uml_net_set_mac(struct net_device *dev, void *addr)
+{
+	struct uml_net_private *lp = netdev_priv(dev);
+	struct sockaddr *hwaddr = addr;
+
+	spin_lock_irq(&lp->lock);
+	eth_mac_addr(dev, hwaddr->sa_data);
+	spin_unlock_irq(&lp->lock);
+
+	return 0;
+}
+
 static int uml_net_change_mtu(struct net_device *dev, int new_mtu)
 {
 	dev->mtu = new_mtu;
@@ -361,7 +373,7 @@ static const struct net_device_ops uml_netdev_ops = {
 	.ndo_start_xmit 	= uml_net_start_xmit,
 	.ndo_set_multicast_list = uml_net_set_multicast_list,
 	.ndo_tx_timeout 	= uml_net_tx_timeout,
-	.ndo_set_mac_address	= eth_mac_addr,
+	.ndo_set_mac_address	= uml_net_set_mac,
 	.ndo_change_mtu 	= uml_net_change_mtu,
 	.ndo_validate_addr	= eth_validate_addr,
 };
@@ -460,8 +472,7 @@ static void eth_configure(int n, void *init, char *mac,
 	    ((*transport->user->init)(&lp->user, dev) != 0))
 		goto out_unregister;
 
-	/* don't use eth_mac_addr, it will not work here */
-	memcpy(dev->dev_addr, device->mac, ETH_ALEN);
+	eth_mac_addr(dev, device->mac);
 	dev->mtu = transport->user->mtu;
 	dev->netdev_ops = &uml_netdev_ops;
 	dev->ethtool_ops = &uml_net_ethtool_ops;
diff --git a/trunk/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c b/trunk/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
index 4f6f679f2799..994230d4dc4e 100644
--- a/trunk/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
+++ b/trunk/arch/x86/kernel/cpu/cpufreq/pcc-cpufreq.c
@@ -368,22 +368,16 @@ static int __init pcc_cpufreq_do_osc(acpi_handle *handle)
 		return -ENODEV;
 
 	out_obj = output.pointer;
-	if (out_obj->type != ACPI_TYPE_BUFFER) {
-		ret = -ENODEV;
-		goto out_free;
-	}
+	if (out_obj->type != ACPI_TYPE_BUFFER)
+		return -ENODEV;
 
 	errors = *((u32 *)out_obj->buffer.pointer) & ~(1 << 0);
-	if (errors) {
-		ret = -ENODEV;
-		goto out_free;
-	}
+	if (errors)
+		return -ENODEV;
 
 	supported = *((u32 *)(out_obj->buffer.pointer + 4));
-	if (!(supported & 0x1)) {
-		ret = -ENODEV;
-		goto out_free;
-	}
+	if (!(supported & 0x1))
+		return -ENODEV;
 
 out_free:
 	kfree(output.pointer);
diff --git a/trunk/arch/x86/kernel/cpu/perf_event_p4.c b/trunk/arch/x86/kernel/cpu/perf_event_p4.c
index 249015173992..b560db3305be 100644
--- a/trunk/arch/x86/kernel/cpu/perf_event_p4.c
+++ b/trunk/arch/x86/kernel/cpu/perf_event_p4.c
@@ -660,12 +660,8 @@ static int p4_pmu_handle_irq(struct pt_regs *regs)
 	for (idx = 0; idx < x86_pmu.num_counters; idx++) {
 		int overflow;
 
-		if (!test_bit(idx, cpuc->active_mask)) {
-			/* catch in-flight IRQs */
-			if (__test_and_clear_bit(idx, cpuc->running))
-				handled++;
+		if (!test_bit(idx, cpuc->active_mask))
 			continue;
-		}
 
 		event = cpuc->events[idx];
 		hwc = &event->hw;
diff --git a/trunk/arch/x86/kernel/module.c b/trunk/arch/x86/kernel/module.c
index 1c355c550960..e0bc186d7501 100644
--- a/trunk/arch/x86/kernel/module.c
+++ b/trunk/arch/x86/kernel/module.c
@@ -239,10 +239,11 @@ int module_finalize(const Elf_Ehdr *hdr,
 		apply_paravirt(pseg, pseg + para->sh_size);
 	}
 
-	return 0;
+	return module_bug_finalize(hdr, sechdrs, me);
 }
 
 void module_arch_cleanup(struct module *mod)
 {
 	alternatives_smp_module_del(mod);
+	module_bug_cleanup(mod);
 }
diff --git a/trunk/arch/x86/oprofile/nmi_int.c b/trunk/arch/x86/oprofile/nmi_int.c
index f1575c9a2572..009b819f48d0 100644
--- a/trunk/arch/x86/oprofile/nmi_int.c
+++ b/trunk/arch/x86/oprofile/nmi_int.c
@@ -674,7 +674,6 @@ static int __init ppro_init(char **cpu_type)
 	case 0x0f:
 	case 0x16:
 	case 0x17:
-	case 0x1d:
 		*cpu_type = "i386/core_2";
 		break;
 	case 0x1a:
diff --git a/trunk/arch/x86/xen/time.c b/trunk/arch/x86/xen/time.c
index b2bb5aa3b054..1a5353a753fc 100644
--- a/trunk/arch/x86/xen/time.c
+++ b/trunk/arch/x86/xen/time.c
@@ -489,9 +489,8 @@ static void xen_hvm_setup_cpu_clockevents(void)
 __init void xen_hvm_init_time_ops(void)
 {
 	/* vector callback is needed otherwise we cannot receive interrupts
-	 * on cpu > 0 and at this point we don't know how many cpus are
-	 * available */
-	if (!xen_have_vector_callback)
+	 * on cpu > 0 */
+	if (!xen_have_vector_callback && num_present_cpus() > 1)
 		return;
 	if (!xen_feature(XENFEAT_hvm_safe_pvclock)) {
 		printk(KERN_INFO "Xen doesn't support pvclock on HVM,"
diff --git a/trunk/drivers/gpu/drm/i915/i915_dma.c b/trunk/drivers/gpu/drm/i915/i915_dma.c
index c74e4e8006d4..9d67b4853030 100644
--- a/trunk/drivers/gpu/drm/i915/i915_dma.c
+++ b/trunk/drivers/gpu/drm/i915/i915_dma.c
@@ -1787,9 +1787,9 @@ unsigned long i915_chipset_val(struct drm_i915_private *dev_priv)
 		}
 	}
 
-	diff = div_u64(diff, diff1);
+	div_u64(diff, diff1);
 	ret = ((m * diff) + c);
-	ret = div_u64(ret, 10);
+	div_u64(ret, 10);
 
 	dev_priv->last_count1 = total_count;
 	dev_priv->last_time1 = now;
@@ -1858,7 +1858,7 @@ void i915_update_gfx_val(struct drm_i915_private *dev_priv)
 
 	/* More magic constants... */
 	diff = diff * 1181;
-	diff = div_u64(diff, diffms * 10);
+	div_u64(diff, diffms * 10);
 	dev_priv->gfx_power = diff;
 }
 
diff --git a/trunk/drivers/gpu/drm/i915/i915_gem.c b/trunk/drivers/gpu/drm/i915/i915_gem.c
index 90b1d6753b9d..2a0025f3e98e 100644
--- a/trunk/drivers/gpu/drm/i915/i915_gem.c
+++ b/trunk/drivers/gpu/drm/i915/i915_gem.c
@@ -469,17 +469,14 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
 		return -ENOENT;
 	obj_priv = to_intel_bo(obj);
 
-	/* Bounds check source.  */
-	if (args->offset > obj->size || args->size > obj->size - args->offset) {
-		ret = -EINVAL;
-		goto err;
-	}
-
-	if (!access_ok(VERIFY_WRITE,
-		       (char __user *)(uintptr_t)args->data_ptr,
-		       args->size)) {
-		ret = -EFAULT;
-		goto err;
+	/* Bounds check source.
+	 *
+	 * XXX: This could use review for overflow issues...
+	 */
+	if (args->offset > obj->size || args->size > obj->size ||
+	    args->offset + args->size > obj->size) {
+		drm_gem_object_unreference_unlocked(obj);
+		return -EINVAL;
 	}
 
 	if (i915_gem_object_needs_bit17_swizzle(obj)) {
@@ -491,8 +488,8 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
 							file_priv);
 	}
 
-err:
 	drm_gem_object_unreference_unlocked(obj);
+
 	return ret;
 }
 
@@ -581,6 +578,8 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
 
 	user_data = (char __user *) (uintptr_t) args->data_ptr;
 	remain = args->size;
+	if (!access_ok(VERIFY_READ, user_data, remain))
+		return -EFAULT;
 
 
 	mutex_lock(&dev->struct_mutex);
@@ -933,17 +932,14 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
 		return -ENOENT;
 	obj_priv = to_intel_bo(obj);
 
-	/* Bounds check destination. */
-	if (args->offset > obj->size || args->size > obj->size - args->offset) {
-		ret = -EINVAL;
-		goto err;
-	}
-
-	if (!access_ok(VERIFY_READ,
-		       (char __user *)(uintptr_t)args->data_ptr,
-		       args->size)) {
-		ret = -EFAULT;
-		goto err;
+	/* Bounds check destination.
+	 *
+	 * XXX: This could use review for overflow issues...
+	 */
+	if (args->offset > obj->size || args->size > obj->size ||
+	    args->offset + args->size > obj->size) {
+		drm_gem_object_unreference_unlocked(obj);
+		return -EINVAL;
 	}
 
 	/* We can only do the GTT pwrite on untiled buffers, as otherwise
@@ -977,8 +973,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
 		DRM_INFO("pwrite failed %d\n", ret);
 #endif
 
-err:
 	drm_gem_object_unreference_unlocked(obj);
+
 	return ret;
 }
 
@@ -3260,8 +3256,6 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
 				  (int) reloc->offset,
 				  reloc->read_domains,
 				  reloc->write_domain);
-			drm_gem_object_unreference(target_obj);
-			i915_gem_object_unpin(obj);
 			return -EINVAL;
 		}
 		if (reloc->write_domain & I915_GEM_DOMAIN_CPU ||
diff --git a/trunk/drivers/gpu/drm/i915/i915_gem_evict.c b/trunk/drivers/gpu/drm/i915/i915_gem_evict.c
index 5c428fa3e0b3..e85246ef691c 100644
--- a/trunk/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/trunk/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -93,7 +93,7 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
 {
 	drm_i915_private_t *dev_priv = dev->dev_private;
 	struct list_head eviction_list, unwind_list;
-	struct drm_i915_gem_object *obj_priv;
+	struct drm_i915_gem_object *obj_priv, *tmp_obj_priv;
 	struct list_head *render_iter, *bsd_iter;
 	int ret = 0;
 
@@ -175,34 +175,39 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
 	return -ENOSPC;
 
 found:
-	/* drm_mm doesn't allow any other other operations while
-	 * scanning, therefore store to be evicted objects on a
-	 * temporary list. */
 	INIT_LIST_HEAD(&eviction_list);
-	while (!list_empty(&unwind_list)) {
-		obj_priv = list_first_entry(&unwind_list,
-					    struct drm_i915_gem_object,
-					    evict_list);
+	list_for_each_entry_safe(obj_priv, tmp_obj_priv,
+				 &unwind_list, evict_list) {
 		if (drm_mm_scan_remove_block(obj_priv->gtt_space)) {
+			/* drm_mm doesn't allow any other other operations while
+			 * scanning, therefore store to be evicted objects on a
+			 * temporary list. */
 			list_move(&obj_priv->evict_list, &eviction_list);
-			continue;
-		}
-		list_del(&obj_priv->evict_list);
-		drm_gem_object_unreference(&obj_priv->base);
+		} else
+			drm_gem_object_unreference(&obj_priv->base);
 	}
 
 	/* Unbinding will emit any required flushes */
-	while (!list_empty(&eviction_list)) {
-		obj_priv = list_first_entry(&eviction_list,
-					    struct drm_i915_gem_object,
-					    evict_list);
-		if (ret == 0)
-			ret = i915_gem_object_unbind(&obj_priv->base);
-		list_del(&obj_priv->evict_list);
+	list_for_each_entry_safe(obj_priv, tmp_obj_priv,
+				 &eviction_list, evict_list) {
+#if WATCH_LRU
+		DRM_INFO("%s: evicting %p\n", __func__, &obj_priv->base);
+#endif
+		ret = i915_gem_object_unbind(&obj_priv->base);
+		if (ret)
+			return ret;
+
 		drm_gem_object_unreference(&obj_priv->base);
 	}
 
-	return ret;
+	/* The just created free hole should be on the top of the free stack
+	 * maintained by drm_mm, so this BUG_ON actually executes in O(1).
+	 * Furthermore all accessed data has just recently been used, so it
+	 * should be really fast, too. */
+	BUG_ON(!drm_mm_search_free(&dev_priv->mm.gtt_space, min_size,
+				   alignment, 0));
+
+	return 0;
 }
 
 int
diff --git a/trunk/drivers/gpu/drm/i915/intel_display.c b/trunk/drivers/gpu/drm/i915/intel_display.c
index 979228594599..b5bf51a4502d 100644
--- a/trunk/drivers/gpu/drm/i915/intel_display.c
+++ b/trunk/drivers/gpu/drm/i915/intel_display.c
@@ -1013,8 +1013,8 @@ void intel_wait_for_vblank(struct drm_device *dev, int pipe)
 		DRM_DEBUG_KMS("vblank wait timed out\n");
 }
 
-/*
- * intel_wait_for_pipe_off - wait for pipe to turn off
+/**
+ * intel_wait_for_vblank_off - wait for vblank after disabling a pipe
  * @dev: drm device
  * @pipe: pipe to wait for
  *
@@ -1022,39 +1022,25 @@ void intel_wait_for_vblank(struct drm_device *dev, int pipe)
  * spinning on the vblank interrupt status bit, since we won't actually
  * see an interrupt when the pipe is disabled.
  *
- * On Gen4 and above:
- *   wait for the pipe register state bit to turn off
- *
- * Otherwise:
- *   wait for the display line value to settle (it usually
- *   ends up stopping at the start of the next frame).
- *  
+ * So this function waits for the display line value to settle (it
+ * usually ends up stopping at the start of the next frame).
  */
-static void intel_wait_for_pipe_off(struct drm_device *dev, int pipe)
+void intel_wait_for_vblank_off(struct drm_device *dev, int pipe)
 {
 	struct drm_i915_private *dev_priv = dev->dev_private;
-
-	if (INTEL_INFO(dev)->gen >= 4) {
-		int pipeconf_reg = (pipe == 0 ? PIPEACONF : PIPEBCONF);
-
-		/* Wait for the Pipe State to go off */
-		if (wait_for((I915_READ(pipeconf_reg) & I965_PIPECONF_ACTIVE) == 0,
-			     100, 0))
-			DRM_DEBUG_KMS("pipe_off wait timed out\n");
-	} else {
-		u32 last_line;
-		int pipedsl_reg = (pipe == 0 ? PIPEADSL : PIPEBDSL);
-		unsigned long timeout = jiffies + msecs_to_jiffies(100);
-
-		/* Wait for the display line to settle */
-		do {
-			last_line = I915_READ(pipedsl_reg) & DSL_LINEMASK;
-			mdelay(5);
-		} while (((I915_READ(pipedsl_reg) & DSL_LINEMASK) != last_line) &&
-			 time_after(timeout, jiffies));
-		if (time_after(jiffies, timeout))
-			DRM_DEBUG_KMS("pipe_off wait timed out\n");
-	}
+	int pipedsl_reg = (pipe == 0 ? PIPEADSL : PIPEBDSL);
+	unsigned long timeout = jiffies + msecs_to_jiffies(100);
+	u32 last_line;
+
+	/* Wait for the display line to settle */
+	do {
+		last_line = I915_READ(pipedsl_reg) & DSL_LINEMASK;
+		mdelay(5);
+	} while (((I915_READ(pipedsl_reg) & DSL_LINEMASK) != last_line) &&
+		 time_after(timeout, jiffies));
+
+	if (time_after(jiffies, timeout))
+		DRM_DEBUG_KMS("vblank wait timed out\n");
 }
 
 /* Parameters have changed, update FBC info */
@@ -2342,13 +2328,13 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
 			I915_READ(dspbase_reg);
 		}
 
+		/* Wait for vblank for the disable to take effect */
+		intel_wait_for_vblank_off(dev, pipe);
+
 		/* Don't disable pipe A or pipe A PLLs if needed */
 		if (pipeconf_reg == PIPEACONF &&
-		    (dev_priv->quirks & QUIRK_PIPEA_FORCE)) {
-			/* Wait for vblank for the disable to take effect */
-			intel_wait_for_vblank(dev, pipe);
+		    (dev_priv->quirks & QUIRK_PIPEA_FORCE))
 			goto skip_pipe_off;
-		}
 
 		/* Next, disable display pipes */
 		temp = I915_READ(pipeconf_reg);
@@ -2357,8 +2343,8 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
 			I915_READ(pipeconf_reg);
 		}
 
-		/* Wait for the pipe to turn off */
-		intel_wait_for_pipe_off(dev, pipe);
+		/* Wait for vblank for the disable to take effect. */
+		intel_wait_for_vblank_off(dev, pipe);
 
 		temp = I915_READ(dpll_reg);
 		if ((temp & DPLL_VCO_ENABLE) != 0) {
diff --git a/trunk/drivers/gpu/drm/i915/intel_dp.c b/trunk/drivers/gpu/drm/i915/intel_dp.c
index 9ab8708ac6ba..1a51ee07de3e 100644
--- a/trunk/drivers/gpu/drm/i915/intel_dp.c
+++ b/trunk/drivers/gpu/drm/i915/intel_dp.c
@@ -1138,14 +1138,18 @@ static bool
 intel_dp_set_link_train(struct intel_dp *intel_dp,
 			uint32_t dp_reg_value,
 			uint8_t dp_train_pat,
-			uint8_t train_set[4])
+			uint8_t train_set[4],
+			bool first)
 {
 	struct drm_device *dev = intel_dp->base.enc.dev;
 	struct drm_i915_private *dev_priv = dev->dev_private;
+	struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.enc.crtc);
 	int ret;
 
 	I915_WRITE(intel_dp->output_reg, dp_reg_value);
 	POSTING_READ(intel_dp->output_reg);
+	if (first)
+		intel_wait_for_vblank(dev, intel_crtc->pipe);
 
 	intel_dp_aux_native_write_1(intel_dp,
 				    DP_TRAINING_PATTERN_SET,
@@ -1170,15 +1174,10 @@ intel_dp_link_train(struct intel_dp *intel_dp)
 	uint8_t voltage;
 	bool clock_recovery = false;
 	bool channel_eq = false;
+	bool first = true;
 	int tries;
 	u32 reg;
 	uint32_t DP = intel_dp->DP;
-	struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.enc.crtc);
-
-	/* Enable output, wait for it to become active */
-	I915_WRITE(intel_dp->output_reg, intel_dp->DP);
-	POSTING_READ(intel_dp->output_reg);
-	intel_wait_for_vblank(dev, intel_crtc->pipe);
 
 	/* Write the link configuration data */
 	intel_dp_aux_native_write(intel_dp, DP_LINK_BW_SET,
@@ -1211,8 +1210,9 @@ intel_dp_link_train(struct intel_dp *intel_dp)
 			reg = DP | DP_LINK_TRAIN_PAT_1;
 
 		if (!intel_dp_set_link_train(intel_dp, reg,
-					     DP_TRAINING_PATTERN_1, train_set))
+					     DP_TRAINING_PATTERN_1, train_set, first))
 			break;
+		first = false;
 		/* Set training pattern 1 */
 
 		udelay(100);
@@ -1266,7 +1266,8 @@ intel_dp_link_train(struct intel_dp *intel_dp)
 
 		/* channel eq pattern */
 		if (!intel_dp_set_link_train(intel_dp, reg,
-					     DP_TRAINING_PATTERN_2, train_set))
+					     DP_TRAINING_PATTERN_2, train_set,
+					     false))
 			break;
 
 		udelay(400);
diff --git a/trunk/drivers/gpu/drm/i915/intel_drv.h b/trunk/drivers/gpu/drm/i915/intel_drv.h
index 8828b3ac6414..ad312ca6b3e5 100644
--- a/trunk/drivers/gpu/drm/i915/intel_drv.h
+++ b/trunk/drivers/gpu/drm/i915/intel_drv.h
@@ -229,6 +229,7 @@ extern struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
 						    struct drm_crtc *crtc);
 int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
 				struct drm_file *file_priv);
+extern void intel_wait_for_vblank_off(struct drm_device *dev, int pipe);
 extern void intel_wait_for_vblank(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_crtc_from_pipe(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_load_detect_pipe(struct intel_encoder *intel_encoder,
diff --git a/trunk/drivers/hwmon/f71882fg.c b/trunk/drivers/hwmon/f71882fg.c
index 75afb3b0e076..537841ef44b9 100644
--- a/trunk/drivers/hwmon/f71882fg.c
+++ b/trunk/drivers/hwmon/f71882fg.c
@@ -111,7 +111,7 @@ static struct platform_device *f71882fg_pdev;
 /* Super-I/O Function prototypes */
 static inline int superio_inb(int base, int reg);
 static inline int superio_inw(int base, int reg);
-static inline int superio_enter(int base);
+static inline void superio_enter(int base);
 static inline void superio_select(int base, int ld);
 static inline void superio_exit(int base);
 
@@ -861,20 +861,11 @@ static int superio_inw(int base, int reg)
 	return val;
 }
 
-static inline int superio_enter(int base)
+static inline void superio_enter(int base)
 {
-	/* Don't step on other drivers' I/O space by accident */
-	if (!request_muxed_region(base, 2, DRVNAME)) {
-		printk(KERN_ERR DRVNAME ": I/O address 0x%04x already in use\n",
-				base);
-		return -EBUSY;
-	}
-
 	/* according to the datasheet the key must be send twice! */
 	outb(SIO_UNLOCK_KEY, base);
 	outb(SIO_UNLOCK_KEY, base);
-
-	return 0;
 }
 
 static inline void superio_select(int base, int ld)
@@ -886,7 +877,6 @@ static inline void superio_select(int base, int ld)
 static inline void superio_exit(int base)
 {
 	outb(SIO_LOCK_KEY, base);
-	release_region(base, 2);
 }
 
 static inline int fan_from_reg(u16 reg)
@@ -2185,15 +2175,21 @@ static int f71882fg_remove(struct platform_device *pdev)
 static int __init f71882fg_find(int sioaddr, unsigned short *address,
 	struct f71882fg_sio_data *sio_data)
 {
+	int err = -ENODEV;
 	u16 devid;
-	int err = superio_enter(sioaddr);
-	if (err)
-		return err;
+
+	/* Don't step on other drivers' I/O space by accident */
+	if (!request_region(sioaddr, 2, DRVNAME)) {
+		printk(KERN_ERR DRVNAME ": I/O address 0x%04x already in use\n",
+				(int)sioaddr);
+		return -EBUSY;
+	}
+
+	superio_enter(sioaddr);
 
 	devid = superio_inw(sioaddr, SIO_REG_MANID);
 	if (devid != SIO_FINTEK_ID) {
 		pr_debug(DRVNAME ": Not a Fintek device\n");
-		err = -ENODEV;
 		goto exit;
 	}
 
@@ -2217,7 +2213,6 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
 	default:
 		printk(KERN_INFO DRVNAME ": Unsupported Fintek device: %04x\n",
 		       (unsigned int)devid);
-		err = -ENODEV;
 		goto exit;
 	}
 
@@ -2228,14 +2223,12 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
 
 	if (!(superio_inb(sioaddr, SIO_REG_ENABLE) & 0x01)) {
 		printk(KERN_WARNING DRVNAME ": Device not activated\n");
-		err = -ENODEV;
 		goto exit;
 	}
 
 	*address = superio_inw(sioaddr, SIO_REG_ADDR);
 	if (*address == 0) {
 		printk(KERN_WARNING DRVNAME ": Base address not set\n");
-		err = -ENODEV;
 		goto exit;
 	}
 	*address &= ~(REGION_LENGTH - 1);	/* Ignore 3 LSB */
@@ -2246,6 +2239,7 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
 		(int)superio_inb(sioaddr, SIO_REG_DEVREV));
 exit:
 	superio_exit(sioaddr);
+	release_region(sioaddr, 2);
 	return err;
 }
 
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/trunk/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 8fd00a6e5120..9dd9e64c2b0b 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -1411,7 +1411,7 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 	clear_bit(STATUS_SCAN_HW, &priv->status);
 	clear_bit(STATUS_SCANNING, &priv->status);
 	/* inform mac80211 scan aborted */
-	queue_work(priv->workqueue, &priv->abort_scan);
+	queue_work(priv->workqueue, &priv->scan_completed);
 }
 
 int iwlagn_manage_ibss_station(struct iwl_priv *priv,
diff --git a/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c b/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c
index d31661c1ce77..59a308b02f95 100644
--- a/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/trunk/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3018,7 +3018,7 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
 	clear_bit(STATUS_SCANNING, &priv->status);
 
 	/* inform mac80211 scan aborted */
-	queue_work(priv->workqueue, &priv->abort_scan);
+	queue_work(priv->workqueue, &priv->scan_completed);
 }
 
 static void iwl3945_bg_restart(struct work_struct *data)
diff --git a/trunk/drivers/regulator/core.c b/trunk/drivers/regulator/core.c
index cc8b337b9119..422a709d271d 100644
--- a/trunk/drivers/regulator/core.c
+++ b/trunk/drivers/regulator/core.c
@@ -700,7 +700,7 @@ static void print_constraints(struct regulator_dev *rdev)
 	    constraints->min_uA != constraints->max_uA) {
 		ret = _regulator_get_current_limit(rdev);
 		if (ret > 0)
-			count += sprintf(buf + count, "at %d mA ", ret / 1000);
+			count += sprintf(buf + count, "at %d uA ", ret / 1000);
 	}
 
 	if (constraints->valid_modes_mask & REGULATOR_MODE_FAST)
@@ -2302,10 +2302,8 @@ struct regulator_dev *regulator_register(struct regulator_desc *regulator_desc,
 	dev_set_name(&rdev->dev, "regulator.%d",
 		     atomic_inc_return(&regulator_no) - 1);
 	ret = device_register(&rdev->dev);
-	if (ret != 0) {
-		put_device(&rdev->dev);
+	if (ret != 0)
 		goto clean;
-	}
 
 	dev_set_drvdata(&rdev->dev, rdev);
 
diff --git a/trunk/drivers/regulator/max8649.c b/trunk/drivers/regulator/max8649.c
index 6b60a9c0366b..4520ace3f7e7 100644
--- a/trunk/drivers/regulator/max8649.c
+++ b/trunk/drivers/regulator/max8649.c
@@ -330,7 +330,7 @@ static int __devinit max8649_regulator_probe(struct i2c_client *client,
 		/* set external clock frequency */
 		info->extclk_freq = pdata->extclk_freq;
 		max8649_set_bits(info->i2c, MAX8649_SYNC, MAX8649_EXT_MASK,
-				 info->extclk_freq << 6);
+				 info->extclk_freq);
 	}
 
 	if (pdata->ramp_timing) {
diff --git a/trunk/drivers/spi/spi.c b/trunk/drivers/spi/spi.c
index b5a78a1f4421..0bcf4c1601a2 100644
--- a/trunk/drivers/spi/spi.c
+++ b/trunk/drivers/spi/spi.c
@@ -23,7 +23,6 @@
 #include <linux/init.h>
 #include <linux/cache.h>
 #include <linux/mutex.h>
-#include <linux/of_device.h>
 #include <linux/slab.h>
 #include <linux/mod_devicetable.h>
 #include <linux/spi/spi.h>
@@ -87,10 +86,6 @@ static int spi_match_device(struct device *dev, struct device_driver *drv)
 	const struct spi_device	*spi = to_spi_device(dev);
 	const struct spi_driver	*sdrv = to_spi_driver(drv);
 
-	/* Attempt an OF style match */
-	if (of_driver_match_device(dev, drv))
-		return 1;
-
 	if (sdrv->id_table)
 		return !!spi_match_id(sdrv->id_table, spi);
 
diff --git a/trunk/drivers/spi/spi_gpio.c b/trunk/drivers/spi/spi_gpio.c
index 63e51b011d50..e24a63498acb 100644
--- a/trunk/drivers/spi/spi_gpio.c
+++ b/trunk/drivers/spi/spi_gpio.c
@@ -350,7 +350,7 @@ static int __init spi_gpio_probe(struct platform_device *pdev)
 	spi_gpio->bitbang.master = spi_master_get(master);
 	spi_gpio->bitbang.chipselect = spi_gpio_chipselect;
 
-	if ((master_flags & (SPI_MASTER_NO_TX | SPI_MASTER_NO_RX)) == 0) {
+	if ((master_flags & (SPI_MASTER_NO_RX | SPI_MASTER_NO_RX)) == 0) {
 		spi_gpio->bitbang.txrx_word[SPI_MODE_0] = spi_gpio_txrx_word_mode0;
 		spi_gpio->bitbang.txrx_word[SPI_MODE_1] = spi_gpio_txrx_word_mode1;
 		spi_gpio->bitbang.txrx_word[SPI_MODE_2] = spi_gpio_txrx_word_mode2;
diff --git a/trunk/drivers/spi/spi_mpc8xxx.c b/trunk/drivers/spi/spi_mpc8xxx.c
index 1dd86b835cd8..d31b57f7baaf 100644
--- a/trunk/drivers/spi/spi_mpc8xxx.c
+++ b/trunk/drivers/spi/spi_mpc8xxx.c
@@ -408,17 +408,11 @@ static void mpc8xxx_spi_cpm_bufs_start(struct mpc8xxx_spi *mspi)
 
 	xfer_ofs = mspi->xfer_in_progress->len - mspi->count;
 
-	if (mspi->rx_dma == mspi->dma_dummy_rx)
-		out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma);
-	else
-		out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
+	out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
 	out_be16(&rx_bd->cbd_datlen, 0);
 	out_be16(&rx_bd->cbd_sc, BD_SC_EMPTY | BD_SC_INTRPT | BD_SC_WRAP);
 
-	if (mspi->tx_dma == mspi->dma_dummy_tx)
-		out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma);
-	else
-		out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
+	out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
 	out_be16(&tx_bd->cbd_datlen, xfer_len);
 	out_be16(&tx_bd->cbd_sc, BD_SC_READY | BD_SC_INTRPT | BD_SC_WRAP |
 				 BD_SC_LAST);
diff --git a/trunk/drivers/xen/xenbus/xenbus_probe.c b/trunk/drivers/xen/xenbus/xenbus_probe.c
index d409495876f1..29bac5118877 100644
--- a/trunk/drivers/xen/xenbus/xenbus_probe.c
+++ b/trunk/drivers/xen/xenbus/xenbus_probe.c
@@ -755,10 +755,7 @@ int register_xenstore_notifier(struct notifier_block *nb)
 {
 	int ret = 0;
 
-	if (xenstored_ready > 0)
-		ret = nb->notifier_call(nb, 0, NULL);
-	else
-		blocking_notifier_chain_register(&xenstore_chain, nb);
+	blocking_notifier_chain_register(&xenstore_chain, nb);
 
 	return ret;
 }
@@ -772,7 +769,7 @@ EXPORT_SYMBOL_GPL(unregister_xenstore_notifier);
 
 void xenbus_probe(struct work_struct *unused)
 {
-	xenstored_ready = 1;
+	BUG_ON((xenstored_ready <= 0));
 
 	/* Enumerate devices in xenstore and watch for changes. */
 	xenbus_probe_devices(&xenbus_frontend);
@@ -838,8 +835,8 @@ static int __init xenbus_init(void)
 			xen_store_evtchn = xen_start_info->store_evtchn;
 			xen_store_mfn = xen_start_info->store_mfn;
 			xen_store_interface = mfn_to_virt(xen_store_mfn);
-			xenstored_ready = 1;
 		}
+		xenstored_ready = 1;
 	}
 
 	/* Initialize the interface to xenstore. */
diff --git a/trunk/fs/fs-writeback.c b/trunk/fs/fs-writeback.c
index ab38fef1c9a1..5581122bd2c0 100644
--- a/trunk/fs/fs-writeback.c
+++ b/trunk/fs/fs-writeback.c
@@ -72,11 +72,22 @@ int writeback_in_progress(struct backing_dev_info *bdi)
 static inline struct backing_dev_info *inode_to_bdi(struct inode *inode)
 {
 	struct super_block *sb = inode->i_sb;
+	struct backing_dev_info *bdi = inode->i_mapping->backing_dev_info;
 
-	if (strcmp(sb->s_type->name, "bdev") == 0)
-		return inode->i_mapping->backing_dev_info;
-
-	return sb->s_bdi;
+	/*
+	 * For inodes on standard filesystems, we use superblock's bdi. For
+	 * inodes on virtual filesystems, we want to use inode mapping's bdi
+	 * because they can possibly point to something useful (think about
+	 * block_dev filesystem).
+	 */
+	if (sb->s_bdi && sb->s_bdi != &noop_backing_dev_info) {
+		/* Some device inodes could play dirty tricks. Catch them... */
+		WARN(bdi != sb->s_bdi && bdi_cap_writeback_dirty(bdi),
+			"Dirtiable inode bdi %s != sb bdi %s\n",
+			bdi->name, sb->s_bdi->name);
+		return sb->s_bdi;
+	}
+	return bdi;
 }
 
 static void bdi_queue_work(struct backing_dev_info *bdi,
diff --git a/trunk/fs/fuse/dev.c b/trunk/fs/fuse/dev.c
index cde755cca564..d367af1514ef 100644
--- a/trunk/fs/fuse/dev.c
+++ b/trunk/fs/fuse/dev.c
@@ -1354,7 +1354,7 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode,
 	loff_t file_size;
 	unsigned int num;
 	unsigned int offset;
-	size_t total_len = 0;
+	size_t total_len;
 
 	req = fuse_get_req(fc);
 	if (IS_ERR(req))
diff --git a/trunk/include/linux/module.h b/trunk/include/linux/module.h
index aace066bad8f..8a6b9fdc7ffa 100644
--- a/trunk/include/linux/module.h
+++ b/trunk/include/linux/module.h
@@ -686,16 +686,17 @@ extern int module_sysfs_initialized;
 
 
 #ifdef CONFIG_GENERIC_BUG
-void module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *,
+int  module_bug_finalize(const Elf_Ehdr *, const Elf_Shdr *,
 			 struct module *);
 void module_bug_cleanup(struct module *);
 
 #else	/* !CONFIG_GENERIC_BUG */
 
-static inline void module_bug_finalize(const Elf_Ehdr *hdr,
+static inline int  module_bug_finalize(const Elf_Ehdr *hdr,
 					const Elf_Shdr *sechdrs,
 					struct module *mod)
 {
+	return 0;
 }
 static inline void module_bug_cleanup(struct module *mod) {}
 #endif	/* CONFIG_GENERIC_BUG */
diff --git a/trunk/include/linux/rcupdate.h b/trunk/include/linux/rcupdate.h
index 83af1f8d8b74..9fbc54a2585d 100644
--- a/trunk/include/linux/rcupdate.h
+++ b/trunk/include/linux/rcupdate.h
@@ -454,7 +454,7 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)
  * Makes rcu_dereference_check() do the dirty work.
  */
 #define rcu_dereference_bh(p) \
-		rcu_dereference_check(p, rcu_read_lock_bh_held() || irqs_disabled())
+		rcu_dereference_check(p, rcu_read_lock_bh_held())
 
 /**
  * rcu_dereference_sched - fetch RCU-protected pointer, checking for RCU-sched
diff --git a/trunk/include/linux/wait.h b/trunk/include/linux/wait.h
index 3efc9f3f43a0..0836ccc57121 100644
--- a/trunk/include/linux/wait.h
+++ b/trunk/include/linux/wait.h
@@ -614,7 +614,6 @@ int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
 		(wait)->private = current;				\
 		(wait)->func = autoremove_wake_function;		\
 		INIT_LIST_HEAD(&(wait)->task_list);			\
-		(wait)->flags = 0;					\
 	} while (0)
 
 /**
diff --git a/trunk/kernel/module.c b/trunk/kernel/module.c
index ccd641991842..d0b5f8db11b4 100644
--- a/trunk/kernel/module.c
+++ b/trunk/kernel/module.c
@@ -1537,7 +1537,6 @@ static int __unlink_module(void *_mod)
 {
 	struct module *mod = _mod;
 	list_del(&mod->list);
-	module_bug_cleanup(mod);
 	return 0;
 }
 
@@ -2626,7 +2625,6 @@ static struct module *load_module(void __user *umod,
 	if (err < 0)
 		goto ddebug;
 
-	module_bug_finalize(info.hdr, info.sechdrs, mod);
 	list_add_rcu(&mod->list, &modules);
 	mutex_unlock(&module_mutex);
 
@@ -2652,8 +2650,6 @@ static struct module *load_module(void __user *umod,
 	mutex_lock(&module_mutex);
 	/* Unlink carefully: kallsyms could be walking list. */
 	list_del_rcu(&mod->list);
-	module_bug_cleanup(mod);
-
  ddebug:
 	if (!mod->taints)
 		dynamic_debug_remove(info.debug);
diff --git a/trunk/kernel/smp.c b/trunk/kernel/smp.c
index ed6aacfcb7ef..75c970c715d3 100644
--- a/trunk/kernel/smp.c
+++ b/trunk/kernel/smp.c
@@ -365,10 +365,9 @@ int smp_call_function_any(const struct cpumask *mask,
 EXPORT_SYMBOL_GPL(smp_call_function_any);
 
 /**
- * __smp_call_function_single(): Run a function on a specific CPU
+ * __smp_call_function_single(): Run a function on another CPU
  * @cpu: The CPU to run on.
  * @data: Pre-allocated and setup data structure
- * @wait: If true, wait until function has completed on specified CPU.
  *
  * Like smp_call_function_single(), but allow caller to pass in a
  * pre-allocated data structure. Useful for embedding @data inside
@@ -377,10 +376,8 @@ EXPORT_SYMBOL_GPL(smp_call_function_any);
 void __smp_call_function_single(int cpu, struct call_single_data *data,
 				int wait)
 {
-	unsigned int this_cpu;
-	unsigned long flags;
+	csd_lock(data);
 
-	this_cpu = get_cpu();
 	/*
 	 * Can deadlock when called with interrupts disabled.
 	 * We allow cpu's that are not yet online though, as no one else can
@@ -390,15 +387,7 @@ void __smp_call_function_single(int cpu, struct call_single_data *data,
 	WARN_ON_ONCE(cpu_online(smp_processor_id()) && wait && irqs_disabled()
 		     && !oops_in_progress);
 
-	if (cpu == this_cpu) {
-		local_irq_save(flags);
-		data->func(data->info);
-		local_irq_restore(flags);
-	} else {
-		csd_lock(data);
-		generic_exec_single(cpu, data, wait);
-	}
-	put_cpu();
+	generic_exec_single(cpu, data, wait);
 }
 
 /**
diff --git a/trunk/lib/bug.c b/trunk/lib/bug.c
index 19552096d16b..7cdfad88128f 100644
--- a/trunk/lib/bug.c
+++ b/trunk/lib/bug.c
@@ -72,8 +72,8 @@ static const struct bug_entry *module_find_bug(unsigned long bugaddr)
 	return NULL;
 }
 
-void module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
-			 struct module *mod)
+int module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
+			struct module *mod)
 {
 	char *secstrings;
 	unsigned int i;
@@ -97,6 +97,8 @@ void module_bug_finalize(const Elf_Ehdr *hdr, const Elf_Shdr *sechdrs,
 	 * could potentially lead to deadlock and thus be counter-productive.
 	 */
 	list_add(&mod->bug_list, &module_bug_list);
+
+	return 0;
 }
 
 void module_bug_cleanup(struct module *mod)
diff --git a/trunk/mm/ksm.c b/trunk/mm/ksm.c
index 65ab5c7067d9..b1873cf03ed9 100644
--- a/trunk/mm/ksm.c
+++ b/trunk/mm/ksm.c
@@ -712,7 +712,7 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
 	if (!ptep)
 		goto out;
 
-	if (pte_write(*ptep) || pte_dirty(*ptep)) {
+	if (pte_write(*ptep)) {
 		pte_t entry;
 
 		swapped = PageSwapCache(page);
@@ -735,9 +735,7 @@ static int write_protect_page(struct vm_area_struct *vma, struct page *page,
 			set_pte_at(mm, addr, ptep, entry);
 			goto out_unlock;
 		}
-		if (pte_dirty(entry))
-			set_page_dirty(page);
-		entry = pte_mkclean(pte_wrprotect(entry));
+		entry = pte_wrprotect(entry);
 		set_pte_at_notify(mm, addr, ptep, entry);
 	}
 	*orig_pte = *ptep;
diff --git a/trunk/mm/rmap.c b/trunk/mm/rmap.c
index 92e6757f196e..9d2ba01bd4f9 100644
--- a/trunk/mm/rmap.c
+++ b/trunk/mm/rmap.c
@@ -381,13 +381,7 @@ vma_address(struct page *page, struct vm_area_struct *vma)
 unsigned long page_address_in_vma(struct page *page, struct vm_area_struct *vma)
 {
 	if (PageAnon(page)) {
-		struct anon_vma *page__anon_vma = page_anon_vma(page);
-		/*
-		 * Note: swapoff's unuse_vma() is more efficient with this
-		 * check, and needs it to match anon_vma when KSM is active.
-		 */
-		if (!vma->anon_vma || !page__anon_vma ||
-		    vma->anon_vma->root != page__anon_vma->root)
+		if (vma->anon_vma->root != page_anon_vma(page)->root)
 			return -EFAULT;
 	} else if (page->mapping && !(vma->vm_flags & VM_NONLINEAR)) {
 		if (!vma->vm_file ||
diff --git a/trunk/net/8021q/vlan_core.c b/trunk/net/8021q/vlan_core.c
index 0eb96f7e44be..01ddb0472f86 100644
--- a/trunk/net/8021q/vlan_core.c
+++ b/trunk/net/8021q/vlan_core.c
@@ -24,11 +24,8 @@ int __vlan_hwaccel_rx(struct sk_buff *skb, struct vlan_group *grp,
 
 	if (vlan_dev)
 		skb->dev = vlan_dev;
-	else if (vlan_id) {
-		if (!(skb->dev->flags & IFF_PROMISC))
-			goto drop;
-		skb->pkt_type = PACKET_OTHERHOST;
-	}
+	else if (vlan_id)
+		goto drop;
 
 	return (polling ? netif_receive_skb(skb) : netif_rx(skb));
 
@@ -105,11 +102,8 @@ vlan_gro_common(struct napi_struct *napi, struct vlan_group *grp,
 
 	if (vlan_dev)
 		skb->dev = vlan_dev;
-	else if (vlan_id) {
-		if (!(skb->dev->flags & IFF_PROMISC))
-			goto drop;
-		skb->pkt_type = PACKET_OTHERHOST;
-	}
+	else if (vlan_id)
+		goto drop;
 
 	for (p = napi->gro_list; p; p = p->next) {
 		NAPI_GRO_CB(p)->same_flow =
diff --git a/trunk/net/ipv4/Kconfig b/trunk/net/ipv4/Kconfig
index 72380a30d1c8..571f8950ed06 100644
--- a/trunk/net/ipv4/Kconfig
+++ b/trunk/net/ipv4/Kconfig
@@ -217,7 +217,6 @@ config NET_IPIP
 
 config NET_IPGRE
 	tristate "IP: GRE tunnels over IP"
-	depends on IPV6 || IPV6=n
 	help
 	  Tunneling means encapsulating data of one protocol type within
 	  another protocol and sending it over a channel that understands the
diff --git a/trunk/net/ipv4/tcp_timer.c b/trunk/net/ipv4/tcp_timer.c
index 74c54b30600f..c35b469e851c 100644
--- a/trunk/net/ipv4/tcp_timer.c
+++ b/trunk/net/ipv4/tcp_timer.c
@@ -135,16 +135,13 @@ static void tcp_mtu_probing(struct inet_connection_sock *icsk, struct sock *sk)
 
 /* This function calculates a "timeout" which is equivalent to the timeout of a
  * TCP connection after "boundary" unsuccessful, exponentially backed-off
- * retransmissions with an initial RTO of TCP_RTO_MIN or TCP_TIMEOUT_INIT if
- * syn_set flag is set.
+ * retransmissions with an initial RTO of TCP_RTO_MIN.
  */
 static bool retransmits_timed_out(struct sock *sk,
-				  unsigned int boundary,
-				  bool syn_set)
+				  unsigned int boundary)
 {
 	unsigned int timeout, linear_backoff_thresh;
 	unsigned int start_ts;
-	unsigned int rto_base = syn_set ? TCP_TIMEOUT_INIT : TCP_RTO_MIN;
 
 	if (!inet_csk(sk)->icsk_retransmits)
 		return false;
@@ -154,12 +151,12 @@ static bool retransmits_timed_out(struct sock *sk,
 	else
 		start_ts = tcp_sk(sk)->retrans_stamp;
 
-	linear_backoff_thresh = ilog2(TCP_RTO_MAX/rto_base);
+	linear_backoff_thresh = ilog2(TCP_RTO_MAX/TCP_RTO_MIN);
 
 	if (boundary <= linear_backoff_thresh)
-		timeout = ((2 << boundary) - 1) * rto_base;
+		timeout = ((2 << boundary) - 1) * TCP_RTO_MIN;
 	else
-		timeout = ((2 << linear_backoff_thresh) - 1) * rto_base +
+		timeout = ((2 << linear_backoff_thresh) - 1) * TCP_RTO_MIN +
 			  (boundary - linear_backoff_thresh) * TCP_RTO_MAX;
 
 	return (tcp_time_stamp - start_ts) >= timeout;
@@ -170,15 +167,14 @@ static int tcp_write_timeout(struct sock *sk)
 {
 	struct inet_connection_sock *icsk = inet_csk(sk);
 	int retry_until;
-	bool do_reset, syn_set = 0;
+	bool do_reset;
 
 	if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
 		if (icsk->icsk_retransmits)
 			dst_negative_advice(sk);
 		retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
-		syn_set = 1;
 	} else {
-		if (retransmits_timed_out(sk, sysctl_tcp_retries1, 0)) {
+		if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
 			/* Black hole detection */
 			tcp_mtu_probing(icsk, sk);
 
@@ -191,14 +187,14 @@ static int tcp_write_timeout(struct sock *sk)
 
 			retry_until = tcp_orphan_retries(sk, alive);
 			do_reset = alive ||
-				   !retransmits_timed_out(sk, retry_until, 0);
+				   !retransmits_timed_out(sk, retry_until);
 
 			if (tcp_out_of_resources(sk, do_reset))
 				return 1;
 		}
 	}
 
-	if (retransmits_timed_out(sk, retry_until, syn_set)) {
+	if (retransmits_timed_out(sk, retry_until)) {
 		/* Has it gone just too far? */
 		tcp_write_err(sk);
 		return 1;
@@ -440,7 +436,7 @@ void tcp_retransmit_timer(struct sock *sk)
 		icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
 	}
 	inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
-	if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1, 0))
+	if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1))
 		__sk_dst_reset(sk);
 
 out:;
diff --git a/trunk/net/mac80211/rx.c b/trunk/net/mac80211/rx.c
index 28624282c5f3..fa0f37e4afe4 100644
--- a/trunk/net/mac80211/rx.c
+++ b/trunk/net/mac80211/rx.c
@@ -2199,6 +2199,9 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
 	struct net_device *prev_dev = NULL;
 	struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb);
 
+	if (status->flag & RX_FLAG_INTERNAL_CMTR)
+		goto out_free_skb;
+
 	if (skb_headroom(skb) < sizeof(*rthdr) &&
 	    pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC))
 		goto out_free_skb;
@@ -2257,6 +2260,7 @@ static void ieee80211_rx_cooked_monitor(struct ieee80211_rx_data *rx,
 	} else
 		goto out_free_skb;
 
+	status->flag |= RX_FLAG_INTERNAL_CMTR;
 	return;
 
  out_free_skb:
diff --git a/trunk/net/phonet/pep.c b/trunk/net/phonet/pep.c
index 15003021f4f0..b2a3ae6cad78 100644
--- a/trunk/net/phonet/pep.c
+++ b/trunk/net/phonet/pep.c
@@ -225,13 +225,12 @@ static void pipe_grant_credits(struct sock *sk)
 static int pipe_rcv_status(struct sock *sk, struct sk_buff *skb)
 {
 	struct pep_sock *pn = pep_sk(sk);
-	struct pnpipehdr *hdr;
+	struct pnpipehdr *hdr = pnp_hdr(skb);
 	int wake = 0;
 
 	if (!pskb_may_pull(skb, sizeof(*hdr) + 4))
 		return -EINVAL;
 
-	hdr = pnp_hdr(skb);
 	if (hdr->data[0] != PN_PEP_TYPE_COMMON) {
 		LIMIT_NETDEBUG(KERN_DEBUG"Phonet unknown PEP type: %u\n",
 				(unsigned)hdr->data[0]);
diff --git a/trunk/sound/core/control.c b/trunk/sound/core/control.c
index 45a818002d99..070aab490191 100644
--- a/trunk/sound/core/control.c
+++ b/trunk/sound/core/control.c
@@ -31,7 +31,6 @@
 
 /* max number of user-defined controls */
 #define MAX_USER_CONTROLS	32
-#define MAX_CONTROL_COUNT	1028
 
 struct snd_kctl_ioctl {
 	struct list_head list;		/* list of all ioctls */
@@ -196,10 +195,6 @@ static struct snd_kcontrol *snd_ctl_new(struct snd_kcontrol *control,
 	
 	if (snd_BUG_ON(!control || !control->count))
 		return NULL;
-
-	if (control->count > MAX_CONTROL_COUNT)
-		return NULL;
-
 	kctl = kzalloc(sizeof(*kctl) + sizeof(struct snd_kcontrol_volatile) * control->count, GFP_KERNEL);
 	if (kctl == NULL) {
 		snd_printk(KERN_ERR "Cannot allocate control instance\n");
diff --git a/trunk/sound/i2c/other/ak4xxx-adda.c b/trunk/sound/i2c/other/ak4xxx-adda.c
index 42d7844ecd0b..1adb8a3c2b62 100644
--- a/trunk/sound/i2c/other/ak4xxx-adda.c
+++ b/trunk/sound/i2c/other/ak4xxx-adda.c
@@ -900,7 +900,7 @@ static int proc_init(struct snd_akm4xxx *ak)
 	return 0;
 }
 #else /* !CONFIG_PROC_FS */
-static int proc_init(struct snd_akm4xxx *ak) { return 0; }
+static int proc_init(struct snd_akm4xxx *ak) {}
 #endif
 
 int snd_akm4xxx_build_controls(struct snd_akm4xxx *ak)
diff --git a/trunk/tools/perf/Makefile b/trunk/tools/perf/Makefile
index 1950e19af1cf..4f1fa77c1feb 100644
--- a/trunk/tools/perf/Makefile
+++ b/trunk/tools/perf/Makefile
@@ -1017,7 +1017,7 @@ builtin-revert.o wt-status.o: wt-status.h
 # we compile into subdirectories. if the target directory is not the source directory, they might not exists. So
 # we depend the various files onto their directories.
 DIRECTORY_DEPS = $(LIB_OBJS) $(BUILTIN_OBJS) $(OUTPUT)PERF-VERSION-FILE $(OUTPUT)common-cmds.h
-$(DIRECTORY_DEPS): | $(sort $(dir $(DIRECTORY_DEPS)))
+$(DIRECTORY_DEPS): $(sort $(dir $(DIRECTORY_DEPS)))
 # In the second step, we make a rule to actually create these directories
 $(sort $(dir $(DIRECTORY_DEPS))):
 	$(QUIET_MKDIR)$(MKDIR) -p $@ 2>/dev/null
diff --git a/trunk/tools/perf/util/trace-event-scripting.c b/trunk/tools/perf/util/trace-event-scripting.c
index f7af2fca965d..7ea983acfaea 100644
--- a/trunk/tools/perf/util/trace-event-scripting.c
+++ b/trunk/tools/perf/util/trace-event-scripting.c
@@ -97,7 +97,7 @@ void setup_python_scripting(void)
 	register_python_scripting(&python_scripting_unsupported_ops);
 }
 #else
-extern struct scripting_ops python_scripting_ops;
+struct scripting_ops python_scripting_ops;
 
 void setup_python_scripting(void)
 {
@@ -158,7 +158,7 @@ void setup_perl_scripting(void)
 	register_perl_scripting(&perl_scripting_unsupported_ops);
 }
 #else
-extern struct scripting_ops perl_scripting_ops;
+struct scripting_ops perl_scripting_ops;
 
 void setup_perl_scripting(void)
 {
diff --git a/trunk/tools/perf/util/ui/browsers/hists.c b/trunk/tools/perf/util/ui/browsers/hists.c
index 6866aa4c41e0..dafdf6775d77 100644
--- a/trunk/tools/perf/util/ui/browsers/hists.c
+++ b/trunk/tools/perf/util/ui/browsers/hists.c
@@ -773,7 +773,7 @@ int hists__browse(struct hists *self, const char *helpline, const char *ev_name)
 
 			switch (key) {
 			case 'a':
-				if (browser->selection->map == NULL ||
+				if (browser->selection->map == NULL &&
 				    browser->selection->map->dso->annotate_warned)
 					continue;
 				goto do_annotate;