Merge branch 'ptebits' into devel

Conflicts:

	arch/arm/Kconfig

101 files changed, 1627 insertions, 819 deletions

diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index d3f0a62efcc..ee68ac54c0d 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -138,7 +138,7 @@ static struct dmi_system_id __cpuinitdata processor_idle_dmi_table[] = {
 	{
 	set_no_mwait, "Extensa 5220", {
 	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
-	DMI_MATCH(DMI_SYS_VENDOR, "ACER"),
+	DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
 	DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
 	DMI_MATCH(DMI_BOARD_NAME, "Columbia") }, NULL},
 	{},
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 158eed4d516..29b7a648cc6 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -49,7 +49,6 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/kthread.h>
-#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/spinlock.h>
 #include <linux/file.h>
@@ -2798,14 +2797,9 @@ out_mem:
 	return ret;
 }
 
-static long pkt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
 {
-	struct inode *inode = file->f_path.dentry->d_inode;
-	struct pktcdvd_device *pd;
-	long ret;
-
-	lock_kernel();
-	pd = inode->i_bdev->bd_disk->private_data;
+	struct pktcdvd_device *pd = inode->i_bdev->bd_disk->private_data;
 
 	VPRINTK("pkt_ioctl: cmd %x, dev %d:%d\n", cmd, imajor(inode), iminor(inode));
 
@@ -2818,8 +2812,7 @@ static long pkt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	case CDROM_LAST_WRITTEN:
 	case CDROM_SEND_PACKET:
 	case SCSI_IOCTL_SEND_COMMAND:
-		ret = blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
-		break;
+		return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
 
 	case CDROMEJECT:
 		/*
@@ -2828,15 +2821,14 @@ static long pkt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 		 */
 		if (pd->refcnt == 1)
 			pkt_lock_door(pd, 0);
-		ret = blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
-		break;
+		return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
 
 	default:
 		VPRINTK(DRIVER_NAME": Unknown ioctl for %s (%x)\n", pd->name, cmd);
-		ret = -ENOTTY;
+		return -ENOTTY;
 	}
-	unlock_kernel();
-	return ret;
+
+	return 0;
 }
 
 static int pkt_media_changed(struct gendisk *disk)
@@ -2858,7 +2850,7 @@ static struct block_device_operations pktcdvd_ops = {
 	.owner =		THIS_MODULE,
 	.open =			pkt_open,
 	.release =		pkt_close,
-	.unlocked_ioctl =	pkt_ioctl,
+	.ioctl =		pkt_ioctl,
 	.media_changed =	pkt_media_changed,
 };
 
@@ -3023,8 +3015,7 @@ static void pkt_get_status(struct pkt_ctrl_command *ctrl_cmd)
 	mutex_unlock(&ctl_mutex);
 }
 
-static long pkt_ctl_ioctl(struct file *file, unsigned int cmd,
-						unsigned long arg)
+static int pkt_ctl_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
 {
 	void __user *argp = (void __user *)arg;
 	struct pkt_ctrl_command ctrl_cmd;
@@ -3041,22 +3032,16 @@ static long pkt_ctl_ioctl(struct file *file, unsigned int cmd,
 	case PKT_CTRL_CMD_SETUP:
 		if (!capable(CAP_SYS_ADMIN))
 			return -EPERM;
-		lock_kernel();
 		ret = pkt_setup_dev(new_decode_dev(ctrl_cmd.dev), &pkt_dev);
 		ctrl_cmd.pkt_dev = new_encode_dev(pkt_dev);
-		unlock_kernel();
 		break;
 	case PKT_CTRL_CMD_TEARDOWN:
 		if (!capable(CAP_SYS_ADMIN))
 			return -EPERM;
-		lock_kernel();
 		ret = pkt_remove_dev(new_decode_dev(ctrl_cmd.pkt_dev));
-		unlock_kernel();
 		break;
 	case PKT_CTRL_CMD_STATUS:
-		lock_kernel();
 		pkt_get_status(&ctrl_cmd);
-		unlock_kernel();
 		break;
 	default:
 		return -ENOTTY;
@@ -3069,7 +3054,7 @@ static long pkt_ctl_ioctl(struct file *file, unsigned int cmd,
 
 
 static const struct file_operations pkt_ctl_fops = {
-	.unlocked_ioctl	 = pkt_ctl_ioctl,
+	.ioctl	 = pkt_ctl_ioctl,
 	.owner	 = THIS_MODULE,
 };
 
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 1838aa3d24f..7ce1ac4baa6 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -407,7 +407,7 @@ struct entropy_store {
 	/* read-write data: */
 	spinlock_t lock;
 	unsigned add_ptr;
-	int entropy_count;
+	int entropy_count;	/* Must at no time exceed ->POOLBITS! */
 	int input_rotate;
 };
 
@@ -520,6 +520,7 @@ static void mix_pool_bytes(struct entropy_store *r, const void *in, int bytes)
 static void credit_entropy_bits(struct entropy_store *r, int nbits)
 {
 	unsigned long flags;
+	int entropy_count;
 
 	if (!nbits)
 		return;
@@ -527,20 +528,20 @@ static void credit_entropy_bits(struct entropy_store *r, int nbits)
 	spin_lock_irqsave(&r->lock, flags);
 
 	DEBUG_ENT("added %d entropy credits to %s\n", nbits, r->name);
-	r->entropy_count += nbits;
-	if (r->entropy_count < 0) {
+	entropy_count = r->entropy_count;
+	entropy_count += nbits;
+	if (entropy_count < 0) {
 		DEBUG_ENT("negative entropy/overflow\n");
-		r->entropy_count = 0;
-	} else if (r->entropy_count > r->poolinfo->POOLBITS)
-		r->entropy_count = r->poolinfo->POOLBITS;
+		entropy_count = 0;
+	} else if (entropy_count > r->poolinfo->POOLBITS)
+		entropy_count = r->poolinfo->POOLBITS;
+	r->entropy_count = entropy_count;
 
 	/* should we wake readers? */
-	if (r == &input_pool &&
-	    r->entropy_count >= random_read_wakeup_thresh) {
+	if (r == &input_pool && entropy_count >= random_read_wakeup_thresh) {
 		wake_up_interruptible(&random_read_wait);
 		kill_fasync(&fasync, SIGIO, POLL_IN);
 	}
-
 	spin_unlock_irqrestore(&r->lock, flags);
 }
 
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index a27160ba21d..daeb8f76697 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -2498,7 +2498,7 @@ static int tiocgwinsz(struct tty_struct *tty, struct winsize __user *arg)
 /**
  *	tty_do_resize		-	resize event
  *	@tty: tty being resized
- *	@real_tty: real tty (if using a pty/tty pair)
+ *	@real_tty: real tty (not the same as tty if using a pty/tty pair)
  *	@rows: rows (character)
  *	@cols: cols (character)
  *
@@ -2512,7 +2512,8 @@ int tty_do_resize(struct tty_struct *tty, struct tty_struct *real_tty,
 	struct pid *pgrp, *rpgrp;
 	unsigned long flags;
 
-	mutex_lock(&tty->termios_mutex);
+	/* For a PTY we need to lock the tty side */
+	mutex_lock(&real_tty->termios_mutex);
 	if (!memcmp(ws, &tty->winsize, sizeof(*ws)))
 		goto done;
 	/* Get the PID values and reference them so we can
@@ -2533,7 +2534,7 @@ int tty_do_resize(struct tty_struct *tty, struct tty_struct *real_tty,
 	tty->winsize = *ws;
 	real_tty->winsize = *ws;
 done:
-	mutex_unlock(&tty->termios_mutex);
+	mutex_unlock(&real_tty->termios_mutex);
 	return 0;
 }
 
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index ea9fc5d03b9..bf34e459742 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -937,12 +937,14 @@ int tty_mode_ioctl(struct tty_struct *tty, struct file *file,
 			return 0;
 #endif
 	case TIOCGSOFTCAR:
-		return put_user(C_CLOCAL(tty) ? 1 : 0,
+		/* FIXME: for correctness we may need to take the termios
+		   lock here - review */
+		return put_user(C_CLOCAL(real_tty) ? 1 : 0,
 						(int __user *)arg);
 	case TIOCSSOFTCAR:
 		if (get_user(arg, (unsigned int __user *) arg))
 			return -EFAULT;
-		return tty_change_softcar(tty, arg);
+		return tty_change_softcar(real_tty, arg);
 	default:
 		return -ENOIOCTLCMD;
 	}
diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
index 8024e3bfd87..b91ef63126e 100644
--- a/drivers/firmware/iscsi_ibft.c
+++ b/drivers/firmware/iscsi_ibft.c
@@ -669,8 +669,7 @@ static int __init ibft_register_kobjects(struct ibft_table_header *header,
 
 	control = (void *)header + sizeof(*header);
 	end = (void *)control + control->hdr.length;
-	eot_offset = (void *)header + header->length -
-		     (void *)control - sizeof(*header);
+	eot_offset = (void *)header + header->length - (void *)control;
 	rc = ibft_verify_hdr("control", (struct ibft_hdr *)control, id_control,
 			     sizeof(*control));
 
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 089c015c01d..53f0e5af1cc 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -400,27 +400,31 @@ static void drm_locked_tasklet_func(unsigned long data)
 {
 	struct drm_device *dev = (struct drm_device *)data;
 	unsigned long irqflags;
-
+	void (*tasklet_func)(struct drm_device *);
+	
 	spin_lock_irqsave(&dev->tasklet_lock, irqflags);
+	tasklet_func = dev->locked_tasklet_func;
+	spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
 
-	if (!dev->locked_tasklet_func ||
+	if (!tasklet_func ||
 	    !drm_lock_take(&dev->lock,
 			   DRM_KERNEL_CONTEXT)) {
-		spin_unlock_irqrestore(&dev->tasklet_lock, irqflags);
 		return;
 	}
 
 	dev->lock.lock_time = jiffies;
 	atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
 
-	dev->locked_tasklet_func(dev);
+	spin_lock_irqsave(&dev->tasklet_lock, irqflags);
+	tasklet_func = dev->locked_tasklet_func;
+	dev->locked_tasklet_func = NULL;
+	spin_unlock_i