Merge commit 'v2.6.27-rc6' into x86/memory-corruption-check

26 files changed, 228 insertions, 38 deletions

diff --git a/arch/arm/include/asm/io.h b/arch/arm/include/asm/io.h
index 94a95d7fafd6..71934856fc22 100644
--- a/arch/arm/include/asm/io.h
+++ b/arch/arm/include/asm/io.h
@@ -61,8 +61,9 @@ extern void __raw_readsl(const void __iomem *addr, void *data, int longlen);
 #define MT_DEVICE_NONSHARED     1
 #define MT_DEVICE_CACHED        2
 #define MT_DEVICE_IXP2000       3
+#define MT_DEVICE_WC            4
 /*
- * types 4 onwards can be found in asm/mach/map.h and are undefined
+ * types 5 onwards can be found in asm/mach/map.h and are undefined
  * for ioremap
  */
 
@@ -215,11 +216,13 @@ extern void _memset_io(volatile void __iomem *, int, size_t);
 #define ioremap(cookie,size)            __arm_ioremap(cookie, size, MT_DEVICE)
 #define ioremap_nocache(cookie,size)    __arm_ioremap(cookie, size, MT_DEVICE)
 #define ioremap_cached(cookie,size)     __arm_ioremap(cookie, size, MT_DEVICE_CACHED)
+#define ioremap_wc(cookie,size)         __arm_ioremap(cookie, size, MT_DEVICE_WC)
 #define iounmap(cookie)                 __iounmap(cookie)
 #else
 #define ioremap(cookie,size)            __arch_ioremap((cookie), (size), MT_DEVICE)
 #define ioremap_nocache(cookie,size)    __arch_ioremap((cookie), (size), MT_DEVICE)
 #define ioremap_cached(cookie,size)     __arch_ioremap((cookie), (size), MT_DEVICE_CACHED)
+#define ioremap_wc(cookie,size)         __arch_ioremap((cookie), (size), MT_DEVICE_WC)
 #define iounmap(cookie)                 __arch_iounmap(cookie)
 #endif
 
diff --git a/arch/arm/include/asm/mach/map.h b/arch/arm/include/asm/mach/map.h
index 06f583b13999..9eb936e49cc3 100644
--- a/arch/arm/include/asm/mach/map.h
+++ b/arch/arm/include/asm/mach/map.h
@@ -18,13 +18,13 @@ struct map_desc {
         unsigned int type;
 };
 
-/* types 0-3 are defined in asm/io.h */
-#define MT_CACHECLEAN           4
-#define MT_MINICLEAN            5
-#define MT_LOW_VECTORS          6
-#define MT_HIGH_VECTORS         7
-#define MT_MEMORY               8
-#define MT_ROM                  9
+/* types 0-4 are defined in asm/io.h */
+#define MT_CACHECLEAN           5
+#define MT_MINICLEAN            6
+#define MT_LOW_VECTORS          7
+#define MT_HIGH_VECTORS         8
+#define MT_MEMORY               9
+#define MT_ROM                  10
 
 #define MT_NONSHARED_DEVICE     MT_DEVICE_NONSHARED
 #define MT_IXP2000_DEVICE       MT_DEVICE_IXP2000
diff --git a/arch/arm/mach-omap1/mcbsp.c b/arch/arm/mach-omap1/mcbsp.c
index 826010d5d014..2baeaeb0c900 100644
--- a/arch/arm/mach-omap1/mcbsp.c
+++ b/arch/arm/mach-omap1/mcbsp.c
@@ -159,6 +159,7 @@ static struct omap_mcbsp_ops omap1_mcbsp_ops = {
 #ifdef CONFIG_ARCH_OMAP730
 static struct omap_mcbsp_platform_data omap730_mcbsp_pdata[] = {
         {
+                .phys_base      = OMAP730_MCBSP1_BASE,
                 .virt_base      = io_p2v(OMAP730_MCBSP1_BASE),
                 .dma_rx_sync    = OMAP_DMA_MCBSP1_RX,
                 .dma_tx_sync    = OMAP_DMA_MCBSP1_TX,
@@ -167,6 +168,7 @@ static struct omap_mcbsp_platform_data omap730_mcbsp_pdata[] = {
                 .ops            = &omap1_mcbsp_ops,
         },
         {
+                .phys_base      = OMAP730_MCBSP2_BASE,
                 .virt_base      = io_p2v(OMAP730_MCBSP2_BASE),
                 .dma_rx_sync    = OMAP_DMA_MCBSP3_RX,
                 .dma_tx_sync    = OMAP_DMA_MCBSP3_TX,
@@ -184,6 +186,7 @@ static struct omap_mcbsp_platform_data omap730_mcbsp_pdata[] = {
 #ifdef CONFIG_ARCH_OMAP15XX
 static struct omap_mcbsp_platform_data omap15xx_mcbsp_pdata[] = {
         {
+                .phys_base      = OMAP1510_MCBSP1_BASE,
                 .virt_base      = OMAP1510_MCBSP1_BASE,
                 .dma_rx_sync    = OMAP_DMA_MCBSP1_RX,
                 .dma_tx_sync    = OMAP_DMA_MCBSP1_TX,
@@ -193,6 +196,7 @@ static struct omap_mcbsp_platform_data omap15xx_mcbsp_pdata[] = {
                 .clk_name       = "mcbsp_clk",
                 },
         {
+                .phys_base      = OMAP1510_MCBSP2_BASE,
                 .virt_base      = io_p2v(OMAP1510_MCBSP2_BASE),
                 .dma_rx_sync    = OMAP_DMA_MCBSP2_RX,
                 .dma_tx_sync    = OMAP_DMA_MCBSP2_TX,
@@ -201,6 +205,7 @@ static struct omap_mcbsp_platform_data omap15xx_mcbsp_pdata[] = {
                 .ops            = &omap1_mcbsp_ops,
         },
         {
+                .phys_base      = OMAP1510_MCBSP3_BASE,
                 .virt_base      = OMAP1510_MCBSP3_BASE,
                 .dma_rx_sync    = OMAP_DMA_MCBSP3_RX,
                 .dma_tx_sync    = OMAP_DMA_MCBSP3_TX,
@@ -219,6 +224,7 @@ static struct omap_mcbsp_platform_data omap15xx_mcbsp_pdata[] = {
 #ifdef CONFIG_ARCH_OMAP16XX
 static struct omap_mcbsp_platform_data omap16xx_mcbsp_pdata[] = {
         {
+                .phys_base      = OMAP1610_MCBSP1_BASE,
                 .virt_base      = OMAP1610_MCBSP1_BASE,
                 .dma_rx_sync    = OMAP_DMA_MCBSP1_RX,
                 .dma_tx_sync    = OMAP_DMA_MCBSP1_TX,
@@ -228,6 +234,7 @@ static struct omap_mcbsp_platform_data omap16xx_mcbsp_pdata[] = {
                 .clk_name       = "mcbsp_clk",
         },
         {
+                .phys_base      = OMAP1610_MCBSP2_BASE,
                 .virt_base      = io_p2v(OMAP1610_MCBSP2_BASE),
                 .dma_rx_sync    = OMAP_DMA_MCBSP2_RX,
                 .dma_tx_sync    = OMAP_DMA_MCBSP2_TX,
@@ -236,6 +243,7 @@ static struct omap_mcbsp_platform_data omap16xx_mcbsp_pdata[] = {
                 .ops            = &omap1_mcbsp_ops,
         },
         {
+                .phys_base      = OMAP1610_MCBSP3_BASE,
                 .virt_base      = OMAP1610_MCBSP3_BASE,
                 .dma_rx_sync    = OMAP_DMA_MCBSP3_RX,
                 .dma_tx_sync    = OMAP_DMA_MCBSP3_TX,
diff --git a/arch/arm/mach-omap2/mcbsp.c b/arch/arm/mach-omap2/mcbsp.c
index 27eb6e3ca926..b261f1f80b5e 100644
--- a/arch/arm/mach-omap2/mcbsp.c
+++ b/arch/arm/mach-omap2/mcbsp.c
@@ -134,6 +134,7 @@ static struct omap_mcbsp_ops omap2_mcbsp_ops = {
 #ifdef CONFIG_ARCH_OMAP24XX
 static struct omap_mcbsp_platform_data omap24xx_mcbsp_pdata[] = {
         {
+                .phys_base      = OMAP24XX_MCBSP1_BASE,
                 .virt_base      = IO_ADDRESS(OMAP24XX_MCBSP1_BASE),
                 .dma_rx_sync    = OMAP24XX_DMA_MCBSP1_RX,
                 .dma_tx_sync    = OMAP24XX_DMA_MCBSP1_TX,
@@ -143,6 +144,7 @@ static struct omap_mcbsp_platform_data omap24xx_mcbsp_pdata[] = {
                 .clk_name       = "mcbsp_clk",
         },
         {
+                .phys_base      = OMAP24XX_MCBSP2_BASE,
                 .virt_base      = IO_ADDRESS(OMAP24XX_MCBSP2_BASE),
                 .dma_rx_sync    = OMAP24XX_DMA_MCBSP2_RX,
                 .dma_tx_sync    = OMAP24XX_DMA_MCBSP2_TX,
@@ -161,6 +163,7 @@ static struct omap_mcbsp_platform_data omap24xx_mcbsp_pdata[] = {
 #ifdef CONFIG_ARCH_OMAP34XX
 static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
         {
+                .phys_base      = OMAP34XX_MCBSP1_BASE,
                 .virt_base      = IO_ADDRESS(OMAP34XX_MCBSP1_BASE),
                 .dma_rx_sync    = OMAP24XX_DMA_MCBSP1_RX,
                 .dma_tx_sync    = OMAP24XX_DMA_MCBSP1_TX,
@@ -170,6 +173,7 @@ static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
                 .clk_name       = "mcbsp_clk",
         },
         {
+                .phys_base      = OMAP34XX_MCBSP2_BASE,
                 .virt_base      = IO_ADDRESS(OMAP34XX_MCBSP2_BASE),
                 .dma_rx_sync    = OMAP24XX_DMA_MCBSP2_RX,
                 .dma_tx_sync    = OMAP24XX_DMA_MCBSP2_TX,
diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c
index 25d9a11eb617..a713e40e1f1a 100644
--- a/arch/arm/mm/mmu.c
+++ b/arch/arm/mm/mmu.c
@@ -211,6 +211,12 @@ static struct mem_type mem_types[] = {
                                   PMD_SECT_TEX(1),
                 .domain         = DOMAIN_IO,
         },
+        [MT_DEVICE_WC] = {      /* ioremap_wc */
+                .prot_pte       = PROT_PTE_DEVICE,
+                .prot_l1        = PMD_TYPE_TABLE,
+                .prot_sect      = PROT_SECT_DEVICE,
+                .domain         = DOMAIN_IO,
+        },
         [MT_CACHECLEAN] = {
                 .prot_sect = PMD_TYPE_SECT | PMD_SECT_XN,
                 .domain    = DOMAIN_KERNEL,
@@ -273,6 +279,20 @@ static void __init build_mem_type_table(void)
         }
 
         /*
+         * On non-Xscale3 ARMv5-and-older systems, use CB=01
+         * (Uncached/Buffered) for ioremap_wc() mappings.  On XScale3
+         * and ARMv6+, use TEXCB=00100 mappings (Inner/Outer Uncacheable
+         * in xsc3 parlance, Uncached Normal in ARMv6 parlance).
+         */
+        if (cpu_is_xsc3() || cpu_arch >= CPU_ARCH_ARMv6) {
+                mem_types[MT_DEVICE_WC].prot_pte_ext |= PTE_EXT_TEX(1);
+                mem_types[MT_DEVICE_WC].prot_sect |= PMD_SECT_TEX(1);
+        } else {
+                mem_types[MT_DEVICE_WC].prot_pte |= L_PTE_BUFFERABLE;
+                mem_types[MT_DEVICE_WC].prot_sect |= PMD_SECT_BUFFERABLE;
+        }
+
+        /*
          * ARMv5 and lower, bit 4 must be set for page tables.
          * (was: cache "update-able on write" bit on ARM610)
          * However, Xscale cores require this bit to be cleared.
diff --git a/arch/arm/plat-mxc/clock.c b/arch/arm/plat-mxc/clock.c
index 2f8627218839..0a38f0b396eb 100644
--- a/arch/arm/plat-mxc/clock.c
+++ b/arch/arm/plat-mxc/clock.c
@@ -37,7 +37,6 @@
 #include <linux/proc_fs.h>
 #include <linux/semaphore.h>
 #include <linux/string.h>
-#include <linux/version.h>
 
 #include <mach/clock.h>
 
diff --git a/arch/arm/plat-omap/gpio.c b/arch/arm/plat-omap/gpio.c
index 3e76ee2bc731..9e1341ebc14e 100644
--- a/arch/arm/plat-omap/gpio.c
+++ b/arch/arm/plat-omap/gpio.c
@@ -1488,7 +1488,7 @@ static int __init _omap_gpio_init(void)
                 bank->chip.set = gpio_set;
                 if (bank_is_mpuio(bank)) {
                         bank->chip.label = "mpuio";
-#ifdef CONFIG_ARCH_OMAP1
+#ifdef CONFIG_ARCH_OMAP16XX
                         bank->chip.dev = &omap_mpuio_device.dev;
 #endif
                         bank->chip.base = OMAP_MPUIO(0);
diff --git a/arch/arm/plat-omap/include/mach/mcbsp.h b/arch/arm/plat-omap/include/mach/mcbsp.h
index 6eb44a92871d..8fdb95e26fcd 100644
--- a/arch/arm/plat-omap/include/mach/mcbsp.h
+++ b/arch/arm/plat-omap/include/mach/mcbsp.h
@@ -315,6 +315,7 @@ struct omap_mcbsp_ops {
 };
 
 struct omap_mcbsp_platform_data {
+        unsigned long phys_base;
         u32 virt_base;
         u8 dma_rx_sync, dma_tx_sync;
         u16 rx_irq, tx_irq;
@@ -324,6 +325,7 @@ struct omap_mcbsp_platform_data {
 
 struct omap_mcbsp {
         struct device *dev;
+        unsigned long phys_base;
         u32 io_base;
         u8 id;
         u8 free;
diff --git a/arch/arm/plat-omap/mcbsp.c b/arch/arm/plat-omap/mcbsp.c
index d0844050f2d2..014d26574bb6 100644
--- a/arch/arm/plat-omap/mcbsp.c
+++ b/arch/arm/plat-omap/mcbsp.c
@@ -651,7 +651,7 @@ int omap_mcbsp_xmit_buffer(unsigned int id, dma_addr_t buffer,
         omap_set_dma_dest_params(mcbsp[id].dma_tx_lch,
                                  src_port,
                                  OMAP_DMA_AMODE_CONSTANT,
-                                 mcbsp[id].io_base + OMAP_MCBSP_REG_DXR1,
+                                 mcbsp[id].phys_base + OMAP_MCBSP_REG_DXR1,
                                  0, 0);
 
         omap_set_dma_src_params(mcbsp[id].dma_tx_lch,
@@ -712,7 +712,7 @@ int omap_mcbsp_recv_buffer(unsigned int id, dma_addr_t buffer,
         omap_set_dma_src_params(mcbsp[id].dma_rx_lch,
                                 src_port,
                                 OMAP_DMA_AMODE_CONSTANT,
-                                mcbsp[id].io_base + OMAP_MCBSP_REG_DRR1,
+                                mcbsp[id].phys_base + OMAP_MCBSP_REG_DRR1,
                                 0, 0);
 
         omap_set_dma_dest_params(mcbsp[id].dma_rx_lch,
@@ -830,6 +830,7 @@ static int __init omap_mcbsp_probe(struct platform_device *pdev)
         mcbsp[id].dma_tx_lch = -1;
         mcbsp[id].dma_rx_lch = -1;
 
+        mcbsp[id].phys_base = pdata->phys_base;
         mcbsp[id].io_base = pdata->virt_base;
         /* Default I/O is IRQ based */
         mcbsp[id].io_type = OMAP_MCBSP_IRQ_IO;
diff --git a/arch/avr32/kernel/asm-offsets.c b/arch/avr32/kernel/asm-offsets.c
index e4796c67a831..d6a8193a1d2f 100644
--- a/arch/avr32/kernel/asm-offsets.c
+++ b/arch/avr32/kernel/asm-offsets.c
@@ -4,6 +4,8 @@
  * to extract and format the required data.
  */
 
+#include <linux/mm.h>
+#include <linux/sched.h>
 #include <linux/thread_info.h>
 #include <linux/kbuild.h>
 
@@ -17,4 +19,8 @@ void foo(void)
         OFFSET(TI_rar_saved, thread_info, rar_saved);
         OFFSET(TI_rsr_saved, thread_info, rsr_saved);
         OFFSET(TI_restart_block, thread_info, restart_block);
+        BLANK();
+        OFFSET(TSK_active_mm, task_struct, active_mm);
+        BLANK();
+        OFFSET(MM_pgd, mm_struct, pgd);
 }
diff --git a/arch/avr32/kernel/entry-avr32b.S b/arch/avr32/kernel/entry-avr32b.S
index 2b398cae110c..33d49377b8be 100644
--- a/arch/avr32/kernel/entry-avr32b.S
+++ b/arch/avr32/kernel/entry-avr32b.S
@@ -334,9 +334,64 @@ save_full_context_ex:
 
         /* Low-level exception handlers */
 handle_critical:
+        /*
+         * AT32AP700x errata:
+         *
+         * After a Java stack overflow or underflow trap, any CPU
+         * memory access may cause erratic behavior. This will happen
+         * when the four least significant bits of the JOSP system
+         * register contains any value between 9 and 15 (inclusive).
+         *
+         * Possible workarounds:
+         *   - Don't use the Java Extension Module
+         *   - Ensure that the stack overflow and underflow trap
+         *     handlers do not do any memory access or trigger any
+         *     exceptions before the overflow/underflow condition is
+         *     cleared (by incrementing or decrementing the JOSP)
+         *   - Make sure that JOSP does not contain any problematic
+         *     value before doing any exception or interrupt
+         *     processing.
+         *   - Set up a critical exception handler which writes a
+         *     known-to-be-safe value, e.g. 4, to JOSP before doing
+         *     any further processing.
+         *
+         * We'll use the last workaround for now since we cannot
+         * guarantee that user space processes don't use Java mode.
+         * Non-well-behaving userland will be terminated with extreme
+         * prejudice.
+         */
+#ifdef CONFIG_CPU_AT32AP700X
+        /*
+         * There's a chance we can't touch memory, so temporarily
+         * borrow PTBR to save the stack pointer while we fix things
+         * up...
+         */
+        mtsr    SYSREG_PTBR, sp
+        mov     sp, 4
+        mtsr    SYSREG_JOSP, sp
+        mfsr    sp, SYSREG_PTBR
+        sub     pc, -2
+
+        /* Push most of pt_regs on stack. We'll do the rest later */
         sub     sp, 4
-        stmts   --sp, r0-lr
-        rcall   save_full_context_ex
+        pushm   r0-r12
+
+        /* PTBR mirrors current_thread_info()->task->active_mm->pgd */
+        get_thread_info r0
+        ld.w    r1, r0[TI_task]
+        ld.w    r2, r1[TSK_active_mm]
+        ld.w    r3, r2[MM_pgd]
+        mtsr    SYSREG_PTBR, r3
+#else
+        sub     sp, 4
+        pushm   r0-r12
+#endif
+        sub     r0, sp, -(14 * 4)
+        mov     r1, lr
+        mfsr    r2, SYSREG_RAR_EX
+        mfsr    r3, SYSREG_RSR_EX
+        pushm   r0-r3
+
         mfsr    r12, SYSREG_ECR
         mov     r11, sp
         rcall   do_critical_exception
diff --git a/arch/avr32/mach-at32ap/pm-at32ap700x.S b/arch/avr32/mach-at32ap/pm-at32ap700x.S
index 5be4de65b209..17503b0ed6c9 100644
--- a/arch/avr32/mach-at32ap/pm-at32ap700x.S
+++ b/arch/avr32/mach-at32ap/pm-at32ap700x.S
@@ -134,7 +134,7 @@ pm_standby:
         mov     r11, SDRAMC_LPR_LPCB_SELF_RFR
         bfins   r10, r11, 0, 2          /* LPCB <- self Refresh */
         sync    0                       /* flush write buffer */
-        st.w    r12[SDRAMC_LPR], r11    /* put SDRAM in self-refresh mode */
+        st.w    r12[SDRAMC_LPR], r10    /* put SDRAM in self-refresh mode */
         ld.w    r11, r12[SDRAMC_LPR]
         unmask_interrupts
         sleep   CPU_SLEEP_FROZEN
diff --git a/arch/ia64/include/asm/sections.h b/arch/ia64/include/asm/sections.h
index 7286e4a9fe84..a7acad2bc2f0 100644
--- a/arch/ia64/include/asm/sections.h
+++ b/arch/ia64/include/asm/sections.h
@@ -21,5 +21,8 @@ extern char __start_gate_brl_fsys_bubble_down_patchlist[], __end_gate_brl_fsys_b
 extern char __start_unwind[], __end_unwind[];
 extern char __start_ivt_text[], __end_ivt_text[];
 
+#undef dereference_function_descriptor
+void *dereference_function_descriptor(void *);
+
 #endif /* _ASM_IA64_SECTIONS_H */
 
diff --git a/arch/ia64/kernel/module.c b/arch/ia64/kernel/module.c
index 29aad349e0c4..545626f66a4c 100644
--- a/arch/ia64/kernel/module.c
+++ b/arch/ia64/kernel/module.c
@@ -31,9 +31,11 @@
 #include <linux/elf.h>
 #include <linux/moduleloader.h>
 #include <linux/string.h>
+#include <linux/uaccess.h>
 #include <linux/vmalloc.h>
 
 #include <asm/patch.h>
+#include <asm/sections.h>
 #include <asm/unaligned.h>
 
 #define ARCH_MODULE_DEBUG 0
@@ -941,3 +943,13 @@ module_arch_cleanup (struct module *mod)
         if (mod->arch.core_unw_table)
                 unw_remove_unwind_table(mod->arch.core_unw_table);
 }
+
+void *dereference_function_descriptor(void *ptr)
+{
+        struct fdesc *desc = ptr;
+        void *p;
+
+        if (!probe_kernel_address(&desc->ip, p))
+                ptr = p;
+        return ptr;
+}
diff --git a/arch/mips/sgi-ip22/ip22-platform.c b/arch/mips/sgi-ip22/ip22-platform.c
index 60141235ec40..52486c4d2b01 100644
--- a/arch/mips/sgi-ip22/ip22-platform.c
+++ b/arch/mips/sgi-ip22/ip22-platform.c
@@ -150,7 +150,7 @@ static int __init sgiseeq_devinit(void)
                 return res;
 
         /* Second HPC is missing? */
-        if (!ip22_is_fullhouse() ||
+        if (ip22_is_fullhouse() ||
             get_dbe(tmp, (unsigned int *)&hpc3c1->pbdma[1]))
                 return 0;
 
diff --git a/arch/parisc/kernel/module.c b/arch/parisc/kernel/module.c
index fdacdd4341c9..44138c3e6ea7 100644
--- a/arch/parisc/kernel/module.c
+++ b/arch/parisc/kernel/module.c
@@ -47,7 +47,9 @@
 #include <linux/string.h>
 #include <linux/kernel.h>
 #include <linux/bug.h>
+#include <linux/uaccess.h>
 
+#include <asm/sections.h>
 #include <asm/unwind.h>
 
 #if 0
@@ -860,3 +862,15 @@ void module_arch_cleanup(struct module *mod)
         deregister_unwind_table(mod);
         module_bug_cleanup(mod);
 }
+
+#ifdef CONFIG_64BIT
+void *dereference_function_descriptor(void *ptr)
+{
+        Elf64_Fdesc *desc = ptr;
+        void *p;
+
+        if (!probe_kernel_address(&desc->addr, p))
+                ptr = p;
+        return ptr;
+}
+#endif
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index 14174aa24074..717a3bc1352e 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -49,7 +49,7 @@ zlib       := inffast.c inflate.c inftrees.c
 zlibheader := inffast.h inffixed.h inflate.h inftrees.h infutil.h
 zliblinuxheader := zlib.h zconf.h zutil.h
 
-$(addprefix $(obj)/,$(zlib) gunzip_util.o main.o): \
+$(addprefix $(obj)/,$(zlib) cuboot-c2k.o gunzip_util.o main.o prpmc2800.o): \
         $(addprefix $(obj)/,$(zliblinuxheader)) $(addprefix $(obj)/,$(zlibheader))
 
 src-libfdt := fdt.c fdt_ro.c fdt_wip.c fdt_sw.c fdt_rw.c fdt_strerror.c
diff --git a/arch/powerpc/include/asm/sections.h b/arch/powerpc/include/asm/sections.h
index 916018e425c4..7710e9e6660f 100644
--- a/arch/powerpc/include/asm/sections.h
+++ b/arch/powerpc/include/asm/sections.h
@@ -16,6 +16,9 @@ static inline int in_kernel_text(unsigned long addr)
         return 0;
 }
 
+#undef dereference_function_descriptor
+void *dereference_function_descriptor(void *);
+
 #endif
 
 #endif /* __KERNEL__ */
diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c
index ee6a2982d567..ad79de272ff3 100644
--- a/arch/powerpc/kernel/module_64.c
+++ b/arch/powerpc/kernel/module_64.c
@@ -21,8 +21,9 @@
 #include <linux/err.h>
 #include <linux/vmalloc.h>
 #include <linux/bug.h>
+#include <linux/uaccess.h>
 #include <asm/module.h>
-#include <asm/uaccess.h>
+#include <asm/sections.h>
 #include <asm/firmware.h>
 #include <asm/code-patching.h>
 #include <linux/sort.h>
@@ -451,3 +452,13 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
 
         return 0;
 }
+
+void *dereference_function_descriptor(void *ptr)
+{
+        struct ppc64_opd_entry *desc = ptr;
+        void *p;
+
+        if (!probe_kernel_address(&desc->funcaddr, p))
+                ptr = p;
+        return ptr;
+}
diff --git a/arch/powerpc/platforms/cell/spufs/sched.c b/arch/powerpc/platforms/cell/spufs/sched.c
index 1c1b627ee843..67595bc380dc 100644
--- a/arch/powerpc/platforms/cell/spufs/sched.c
+++ b/arch/powerpc/platforms/cell/spufs/sched.c
@@ -643,9 +643,10 @@ static struct spu *find_victim(struct spu_context *ctx)
                             !(tmp->flags & SPU_CREATE_NOSCHED) &&
                             (!victim || tmp->prio > victim->prio)) {
                                 victim = spu->ctx;
-                                get_spu_context(victim);
                         }
                 }
+                if (victim)
+                        get_spu_context(victim);
                 mutex_unlock(&cbe_spu_info[node].list_mutex);
 
                 if (victim) {
@@ -727,17 +728,33 @@ static void spu_schedule(struct spu *spu, struct spu_context *ctx)
         /* not a candidate for interruptible because it's called either
            from the scheduler thread or from spu_deactivate */
         mutex_lock(&ctx->state_mutex);
-        __spu_schedule(spu, ctx);
+        if (ctx->state == SPU_STATE_SAVED)
+                __spu_schedule(spu, ctx);
         spu_release(ctx);
 }
 
-static void spu_unschedule(struct spu *spu, struct spu_context *ctx)
+/**
+ * spu_unschedule - remove a context from a spu, and possibly release it.
+ * @spu:        The SPU to unschedule from
+ * @ctx:        The context currently scheduled on the SPU
+ * @free_spu    Whether to free the SPU for other contexts
+ *
+ * Unbinds the context @ctx from the SPU @spu. If @free_spu is non-zero, the
+ * SPU is made available for other contexts (ie, may be returned by
+ * spu_get_idle). If this is zero, the caller is expected to schedule another
+ * context to this spu.
+ *
+ * Should be called with ctx->state_mutex held.
+ */
+static void spu_unschedule(struct spu *spu, struct spu_context *ctx,
+                int free_spu)
 {
         int node = spu->node;
 
         mutex_lock(&cbe_spu_info[node].list_mutex);
         cbe_spu_info[node].nr_active--;
-        spu->alloc_state = SPU_FREE;
+        if (free_spu)
+                spu->alloc_state = SPU_FREE;
         spu_unbind_context(spu, ctx);
         ctx->stats.invol_ctx_switch++;
         spu->stats.invol_ctx_switch++;
@@ -837,7 +854,7 @@ static int __spu_deactivate(struct spu_context *ctx, int force, int max_prio)
         if (spu) {
                 new = grab_runnable_context(max_prio, spu->node);
                 if (new || force) {
-                        spu_unschedule(spu, ctx);
+                        spu_unschedule(spu, ctx, new == NULL);
                         if (new) {
                                 if (new->flags & SPU_CREATE_NOSCHED)
                                         wake_up(&new->stop_wq);
@@ -910,7 +927,7 @@ static noinline void spusched_tick(struct spu_context *ctx)
 
         new = grab_runnable_context(ctx->prio + 1, spu->node);
         if (new) {
-                spu_unschedule(spu, ctx);
+                spu_unschedule(spu, ctx, 0);
                 if (test_bit(SPU_SCHED_SPU_RUN, &ctx->sched_flags))
                         spu_add_to_rq(ctx);
         } else {
diff --git a/arch/s390/kernel/compat_ptrace.h b/arch/s390/kernel/compat_ptrace.h
index cde81fa64f89..a2be3a978d5c 100644
--- a/arch/s390/kernel/compat_ptrace.h
+++ b/arch/s390/kernel/compat_ptrace.h
@@ -42,6 +42,7 @@ struct user_regs_struct32
         u32 gprs[NUM_GPRS];
         u32 acrs[NUM_ACRS];
         u32 orig_gpr2;
+        /* nb: there's a 4-byte hole here */
         s390_fp_regs fp_regs;
         /*
          * These per registers are in here so that gdb can modify them
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index 2815bfe348a6..c8b08289eb87 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -170,6 +170,13 @@ static unsigned long __peek_user(struct task_struct *child, addr_t addr)
                  */
                 tmp = (addr_t) task_pt_regs(child)->orig_gpr2;
 
+        } else if (addr < (addr_t) &dummy->regs.fp_regs) {
+                /*
+                 * prevent reads of padding hole between
+                 * orig_gpr2 and fp_regs on s390.
+                 */
+                tmp = 0;
+
         } else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
                 /* 
                  * floating point regs. are stored in the thread structure
@@ -270,6 +277,13 @@ static int __poke_user(struct task_struct *child, addr_t addr, addr_t data)
                  */
                 task_pt_regs(child)->orig_gpr2 = data;
 
+        } else if (addr < (addr_t) &dummy->regs.fp_regs) {
+                /*
+                 * prevent writes of padding hole between
+                 * orig_gpr2 and fp_regs on s390.
+                 */
+                return 0;
+
         } else if (addr < (addr_t) (&dummy->regs.fp_regs + 1)) {
                 /*
                  * floating point regs. are stored in the thread structure
@@ -428,6 +442,13 @@ static u32 __peek_user_compat(struct task_struct *child, addr_t addr)
                  */
                 tmp = *(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4);
 
+        } else if (addr < (addr_t) &dummy32->regs.fp_regs) {
+                /*
+                 * prevent reads of padding hole between
+                 * orig_gpr2 and fp_regs on s390.
+                 */
+                tmp = 0;
+
         } else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
                 /*
                  * floating point regs. are stored in the thread structure 
@@ -514,6 +535,13 @@ static int __poke_user_compat(struct task_struct *child,
                  */
                 *(__u32*)((addr_t) &task_pt_regs(child)->orig_gpr2 + 4) = tmp;
 
+        } else if (addr < (addr_t) &dummy32->regs.fp_regs) {
+                /*
+                 * prevent writess of padding hole between
+                 * orig_gpr2 and fp_regs on s390.
+                 */
+                return 0;
+
         } else if (addr < (addr_t) (&dummy32->regs.fp_regs + 1)) {
                 /*
                  * floating point regs. are stored in the thread structure 
diff --git a/arch/sparc64/kernel/irq.c b/arch/sparc64/kernel/irq.c
index 9b6689d9d570..23963882bc18 100644
--- a/arch/sparc64/kernel/irq.c
+++ b/arch/sparc64/kernel/irq.c
@@ -792,6 +792,8 @@ void fixup_irqs(void)
                 }
                 spin_unlock_irqrestore(&irq_desc[irq].lock, flags);
         }
+
+        tick_ops->disable_irq();
 }
 #endif
 
diff --git a/arch/sparc64/kernel/smp.c b/arch/sparc64/kernel/smp.c
index 743ccad61c60..2be166c544ca 100644
--- a/arch/sparc64/kernel/smp.c
+++ b/arch/sparc64/kernel/smp.c
@@ -80,8 +80,6 @@ void smp_bogo(struct seq_file *m)
                            i, cpu_data(i).clock_tick);
 }
 
-static __cacheline_aligned_in_smp DEFINE_SPINLOCK(call_lock);
-
 extern void setup_sparc64_timer(void);
 
 static volatile unsigned long callin_flag = 0;
@@ -120,9 +118,9 @@ void __cpuinit smp_callin(void)
         while (!cpu_isset(cpuid, smp_commenced_mask))
                 rmb();
 
-        spin_lock(&call_lock);
+        ipi_call_lock();
         cpu_set(cpuid, cpu_online_map);
-        spin_unlock(&call_lock);
+        ipi_call_unlock();
 
         /* idle thread is expected to have preempt disabled */
         preempt_disable();
@@ -1305,10 +1303,6 @@ int __cpu_disable(void)
         c->core_id = 0;
         c->proc_id = -1;
 
-        spin_lock(&call_lock);
-        cpu_clear(cpu, cpu_online_map);
-        spin_unlock(&call_lock);
-
         smp_wmb();
 
         /* Make sure no interrupts point to this cpu.  */
@@ -1318,6 +1312,10 @@ int __cpu_disable(void)
         mdelay(1);
         local_irq_disable();
 
+        ipi_call_lock();
+        cpu_clear(cpu, cpu_online_map);
+        ipi_call_unlock();
+
         return 0;
 }
 
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index 2c518fbc52ec..b225219c448c 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -382,14 +382,17 @@ config X86_OOSTORE
 # P6_NOPs are a relatively minor optimization that require a family >=
 # 6 processor, except that it is broken on certain VIA chips.
 # Furthermore, AMD chips prefer a totally different sequence of NOPs
-# (which work on all CPUs).  As a result, disallow these if we're
-# compiling X86_GENERIC but not X86_64 (these NOPs do work on all
-# x86-64 capable chips); the list of processors in the right-hand clause
-# are the cores that benefit from this optimization.
+# (which work on all CPUs).  In addition, it looks like Virtual PC
+# does not understand them.
+#
+# As a result, disallow these if we're not compiling for X86_64 (these
+# NOPs do work on all x86-64 capable chips); the list of processors in
+# the right-hand clause are the cores that benefit from this optimization.
 #
 config X86_P6_NOP
         def_bool y
-        depends on (X86_64 || !X86_GENERIC) && (M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MPENTIUM4 || MPSC)
+        depends on X86_64
+        depends on (MCORE2 || MPENTIUM4 || MPSC)
 
 config X86_TSC
         def_bool y
diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c
index 9af89078f7bb..66e48aa2dd1b 100644
--- a/arch/x86/kernel/e820.c
+++ b/arch/x86/kernel/e820.c
@@ -1203,7 +1203,7 @@ static int __init parse_memmap_opt(char *p)
         if (!p)
                 return -EINVAL;
 
-        if (!strcmp(p, "exactmap")) {
+        if (!strncmp(p, "exactmap", 8)) {
 #ifdef CONFIG_CRASH_DUMP
                 /*
                  * If we are doing a crash dump, we still need to know