Merge branch 'kvm-updates-2.6.27' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm

* 'kvm-updates-2.6.27' of git://git.kernel.org/pub/scm/linux/kernel/git/avi/kvm:
  KVM: fix userspace ABI breakage
  KVM: MMU: Fix torn shadow pte
  KVM: Use .fixup instead of .text.fixup on __kvm_handle_fault_on_reboot
diff --git a/Documentation/lguest/lguest.c b/Documentation/lguest/lguest.c
index 6554148..7228369 100644
--- a/Documentation/lguest/lguest.c
+++ b/Documentation/lguest/lguest.c
@@ -895,6 +895,9 @@
 	}
 }
 
+/* This is called when we no longer want to hear about Guest changes to a
+ * virtqueue.  This is more efficient in high-traffic cases, but it means we
+ * have to set a timer to check if any more changes have occurred. */
 static void block_vq(struct virtqueue *vq)
 {
 	struct itimerval itm;
@@ -939,6 +942,11 @@
 	if (!timeout && num)
 		block_vq(vq);
 
+	/* We never quite know how long should we wait before we check the
+	 * queue again for more packets.  We start at 500 microseconds, and if
+	 * we get fewer packets than last time, we assume we made the timeout
+	 * too small and increase it by 10 microseconds.  Otherwise, we drop it
+	 * by one microsecond every time.  It seems to work well enough. */
 	if (timeout) {
 		if (num < last_timeout_num)
 			timeout_usec += 10;
diff --git a/drivers/lguest/lguest_device.c b/drivers/lguest/lguest_device.c
index 37344aa..a661bbd 100644
--- a/drivers/lguest/lguest_device.c
+++ b/drivers/lguest/lguest_device.c
@@ -98,6 +98,10 @@
 	return features;
 }
 
+/* The virtio core takes the features the Host offers, and copies the
+ * ones supported by the driver into the vdev->features array.  Once
+ * that's all sorted out, this routine is called so we can tell the
+ * Host which features we understand and accept. */
 static void lg_finalize_features(struct virtio_device *vdev)
 {
 	unsigned int i, bits;
@@ -108,6 +112,10 @@
 	/* Give virtio_ring a chance to accept features. */
 	vring_transport_features(vdev);
 
+	/* The vdev->feature array is a Linux bitmask: this isn't the
+	 * same as a the simple array of bits used by lguest devices
+	 * for features.  So we do this slow, manual conversion which is
+	 * completely general. */
 	memset(out_features, 0, desc->feature_len);
 	bits = min_t(unsigned, desc->feature_len, sizeof(vdev->features)) * 8;
 	for (i = 0; i < bits; i++) {
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index bfef604..62eab43 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -158,7 +158,7 @@
 	vb->vdev->config->get(vb->vdev,
 			      offsetof(struct virtio_balloon_config, num_pages),
 			      &v, sizeof(v));
-	return v - vb->num_pages;
+	return (s64)v - vb->num_pages;
 }
 
 static void update_balloon_size(struct virtio_balloon *vb)
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index a5bc91a..d0e87cb 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -102,7 +102,7 @@
 	/* XXX use normal device tree? */
 	xenbus_suspend();
 
-	err = stop_machine_run(xen_suspend, &cancelled, 0);
+	err = stop_machine(xen_suspend, &cancelled, &cpumask_of_cpu(0));
 	if (err) {
 		printk(KERN_ERR "failed to start xen_suspend: %d\n", err);
 		goto out;
diff --git a/include/linux/stop_machine.h b/include/linux/stop_machine.h
index f1cb0ba..faf1519 100644
--- a/include/linux/stop_machine.h
+++ b/include/linux/stop_machine.h
@@ -3,16 +3,13 @@
 /* "Bogolock": stop the entire machine, disable interrupts.  This is a
    very heavy lock, which is equivalent to grabbing every spinlock
    (and more).  So the "read" side to such a lock is anything which
-   diables preeempt. */
+   disables preeempt. */
 #include <linux/cpu.h>
 #include <linux/cpumask.h>
 #include <asm/system.h>
 
 #if defined(CONFIG_STOP_MACHINE) && defined(CONFIG_SMP)
 
-/* Deprecated, but useful for transition. */
-#define ALL_CPUS ~0U
-
 /**
  * stop_machine: freeze the machine on all CPUs and run this function
  * @fn: the function to run
@@ -50,18 +47,4 @@
 	return ret;
 }
 #endif /* CONFIG_SMP */
-
-static inline int __deprecated stop_machine_run(int (*fn)(void *), void *data,
-						unsigned int cpu)
-{
-	/* If they don't care which cpu fn runs on, just pick one. */
-	if (cpu == NR_CPUS)
-		return stop_machine(fn, data, NULL);
-	else if (cpu == ~0U)
-		return stop_machine(fn, data, &cpu_possible_map);
-	else {
-		cpumask_t cpus = cpumask_of_cpu(cpu);
-		return stop_machine(fn, data, &cpus);
-	}
-}
 #endif /* _LINUX_STOP_MACHINE */
diff --git a/kernel/module.c b/kernel/module.c
index 08864d2..9db1191 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1799,7 +1799,7 @@
 
 /* Allocate and load the module: note that size of section 0 is always
    zero, and we rely on this for optional sections. */
-static struct module *load_module(void __user *umod,
+static noinline struct module *load_module(void __user *umod,
 				  unsigned long len,
 				  const char __user *uargs)
 {