Merge branch 'for-linus' of git://git.kernel.dk/linux-2.6-block

* 'for-linus' of git://git.kernel.dk/linux-2.6-block: (37 commits)
  splice: fix generic_file_splice_read() race with page invalidation
  ramfs: enable splice write
  drivers/block/pktcdvd.c: avoid useless memset
  cdrom: revert commit 22a9189 (cdrom: use kmalloced buffers instead of buffers on stack)
  scsi: sr avoids useless buffer allocation
  block: blk_rq_map_kern uses the bounce buffers for stack buffers
  block: add blk_queue_update_dma_pad
  DAC960: push down BKL
  pktcdvd: push BKL down into driver
  paride: push ioctl down into driver
  block: use get_unaligned_* helpers
  block: extend queue_flag bitops
  block: request_module(): use format string
  Add bvec_merge_data to handle stacked devices and ->merge_bvec()
  block: integrity flags can't use bit ops on unsigned short
  cmdfilter: extend default read filter
  sg: fix odd style (extra parenthesis) introduced by cmd filter patch
  block: add bounce support to blk_rq_map_user_iov
  cfq-iosched: get rid of enable_idle being unused warning
  allow userspace to modify scsi command filter on per device basis
  ...

16 files changed, 331 insertions, 344 deletions

diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 57a43649a461..499ccc628d81 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -885,7 +885,8 @@ static int ata_scsi_dev_config(struct scsi_device *sdev,
                 /* set the min alignment and padding */
                 blk_queue_update_dma_alignment(sdev->request_queue,
                                                ATA_DMA_PAD_SZ - 1);
-                blk_queue_dma_pad(sdev->request_queue, ATA_DMA_PAD_SZ - 1);
+                blk_queue_update_dma_pad(sdev->request_queue,
+                                         ATA_DMA_PAD_SZ - 1);
 
                 /* configure draining */
                 buf = kmalloc(ATAPI_MAX_DRAIN, q->bounce_gfp | GFP_KERNEL);
diff --git a/drivers/block/DAC960.c b/drivers/block/DAC960.c
index cd03473f3547..a002a381df92 100644
--- a/drivers/block/DAC960.c
+++ b/drivers/block/DAC960.c
@@ -6628,15 +6628,18 @@ static void DAC960_DestroyProcEntries(DAC960_Controller_T *Controller)
  * DAC960_gam_ioctl is the ioctl function for performing RAID operations.
 */
 
-static int DAC960_gam_ioctl(struct inode *inode, struct file *file,
-                            unsigned int Request, unsigned long Argument)
+static long DAC960_gam_ioctl(struct file *file, unsigned int Request,
+                                                unsigned long Argument)
 {
-  int ErrorCode = 0;
+  long ErrorCode = 0;
   if (!capable(CAP_SYS_ADMIN)) return -EACCES;
+
+  lock_kernel();
   switch (Request)
     {
     case DAC960_IOCTL_GET_CONTROLLER_COUNT:
-      return DAC960_ControllerCount;
+      ErrorCode = DAC960_ControllerCount;
+      break;
     case DAC960_IOCTL_GET_CONTROLLER_INFO:
       {
         DAC960_ControllerInfo_T __user *UserSpaceControllerInfo =
@@ -6644,15 +6647,20 @@ static int DAC960_gam_ioctl(struct inode *inode, struct file *file,
         DAC960_ControllerInfo_T ControllerInfo;
         DAC960_Controller_T *Controller;
         int ControllerNumber;
-        if (UserSpaceControllerInfo == NULL) return -EINVAL;
-        ErrorCode = get_user(ControllerNumber,
+        if (UserSpaceControllerInfo == NULL)
+                ErrorCode = -EINVAL;
+        else ErrorCode = get_user(ControllerNumber,
                              &UserSpaceControllerInfo->ControllerNumber);
-        if (ErrorCode != 0) return ErrorCode;
+        if (ErrorCode != 0)
+                break;;
+        ErrorCode = -ENXIO;
         if (ControllerNumber < 0 ||
-            ControllerNumber > DAC960_ControllerCount - 1)
-          return -ENXIO;
+            ControllerNumber > DAC960_ControllerCount - 1) {
+          break;
+        }
         Controller = DAC960_Controllers[ControllerNumber];
-        if (Controller == NULL) return -ENXIO;
+        if (Controller == NULL)
+                break;;
         memset(&ControllerInfo, 0, sizeof(DAC960_ControllerInfo_T));
         ControllerInfo.ControllerNumber = ControllerNumber;
         ControllerInfo.FirmwareType = Controller->FirmwareType;
@@ -6665,8 +6673,9 @@ static int DAC960_gam_ioctl(struct inode *inode, struct file *file,
         ControllerInfo.PCI_Address = Controller->PCI_Address;
         strcpy(ControllerInfo.ModelName, Controller->ModelName);
         strcpy(ControllerInfo.FirmwareVersion, Controller->FirmwareVersion);
-        return (copy_to_user(UserSpaceControllerInfo, &ControllerInfo,
+        ErrorCode = (copy_to_user(UserSpaceControllerInfo, &ControllerInfo,
                              sizeof(DAC960_ControllerInfo_T)) ? -EFAULT : 0);
+        break;
       }
     case DAC960_IOCTL_V1_EXECUTE_COMMAND:
       {
@@ -6684,30 +6693,39 @@ static int DAC960_gam_ioctl(struct inode *inode, struct file *file,
         int ControllerNumber, DataTransferLength;
         unsigned char *DataTransferBuffer = NULL;
         dma_addr_t DataTransferBufferDMA;
-        if (UserSpaceUserCommand == NULL) return -EINVAL;
+        if (UserSpaceUserCommand == NULL) {
+                ErrorCode = -EINVAL;
+                break;
+        }
         if (copy_from_user(&UserCommand, UserSpaceUserCommand,
                                    sizeof(DAC960_V1_UserCommand_T))) {
                 ErrorCode = -EFAULT;
-                goto Failure1a;
+                break;
         }
         ControllerNumber = UserCommand.ControllerNumber;
+        ErrorCode = -ENXIO;
         if (ControllerNumber < 0 ||
             ControllerNumber > DAC960_ControllerCount - 1)
-          return -ENXIO;
+                break;
         Controller = DAC960_Controllers[ControllerNumber];
-        if (Controller == NULL) return -ENXIO;
-        if (Controller->FirmwareType != DAC960_V1_Controller) return -EINVAL;
+        if (Controller == NULL)
+                break;
+        ErrorCode = -EINVAL;
+        if (Controller->FirmwareType != DAC960_V1_Controller)
+                break;
         CommandOpcode = UserCommand.CommandMailbox.Common.CommandOpcode;
         DataTransferLength = UserCommand.DataTransferLength;
-        if (CommandOpcode & 0x80) return -EINVAL;
+        if (CommandOpcode & 0x80)
+                break;
         if (CommandOpcode == DAC960_V1_DCDB)
           {
             if (copy_from_user(&DCDB, UserCommand.DCDB,
                                sizeof(DAC960_V1_DCDB_T))) {
                 ErrorCode = -EFAULT;
-                goto Failure1a;
+                break;
             }
-            if (DCDB.Channel >= DAC960_V1_MaxChannels) return -EINVAL;
+            if (DCDB.Channel >= DAC960_V1_MaxChannels)
+                        break;
             if (!((DataTransferLength == 0 &&
                    DCDB.Direction
                    == DAC960_V1_DCDB_NoDataTransfer) ||
@@ -6717,38 +6735,37 @@ static int DAC960_gam_ioctl(struct inode *inode, struct file *file,
                   (DataTransferLength < 0 &&
                    DCDB.Direction
                    == DAC960_V1_DCDB_DataTransferSystemToDevice)))
-              return -EINVAL;
+                        break;
             if (((DCDB.TransferLengthHigh4 << 16) | DCDB.TransferLength)
                 != abs(DataTransferLength))
-              return -EINVAL;
+                        break;
             DCDB_IOBUF = pci_alloc_consistent(Controller->PCIDevice,
                         sizeof(DAC960_V1_DCDB_T), &DCDB_IOBUFDMA);
-            if (DCDB_IOBUF == NULL)
-                        return -ENOMEM;
+            if (DCDB_IOBUF == NULL) {
+                        ErrorCode = -ENOMEM;
+                        break;
+                }
           }
+        ErrorCode = -ENOMEM;
         if (DataTransferLength > 0)
           {
             DataTransferBuffer = pci_alloc_consistent(Controller->PCIDevice,
                                 DataTransferLength, &DataTransferBufferDMA);
-            if (DataTransferBuffer == NULL) {
-                ErrorCode = -ENOMEM;
-                goto Failure1;
-            }
+            if (DataTransferBuffer == NULL)
+                break;
             memset(DataTransferBuffer, 0, DataTransferLength);
           }
         else if (DataTransferLength < 0)
           {
             DataTransferBuffer = pci_alloc_consistent(Controller->PCIDevice,
                                 -DataTransferLength, &DataTransferBufferDMA);
-            if (DataTransferBuffer == NULL) {
-                ErrorCode = -ENOMEM;
-                goto Failure1;
-            }
+            if (DataTransferBuffer == NULL)
+                break;
             if (copy_from_user(DataTransferBuffer,
                                UserCommand.DataTransferBuffer,
                                -DataTransferLength)) {
                 ErrorCode = -EFAULT;
-                goto Failure1;
+                break;
             }
           }
         if (CommandOpcode == DAC960_V1_DCDB)
@@ -6825,8 +6842,7 @@ static int DAC960_gam_ioctl(struct inode *inode, struct file *file,
         if (DCDB_IOBUF != NULL)
           pci_free_consistent(Controller->PCIDevice, sizeof(DAC960_V1_DCDB_T),
                         DCDB_IOBUF, DCDB_IOBUFDMA);
-      Failure1a:
-        return ErrorCode;
+        break;
       }
     case DAC960_IOCTL_V2_EXECUTE_COMMAND:
       {
@@ -6844,32 +6860,43 @@ static int DAC960_gam_ioctl(struct inode *inode, struct file *file,
         dma_addr_t DataTransferBufferDMA;
         unsigned char *RequestSenseBuffer = NULL;
         dma_addr_t RequestSenseBufferDMA;
-        if (UserSpaceUserCommand == NULL) return -EINVAL;
+
+        ErrorCode = -EINVAL;
+        if (UserSpaceUserCommand == NULL)
+                break;
         if (copy_from_user(&UserCommand, UserSpaceUserCommand,
                            sizeof(DAC960_V2_UserCommand_T))) {
                 ErrorCode = -EFAULT;
-                goto Failure2a;
+                break;
         }
+        ErrorCode = -ENXIO;
         ControllerNumber = UserCommand.ControllerNumber;
         if (ControllerNumber < 0 ||
             ControllerNumber > DAC960_ControllerCount - 1)
-          return -ENXIO;
+                break;
         Controller = DAC960_Controllers[ControllerNumber];
-        if (Controller == NULL) return -ENXIO;
-        if (Controller->FirmwareType != DAC960_V2_Controller) return -EINVAL;
+        if (Controller == NULL)
+                break;
+        if (Controller->FirmwareType != DAC960_V2_Controller){
+                ErrorCode = -EINVAL;
+                break;
+        }
         DataTransferLength = UserCommand.DataTransferLength;
+        ErrorCode = -ENOMEM;
         if (DataTransferLength > 0)
           {
             DataTransferBuffer = pci_alloc_consistent(Controller->PCIDevice,
                                 DataTransferLength, &DataTransferBufferDMA);
-            if (DataTransferBuffer == NULL) return -ENOMEM;
+            if (DataTransferBuffer == NULL)
+                break;
             memset(DataTransferBuffer, 0, DataTransferLength);
           }
         else if (DataTransferLength < 0)
           {
             DataTransferBuffer = pci_alloc_consistent(Controller->PCIDevice,
                                 -DataTransferLength, &DataTransferBufferDMA);
-            if (DataTransferBuffer == NULL) return -ENOMEM;
+            if (DataTransferBuffer == NULL)
+                break;
             if (copy_from_user(DataTransferBuffer,
                                UserCommand.DataTransferBuffer,
                                -DataTransferLength)) {
@@ -6979,8 +7006,7 @@ static int DAC960_gam_ioctl(struct inode *inode, struct file *file,
         if (RequestSenseBuffer != NULL)
           pci_free_consistent(Controller->PCIDevice, RequestSenseLength,
                 RequestSenseBuffer, RequestSenseBufferDMA);
-      Failure2a:
-        return ErrorCode;
+        break;
       }
     case DAC960_IOCTL_V2_GET_HEALTH_STATUS:
       {
@@ -6990,21 +7016,33 @@ static int DAC960_gam_ioctl(struct inode *inode, struct file *file,
         DAC960_V2_HealthStatusBuffer_T HealthStatusBuffer;
         DAC960_Controller_T *Controller;
         int ControllerNumber;
-        if (UserSpaceGetHealthStatus == NULL) return -EINVAL;
+        if (UserSpaceGetHealthStatus == NULL) {
+                ErrorCode = -EINVAL;
+                break;
+        }
         if (copy_from_user(&GetHealthStatus, UserSpaceGetHealthStatus,
-                           sizeof(DAC960_V2_GetHealthStatus_T)))
-                return -EFAULT;
+                           sizeof(DAC960_V2_GetHealthStatus_T))) {
+                ErrorCode = -EFAULT;
+                break;
+        }
+        ErrorCode = -ENXIO;
         ControllerNumber = GetHealthStatus.ControllerNumber;
         if (ControllerNumber < 0 ||
             ControllerNumber > DAC960_ControllerCount - 1)
-          return -ENXIO;
+                    break;
         Controller = DAC960_Controllers[ControllerNumber];
-        if (Controller == NULL) return -ENXIO;
-        if (Controller->FirmwareType != DAC960_V2_Controller) return -EINVAL;
+        if (Controller == NULL)
+                break;
+        if (Controller->FirmwareType != DAC960_V2_Controller) {
+                ErrorCode = -EINVAL;
+                break;
+        }
         if (copy_from_user(&HealthStatusBuffer,
                            GetHealthStatus.HealthStatusBuffer,
-                           sizeof(DAC960_V2_HealthStatusBuffer_T)))
-                return -EFAULT;
+                           sizeof(DAC960_V2_HealthStatusBuffer_T))) {
+                ErrorCode = -EFAULT;
+                break;
+        }
         while (Controller->V2.HealthStatusBuffer->StatusChangeCounter
                == HealthStatusBuffer.StatusChangeCounter &&
                Controller->V2.HealthStatusBuffer->NextEventSequenceNumber
@@ -7012,21 +7050,28 @@ static int DAC960_gam_ioctl(struct inode *inode, struct file *file,
           {
             interruptible_sleep_on_timeout(&Controller->HealthStatusWaitQueue,
                                            DAC960_MonitoringTimerInterval);
-            if (signal_pending(current)) return -EINTR;
+            if (signal_pending(current)) {
+                ErrorCode = -EINTR;
+                break;
+            }
           }
         if (copy_to_user(GetHealthStatus.HealthStatusBuffer,
                          Controller->V2.HealthStatusBuffer,
                          sizeof(DAC960_V2_HealthStatusBuffer_T)))
-                return -EFAULT;
-        return 0;
+                ErrorCode = -EFAULT;
+        else
+                ErrorCode =  0;
       }
+      default:
+        ErrorCode = -ENOTTY;
     }
-  return -EINVAL;
+  unlock_kernel();
+  return ErrorCode;
 }
 
 static const struct file_operations DAC960_gam_fops = {
         .owner          = THIS_MODULE,
-        .ioctl          = DAC960_gam_ioctl
+        .unlocked_ioctl = DAC960_gam_ioctl
 };
 
 static struct miscdevice DAC960_gam_dev = {
diff --git a/drivers/block/aoe/aoecmd.c b/drivers/block/aoe/aoecmd.c
index 41f818be2f7e..2f1746295d06 100644
--- a/drivers/block/aoe/aoecmd.c
+++ b/drivers/block/aoe/aoecmd.c
@@ -1003,7 +1003,7 @@ aoecmd_cfg_rsp(struct sk_buff *skb)
          * Enough people have their dip switches set backwards to
          * warrant a loud message for this special case.
          */
-        aoemajor = be16_to_cpu(get_unaligned(&h->major));
+        aoemajor = get_unaligned_be16(&h->major);
         if (aoemajor == 0xfff) {
                 printk(KERN_ERR "aoe: Warning: shelf address is all ones.  "
                         "Check shelf dip switches.\n");
diff --git a/drivers/block/paride/pt.c b/drivers/block/paride/pt.c
index 8b9549ab4a4e..27455ee1e9da 100644
--- a/drivers/block/paride/pt.c
+++ b/drivers/block/paride/pt.c
@@ -146,6 +146,7 @@ static int (*drives[4])[6] = {&drive0, &drive1, &drive2, &drive3};
 #include <linux/mtio.h>
 #include <linux/device.h>
 #include <linux/sched.h>        /* current, TASK_*, schedule_timeout() */
+#include <linux/smp_lock.h>
 
 #include <asm/uaccess.h>
 
@@ -189,8 +190,7 @@ module_param_array(drive3, int, NULL, 0);
 #define ATAPI_LOG_SENSE         0x4d
 
 static int pt_open(struct inode *inode, struct file *file);
-static int pt_ioctl(struct inode *inode, struct file *file,
-                    unsigned int cmd, unsigned long arg);
+static long pt_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 static int pt_release(struct inode *inode, struct file *file);
 static ssize_t pt_read(struct file *filp, char __user *buf,
                        size_t count, loff_t * ppos);
@@ -236,7 +236,7 @@ static const struct file_operations pt_fops = {
         .owner = THIS_MODULE,
         .read = pt_read,
         .write = pt_write,
-        .ioctl = pt_ioctl,
+        .unlocked_ioctl = pt_ioctl,
         .open = pt_open,
         .release = pt_release,
 };
@@ -685,8 +685,7 @@ out:
         return err;
 }
 
-static int pt_ioctl(struct inode *inode, struct file *file,
-         unsigned int cmd, unsigned long arg)
+static long pt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
         struct pt_unit *tape = file->private_data;
         struct mtop __user *p = (void __user *)arg;
@@ -700,23 +699,26 @@ static int pt_ioctl(struct inode *inode, struct file *file,
                 switch (mtop.mt_op) {
 
                 case MTREW:
+                        lock_kernel();
                         pt_rewind(tape);
+                        unlock_kernel();
                         return 0;
 
                 case MTWEOF:
+                        lock_kernel();
                         pt_write_fm(tape);
+                        unlock_kernel();
                         return 0;
 
                 default:
-                        printk("%s: Unimplemented mt_op %d\n", tape->name,
+                        /* FIXME: rate limit ?? */
+                        printk(KERN_DEBUG "%s: Unimplemented mt_op %d\n", tape->name,
                                mtop.mt_op);
                         return -EINVAL;
                 }
 
         default:
-                printk("%s: Unimplemented ioctl 0x%x\n", tape->name, cmd);
-                return -EINVAL;
-
+                return -ENOTTY;
         }
 }
 
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 3ba1df93e9e3..45bee918c46a 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -49,6 +49,7 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/kthread.h>
+#include <linux/smp_lock.h>
 #include <linux/errno.h>
 #include <linux/spinlock.h>
 #include <linux/file.h>
@@ -2079,7 +2080,6 @@ static noinline_for_stack int pkt_write_caching(struct pktcdvd_device *pd,
         unsigned char buf[64];
         int ret;
 
-        memset(buf, 0, sizeof(buf));
         init_cdrom_command(&cgc, buf, sizeof(buf), CGC_DATA_READ);
         cgc.sense = &sense;
         cgc.buflen = pd->mode_offset + 12;
@@ -2126,7 +2126,6 @@ static noinline_for_stack int pkt_get_max_speed(struct pktcdvd_device *pd,
         unsigned char *cap_buf;
         int ret, offset;
 
-        memset(buf, 0, sizeof(buf));
         cap_buf = &buf[sizeof(struct mode_page_header) + pd->mode_offset];
         init_cdrom_command(&cgc, buf, sizeof(buf), CGC_DATA_UNKNOWN);
         cgc.sense = &sense;
@@ -2633,11 +2632,12 @@ end_io:
 
 
 
-static int pkt_merge_bvec(struct request_queue *q, struct bio *bio, struct bio_vec *bvec)
+static int pkt_merge_bvec(struct request_queue *q, struct bvec_merge_data *bmd,
+                          struct bio_vec *bvec)
 {
         struct pktcdvd_device *pd = q->queuedata;
-        sector_t zone = ZONE(bio->bi_sector, pd);
-        int used = ((bio->bi_sector - zone) << 9) + bio->bi_size;
+        sector_t zone = ZONE(bmd->bi_sector, pd);
+        int used = ((bmd->bi_sector - zone) << 9) + bmd->bi_size;
         int remaining = (pd->settings.size << 9) - used;
         int remaining2;
 
@@ -2645,7 +2645,7 @@ static int pkt_merge_bvec(struct request_queue *q, struct bio *bio, struct bio_v
          * A bio <= PAGE_SIZE must be allowed. If it crosses a packet
          * boundary, pkt_make_request() will split the bio.
          */
-        remaining2 = PAGE_SIZE - bio->bi_size;
+        remaining2 = PAGE_SIZE - bmd->bi_size;
         remaining = max(remaining, remaining2);
 
         BUG_ON(remaining < 0);
@@ -2796,9 +2796,14 @@ out_mem:
         return ret;
 }
 
-static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
+static long pkt_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
-        struct pktcdvd_device *pd = inode->i_bdev->bd_disk->private_data;
+        struct inode *inode = file->f_path.dentry->d_inode;
+        struct pktcdvd_device *pd;
+        long ret;
+
+        lock_kernel();
+        pd = inode->i_bdev->bd_disk->private_data;
 
         VPRINTK("pkt_ioctl: cmd %x, dev %d:%d\n", cmd, imajor(inode), iminor(inode));
 
@@ -2811,7 +2816,8 @@ static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, u
         case CDROM_LAST_WRITTEN:
         case CDROM_SEND_PACKET:
         case SCSI_IOCTL_SEND_COMMAND:
-                return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
+                ret = blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
+                break;
 
         case CDROMEJECT:
                 /*
@@ -2820,14 +2826,15 @@ static int pkt_ioctl(struct inode *inode, struct file *file, unsigned int cmd, u
                  */
                 if (pd->refcnt == 1)
                         pkt_lock_door(pd, 0);
-                return blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
+                ret = blkdev_ioctl(pd->bdev->bd_inode, file, cmd, arg);
+                break;
 
         default:
                 VPRINTK(DRIVER_NAME": Unknown ioctl for %s (%x)\n", pd->name, cmd);
-                return -ENOTTY;
+                ret = -ENOTTY;
         }
-
-        return 0;
+        unlock_kernel();
+        return ret;
 }
 
 static int pkt_media_changed(struct gendisk *disk)
@@ -2849,7 +2856,7 @@ static struct block_device_operations pktcdvd_ops = {
         .owner =                THIS_MODULE,
         .open =                 pkt_open,
         .release =              pkt_close,
-        .ioctl =                pkt_ioctl,
+        .unlocked_ioctl =       pkt_ioctl,
         .media_changed =        pkt_media_changed,
 };
 
@@ -3014,7 +3021,8 @@ static void pkt_get_status(struct pkt_ctrl_command *ctrl_cmd)
         mutex_unlock(&ctl_mutex);
 }
 
-static int pkt_ctl_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
+static long pkt_ctl_ioctl(struct file *file, unsigned int cmd,
+                                                unsigned long arg)
 {
         void __user *argp = (void __user *)arg;
         struct pkt_ctrl_command ctrl_cmd;
@@ -3031,16 +3039,22 @@ static int pkt_ctl_ioctl(struct inode *inode, struct file *file, unsigned int cm
         case PKT_CTRL_CMD_SETUP:
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
+                lock_kernel();
                 ret = pkt_setup_dev(new_decode_dev(ctrl_cmd.dev), &pkt_dev);
                 ctrl_cmd.pkt_dev = new_encode_dev(pkt_dev);
+                unlock_kernel();
                 break;
         case PKT_CTRL_CMD_TEARDOWN:
                 if (!capable(CAP_SYS_ADMIN))
                         return -EPERM;
+                lock_kernel();
                 ret = pkt_remove_dev(new_decode_dev(ctrl_cmd.pkt_dev));
+                unlock_kernel();
                 break;
         case PKT_CTRL_CMD_STATUS:
+                lock_kernel();
                 pkt_get_status(&ctrl_cmd);
+                unlock_kernel();
                 break;
         default:
                 return -ENOTTY;
@@ -3053,7 +3067,7 @@ static int pkt_ctl_ioctl(struct inode *inode, struct file *file, unsigned int cm
 
 
 static const struct file_operations pkt_ctl_fops = {
-        .ioctl   = pkt_ctl_ioctl,
+        .unlocked_ioctl  = pkt_ctl_ioctl,
         .owner   = THIS_MODULE,
 };
 
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index f2fff5799ddf..9ae05c584234 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -38,6 +38,7 @@
 #include <linux/interrupt.h>
 #include <linux/blkdev.h>
 #include <linux/hdreg.h>
+#include <linux/cdrom.h>
 #include <linux/module.h>
 
 #include <xen/xenbus.h>
@@ -153,6 +154,40 @@ static int blkif_getgeo(struct block_device *bd, struct hd_geometry *hg)
         return 0;
 }
 
+int blkif_ioctl(struct inode *inode, struct file *filep,
+                unsigned command, unsigned long argument)
+{
+        struct blkfront_info *info =
+                inode->i_bdev->bd_disk->private_data;
+        int i;
+
+        dev_dbg(&info->xbdev->dev, "command: 0x%x, argument: 0x%lx\n",
+                command, (long)argument);
+
+        switch (command) {
+        case CDROMMULTISESSION:
+                dev_dbg(&info->xbdev->dev, "FIXME: support multisession CDs later\n");
+                for (i = 0; i < sizeof(struct cdrom_multisession); i++)
+                        if (put_user(0, (char __user *)(argument + i)))
+                                return -EFAULT;
+                return 0;
+
+        case CDROM_GET_CAPABILITY: {
+                struct gendisk *gd = info->gd;
+                if (gd->flags & GENHD_FL_CD)
+                        return 0;
+                return -EINVAL;
+        }
+
+        default:
+                /*printk(KERN_ALERT "ioctl %08x not supported by Xen blkdev\n",
+                  command);*/
+                return -EINVAL; /* same return as native Linux */
+        }
+
+        return 0;
+}
+
 /*
  * blkif_queue_request
  *
@@ -324,6 +359,9 @@ static int xlvbd_init_blk_queue(struct gendisk *gd, u16 sector_size)
         /* Make sure buffer addresses are sector-aligned. */
         blk_queue_dma_alignment(rq, 511);
 
+        /* Make sure we don't use bounce buffers. */
+        blk_queue_bounce_limit(rq, BLK_BOUNCE_ANY);
+
         gd->queue = rq;
 
         return 0;
@@ -546,7 +584,7 @@ static int setup_blkring(struct xenbus_device *dev,
 
         info->ring_ref = GRANT_INVALID_REF;
 
-        sring = (struct blkif_sring *)__get_free_page(GFP_KERNEL);
+        sring = (struct blkif_sring *)__get_free_page(GFP_NOIO | __GFP_HIGH);
         if (!sring) {
                 xenbus_dev_fatal(dev, -ENOMEM, "allocating shared ring");
                 return -ENOMEM;
@@ -703,7 +741,8 @@ static int blkif_recover(struct blkfront_info *info)
         int j;
 
         /* Stage 1: Make a safe copy of the shadow state. */
-        copy = kmalloc(sizeof(info->shadow), GFP_KERNEL);
+        copy = kmalloc(sizeof(info->shadow),
+                       GFP_NOIO | __GFP_REPEAT | __GFP_HIGH);
         if (!copy)
                 return -ENOMEM;
         memcpy(copy, info->shadow, sizeof(info->shadow));
@@ -959,7 +998,7 @@ static int blkif_release(struct inode *inode, struct file *filep)
                 struct xenbus_device *dev = info->xbdev;
                 enum xenbus_state state = xenbus_read_driver_state(dev->otherend);
 
-                if (state == XenbusStateClosing)
+                if (state == XenbusStateClosing && info->is_ready)
                         blkfront_closing(dev);
         }
         return 0;
@@ -971,6 +1010,7 @@ static struct block_device_operations xlvbd_block_fops =
         .open = blkif_open,
         .release = blkif_release,
         .getgeo = blkif_getgeo,
+        .ioctl = blkif_ioctl,
 };
 
 
@@ -1006,7 +1046,7 @@ static int __init xlblk_init(void)
 module_init(xlblk_init);
 
 
-static void xlblk_exit(void)
+static void __exit xlblk_exit(void)
 {
         return xenbus_unregister_driver(&blkfront);
 }
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 69f26eb6415b..a5da35632651 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -461,37 +461,27 @@ int cdrom_get_media_event(struct cdrom_device_info *cdi,
                           struct media_event_desc *med)
 {
         struct packet_command cgc;
-        unsigned char *buffer;
-        struct event_header *eh;
-        int ret = 1;
-
-        buffer = kmalloc(8, GFP_KERNEL);
-        if (!buffer)
-                return -ENOMEM;
+        unsigned char buffer[8];
+        struct event_header *eh = (struct event_header *) buffer;
 
-        eh = (struct event_header *)buffer;
-
-        init_cdrom_command(&cgc, buffer, 8, CGC_DATA_READ);
+        init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_READ);
         cgc.cmd[0] = GPCMD_GET_EVENT_STATUS_NOTIFICATION;
         cgc.cmd[1] = 1;         /* IMMED */
         cgc.cmd[4] = 1 << 4;    /* media event */
-        cgc.cmd[8] = 8;
+        cgc.cmd[8] = sizeof(buffer);
         cgc.quiet = 1;
 
         if (cdi->ops->generic_packet(cdi, &cgc))
-                goto err;
+                return 1;
 
         if (be16_to_cpu(eh->data_len) < sizeof(*med))
-                goto err;
+                return 1;
 
         if (eh->nea || eh->notification_class != 0x4)
-                goto err;
+                return 1;
 
-        memcpy(med, buffer + sizeof(*eh), sizeof(*med));
-        ret = 0;
-err:
-        kfree(buffer);
-        return ret;
+        memcpy(med, &buffer[sizeof(*eh)], sizeof(*med));
+        return 0;
 }
 
 /*
@@ -501,82 +491,68 @@ err:
 static int cdrom_mrw_probe_pc(struct cdrom_device_info *cdi)
 {
         struct packet_command cgc;
-        char *buffer;
-        int ret = 1;
-
-        buffer = kmalloc(16, GFP_KERNEL);
-        if (!buffer)
-                return -ENOMEM;
+        char buffer[16];
 
-        init_cdrom_command(&cgc, buffer, 16, CGC_DATA_READ);
+        init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_READ);
 
         cgc.timeout = HZ;
         cgc.quiet = 1;
 
         if (!cdrom_mode_sense(cdi, &cgc, MRW_MODE_PC, 0)) {
                 cdi->mrw_mode_page = MRW_MODE_PC;
-                ret = 0;
+                return 0;
         } else if (!cdrom_mode_sense(cdi, &cgc, MRW_MODE_PC_PRE1, 0)) {
                 cdi->mrw_mode_page = MRW_MODE_PC_PRE1;
-                ret = 0;
+                return 0;
         }
-        kfree(buffer);
-        return ret;
+
+        return 1;
 }
 
 static int cdrom_is_mrw(struct cdrom_device_info *cdi, int *write)
 {
         struct packet_command cgc;
         struct mrw_feature_desc *mfd;
-        unsigned char *buffer;
+        unsigned char buffer[16];
         int ret;
 
         *write = 0;
-        buffer = kmalloc(16, GFP_KERNEL);
-        if (!buffer)
-                return -ENOMEM;
 
-        init_cdrom_command(&cgc, buffer, 16, CGC_DATA_READ);
+        init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_READ);
 
         cgc.cmd[0] = GPCMD_GET_CONFIGURATION;
         cgc.cmd[3] = CDF_MRW;
-        cgc.cmd[8] = 16;
+        cgc.cmd[8] = sizeof(buffer);
         cgc.quiet = 1;
 
         if ((ret = cdi->ops->generic_packet(cdi, &cgc)))
-                goto err;
+                return ret;
 
         mfd = (struct mrw_feature_desc *)&buffer[sizeof(struct feature_header)];
-        if (be16_to_cpu(mfd->feature_code) != CDF_MRW) {
-                ret = 1;
-                goto err;
-        }
+        if (be16_to_cpu(mfd->feature_code) != CDF_MRW)
+                return 1;
         *write = mfd->write;
 
         if ((ret = cdrom_mrw_probe_pc(cdi))) {
                 *write = 0;
+                return ret;
         }
-err:
-        kfree(buffer);
-        return ret;
+
+        return 0;
 }
 
 static int cdrom_mrw_bgformat(struct cdrom_device_info *cdi, int cont)
 {
         struct packet_command cgc;
-        unsigned char *buffer;
+        unsigned char buffer[12];
         int ret;
 
         printk(KERN_INFO "cdrom: %sstarting format\n", cont ? "Re" : "");
 
-        buffer = kmalloc(12, GFP_KERNEL);
-        if (!buffer)
-                return -ENOMEM;
-
         /*
          * FmtData bit set (bit 4), format type is 1
          */
-        init_cdrom_command(&cgc, buffer, 12, CGC_DATA_WRITE);
+        init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_WRITE);
         cgc.cmd[0] = GPCMD_FORMAT_UNIT;
         cgc.cmd[1] = (1 << 4) | 1;
 
@@ -603,7 +579,6 @@ static int cdrom_mrw_bgformat(struct cdrom_device_info *cdi, int cont)
         if (ret)
                 printk(KERN_INFO "cdrom: bgformat failed\n");
 
-        kfree(buffer);
         return ret;
 }
 
@@ -663,17 +638,16 @@ static int cdrom_mrw_set_lba_space(struct cdrom_device_info *cdi, int space)
 {
         struct packet_command cgc;
         struct mode_page_header *mph;
-        char *buffer;
+        char buffer[16];
         int ret, offset, size;
 
-        buffer = kmalloc(16, GFP_KERNEL);
-        if (!buffer)
-                return -ENOMEM;
+        init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_READ);
 
-        init_cdrom_command(&cgc, buffer, 16, CGC_DATA_READ);
+        cgc.buffer = buffer;
+        cgc.buflen = sizeof(buffer);
 
         if ((ret = cdrom_mode_sense(cdi, &cgc, cdi->mrw_mode_page, 0)))
-                goto err;
+                return ret;
 
         mph = (struct mode_page_header *) buffer;
         offset = be16_to_cpu(mph->desc_length);
@@ -683,70 +657,55 @@ static int cdrom_mrw_set_lba_space(struct cdrom_device_info *cdi, int space)
         cgc.buflen = size;
 
         if ((ret = cdrom_mode_select(cdi, &cgc)))
-                goto err;
+                return ret;
 
         printk(KERN_INFO "cdrom: %s: mrw address space %s selected\n", cdi->name, mrw_address_space[space]);
-        ret = 0;
-err:
-        kfree(buffer);
-        return ret;
+        return 0;
 }
 
 static int cdrom_get_random_writable(struct cdrom_device_info *cdi,
                               struct rwrt_feature_desc *rfd)
 {
         struct packet_command cgc;
-        char *buffer;
+        char buffer[24];
         int ret;
 
-        buffer = kmalloc(24, GFP_KERNEL);
-        if (!buffer)
-                return -ENOMEM;
-
-        init_cdrom_command(&cgc, buffer, 24, CGC_DATA_READ);
+        init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_READ);
 
         cgc.cmd[0] = GPCMD_GET_CONFIGURATION;   /* often 0x46 */
         cgc.cmd[3] = CDF_RWRT;                  /* often 0x0020 */
-        cgc.cmd[8] = 24;                        /* often 0x18 */
+        cgc.cmd[8] = sizeof(buffer);            /* often 0x18 */
         cgc.quiet = 1;
 
         if ((ret = cdi->ops->generic_packet(cdi, &cgc)))
-                goto err;
+                return ret;
 
         memcpy(rfd, &buffer[sizeof(struct feature_header)], sizeof (*rfd));
-        ret = 0;
-err:
-        kfree(buffer);
-        return ret;
+        return 0;
 }
 
 static int cdrom_has_defect_mgt(struct cdrom_device_info *cdi)
 {
         struct packet_command cgc;
-        char *buffer;
+        char buffer[16];
         __be16 *feature_code;
         int ret;
 
-        buffer = kmalloc(16, GFP_KERNEL);
-        if (!buffer)
-                return -ENOMEM;
-
-        init_cdrom_command(&cgc, buffer, 16, CGC_DATA_READ);
+        init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_READ);
 
         cgc.cmd[0] = GPCMD_GET_CONFIGURATION;
         cgc.cmd[3] = CDF_HWDM;
-        cgc.cmd[8] = 16;
+        cgc.cmd[8] = sizeof(buffer);
         cgc.quiet = 1;
 
         if ((ret = cdi->ops->generic_packet(cdi, &cgc)))
-                goto err;
+                return ret;
 
         feature_code = (__be16 *) &buffer[sizeof(struct feature_header)];
         if (be16_to_cpu(*feature_code) == CDF_HWDM)
-                ret = 0;
-err:
-        kfree(buffer);
-        return ret;
+                return 0;
+
+        return 1;
 }
 
 
@@ -837,14 +796,10 @@ static int cdrom_mrw_open_write(struct cdrom_device_info *cdi)
 static int mo_open_write(struct cdrom_device_info *cdi)
 {
         struct packet_command cgc;
-        char *buffer;
+        char buffer[255];
         int ret;
 
-        buffer = kmalloc(255, GFP_KERNEL);
-        if (!buffer)
-                return -ENOMEM;
-
-        init_cdrom_command(&cgc, buffer, 4, CGC_DATA_READ);
+        init_cdrom_command(&cgc, &buffer, 4, CGC_DATA_READ);
         cgc.quiet = 1;
 
         /*
@@ -861,15 +816,10 @@ static int mo_open_write(struct cdrom_device_info *cdi)
         }
 
         /* drive gave us no info, let the user go ahead */
-        if (ret) {
-                ret = 0;
-                goto err;
-        }
+        if (ret)
+                return 0;
 
-        ret = buffer[3] & 0x80;
-err:
-        kfree(buffer);
-        return ret;
+        return buffer[3] & 0x80;
 }
 
 static int cdrom_ram_open_write(struct cdrom_device_info *cdi)
@@ -892,19 +842,15 @@ static int cdrom_ram_open_write(struct cdrom_device_info *cdi)
 static void cdrom_mmc3_profile(struct cdrom_device_info *cdi)
 {
         struct packet_command cgc;
-        char *buffer;
+        char buffer[32];
         int ret, mmc3_profile;
 
-        buffer = kmalloc(32, GFP_KERNEL);
-        if (!buffer)
-                return;
-
-        init_cdrom_command(&cgc, buffer, 32, CGC_DATA_READ);
+        init_cdrom_command(&cgc, buffer, sizeof(buffer), CGC_DATA_READ);
 
         cgc.cmd[0] = GPCMD_GET_CONFIGURATION;
         cgc.cmd[1] = 0;
         cgc.cmd[2] = cgc.cmd[3] = 0;            /* Starting Feature Number */
-        cgc.cmd[8] = 32;                        /* Allocation Length */
+        cgc.cmd[8] = sizeof(buffer);            /* Allocation Length */
         cgc.quiet = 1;
 
         if ((ret = cdi->ops->generic_packet(cdi, &cgc)))
@@ -913,7 +859,6 @@ static void cdrom_mmc3_profile(struct cdrom_device_info *cdi)
                 mmc3_profile = (buffer[6] << 8) | buffer[7];
 
         cdi->mmc3_profile = mmc3_profile;
-        kfree(buffer);
 }
 
 static int cdrom_is_dvd_rw(struct cdrom_device_info *cdi)
@@ -1628,15 +1573,12 @@ static void setup_send_key(struct packet_command *cgc, unsigned agid, unsigned t
 static int dvd_do_auth(struct cdrom_device_info *cdi, dvd_authinfo *ai)
 {
         int ret;
-        u_char *buf;
+        u_char buf[20];
         struct packet_command cgc;
         struct cdrom_device_ops *cdo = cdi->ops;
-        rpc_state_t *rpc_state;
-
-        buf = kzalloc(20, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
+        rpc_state_t rpc_state;
 
+        memset(buf, 0, sizeof(buf));
         init_cdrom_command(&cgc, buf, 0, CGC_DATA_READ);
 
         switch (ai->type) {
@@ -1647,7 +1589,7 @@ static int dvd_do_auth(struct cdrom_device_info *cdi, dvd_authinfo *ai)
                 setup_report_key(&cgc, ai->lsa.agid, 0);
 
                 if ((ret = cdo->generic_packet(cdi, &cgc)))
-                        goto err;
+                        return ret;
 
                 ai->lsa.agid = buf[7] >> 6;
                 /* Returning data, let host change state */
@@ -1658,7 +1600,7 @@ static int dvd_do_auth(struct cdrom_device_info *cdi, dvd_authinfo *ai)
                 setup_report_key(&cgc, ai->lsk.agid, 2);
 
                 if ((ret = cdo->generic_packet(cdi, &cgc)))
-                        goto err;
+                        return ret;
 
                 copy_key(ai->lsk.key, &buf[4]);
                 /* Returning data, let host change state */
@@ -1669,7 +1611,7 @@ static int dvd_do_auth(struct cdrom_device_info *cdi, dvd_authinfo *ai)
                 setup_report_key(&cgc, ai->lsc.agid, 1);
 
                 if ((ret = cdo->generic_packet(cdi, &cgc)))
-                        goto err;
+                        return ret;
 
                 copy_chal(ai->lsc.chal, &buf[4]);
                 /* Returning data, let host change state */
@@ -1686,7 +1628,7 @@ static int dvd_do_auth(struct cdrom_device_info *cdi, dvd_authinfo *ai)
                 cgc.cmd[2] = ai->lstk.lba >> 24;
 
                 if ((ret = cdo->generic_packet(cdi, &cgc)))
-                        goto err;
+                        return ret;
 
                 ai->lstk.cpm = (buf[4] >> 7) & 1;
                 ai->lstk.cp_sec = (buf[4] >> 6) & 1;
@@ -1700,7 +1642,7 @@ static int dvd_do_auth(struct cdrom_device_info *cdi, dvd_authinfo *ai)
                 setup_report_key(&cgc, ai->lsasf.agid, 5);
                 
                 if ((ret = cdo->generic_packet(cdi, &cgc)))
-                        goto err;
+                        return ret;
 
                 ai->lsasf.asf = buf[7] & 1;
                 break;
@@ -1713,7 +1655,7 @@ static int dvd_do_auth(struct cdrom_device_info *cdi, dvd_authinfo *ai)
                 copy_chal(&buf[4], ai->hsc.chal);
 
                 if ((ret = cdo->generic_packet(cdi, &cgc)))
-                        goto err;
+                        return ret;
 
                 ai->type = DVD_LU_SEND_KEY1;
                 break;
@@ -1726,7 +1668,7 @@ static int dvd_do_auth(struct cdrom_device_info *cdi, dvd_authinfo *ai)
 
                 if ((ret = cdo->generic_packet(cdi, &cgc))) {
                         ai->type = DVD_AUTH_FAILURE;
-                        goto err;
+                        return ret;
                 }
                 ai->type = DVD_AUTH_ESTABLISHED;
                 break;
@@ -1737,23 +1679,24 @@ static int dvd_do_auth(struct cdrom_device_info *cdi, dvd_authinfo *ai)
                 cdinfo(CD_DVD, "entering DVD_INVALIDATE_AGID\n"); 
                 setup_report_key(&cgc, ai->lsa.agid, 0x3f);
                 if ((ret = cdo->generic_packet(cdi, &cgc)))
-                        goto err;
+                        return ret;
                 break;
 
         /* Get region settings */
         case DVD_LU_SEND_RPC_STATE:
                 cdinfo(CD_DVD, "entering DVD_LU_SEND_RPC_STATE\n");
                 setup_report_key(&cgc, 0, 8);
+                memset(&rpc_state, 0, sizeof(rpc_state_t));
+                cgc.buffer = (char *) &rpc_state;
 
                 if ((ret = cdo->generic_packet(cdi, &cgc)))
-                        goto err;
+                        return ret;
 
-                rpc_state = (rpc_state_t *)buf;
-                ai->lrpcs.type = rpc_state->type_code;
-                ai->lrpcs.vra = rpc_state->vra;
-                ai->lrpcs.ucca = rpc_state->ucca;
-                ai->lrpcs.region_mask = rpc_state->region_mask;
-                ai->lrpcs.rpc_scheme = rpc_state->rpc_scheme;
+                ai->lrpcs.type = rpc_state.type_code;
+                ai->lrpcs.vra = rpc_state.vra;
+                ai->lrpcs.ucca = rpc_state.ucca;
+                ai->lrpcs.region_mask = rpc_state.region_mask;
+                ai->lrpcs.rpc_scheme = rpc_state.rpc_scheme;
                 break;
 
         /* Set region settings */
@@ -1764,23 +1707,20 @@ static int dvd_do_auth(struct cdrom_device_info *cdi, dvd_authinfo *ai)
                 buf[4] = ai->hrpcs.pdrc;
 
                 if ((ret = cdo->generic_packet(cdi, &cgc)))
-                        goto err;
+                        return ret;
                 break;
 
         default:
                 cdinfo(CD_WARNING, "Invalid DVD key ioctl (%d)\n", ai->type);
-                ret = -ENOTTY;
-                goto err;
+                return -ENOTTY;
         }
-        ret = 0;
-err:
-        kfree(buf);
-        return ret;
+
+        return 0;
 }
 
 static int dvd_read_physical(struct cdrom_device_info *cdi, dvd_struct *s)
 {
-        unsigned char *buf, *base;
+        unsigned char buf[21], *base;
         struct dvd_layer *layer;
         struct packet_command cgc;
         struct cdrom_device_ops *cdo = cdi->ops;
@@ -1789,11 +1729,7 @@ static int dvd_read_physical(struct cdrom_device_info *cdi, dvd_struct *s)
         if (layer_num >= DVD_LAYERS)
                 return -EINVAL;
 
-        buf = kmalloc(21, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
-        init_cdrom_command(&cgc, buf, 21, CGC_DATA_READ);
+        init_cdrom_command(&cgc, buf, sizeof(buf), CGC_DATA_READ);
         cgc.cmd[0] = GPCMD_READ_DVD_STRUCTURE;
         cgc.cmd[6] = layer_num;
         cgc.cmd[7] = s->type;
@@ -1805,7 +1741,7 @@ static int dvd_read_physical(struct cdrom_device_info *cdi, dvd_struct *s)
         cgc.quiet = 1;
 
         if ((ret = cdo->generic_packet(cdi, &cgc)))
-                goto err;
+                return ret;
 
         base = &buf[4];
         layer = &s->physical.layer[layer_num];
@@ -1829,24 +1765,17 @@ static int dvd_read_physical(struct cdrom_device_info *cdi, dvd_struct *s)
         layer->end_sector_l0 = base[13] << 16 | base[14] << 8 | base[15];
         layer->bca = base[16] >> 7;
 
-        ret = 0;
-err:
-        kfree(buf);
-        return ret;
+        return 0;
 }
 
 static int dvd_read_copyright(struct cdrom_device_info *cdi, dvd_struct *s)
 {
         int ret;
-        u_char *buf;
+        u_char buf[8];
         struct packet_command cgc;
         struct cdrom_device_ops *cdo = cdi->ops;
 
-        buf = kmalloc(8, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
-        init_cdrom_command(&cgc, buf, 8, CGC_DATA_READ);
+        init_cdrom_command(&cgc, buf, sizeof(buf), CGC_DATA_READ);
         cgc.cmd[0] = GPCMD_READ_DVD_STRUCTURE;
         cgc.cmd[6] = s->copyright.layer_num;
         cgc.cmd[7] = s->type;
@@ -1854,15 +1783,12 @@ static int dvd_read_copyright(struct cdrom_device_info *cdi, dvd_struct *s)
         cgc.cmd[9] = cgc.buflen & 0xff;
 
         if ((ret = cdo->generic_packet(cdi, &cgc)))
-                goto err;
+                return ret;
 
         s->copyright.cpst = buf[4];
         s->copyright.rmi = buf[5];
 
-        ret = 0;
-err:
-        kfree(buf);
-        return ret;
+        return 0;
 }
 
 static int dvd_read_disckey(struct cdrom_device_info *cdi, dvd_struct *s)
@@ -1894,33 +1820,26 @@ static int dvd_read_disckey(struct cdrom_device_info *cdi, dvd_struct *s)
 static int dvd_read_bca(struct cdrom_device_info *cdi, dvd_struct *s)
 {
         int ret;
-        u_char *buf;
+        u_char buf[4 + 188];
         struct packet_command cgc;
         struct cdrom_device_ops *cdo = cdi->ops;
 
-        buf = kmalloc(4 + 188, GFP_KERNEL);
-        if (!buf)
-                return -ENOMEM;
-
-        init_cdrom_command(&cgc, buf, 4 + 188, CGC_DATA_READ);
+        init_cdrom_command(&cgc, buf, sizeof(buf), CGC_DATA_READ);
         cgc.cmd[0] = GPCMD_READ_DVD_STRUCTURE;
         cgc.cmd[7] = s->type;
         cgc.cmd[9] = cgc.buflen & 0xff;
 
         if ((ret = cdo->generic_packet(cdi, &cgc)))
-                goto err;
+                return ret;
 
         s->bca.len = buf[0] << 8 | buf[1];
         if (s->bca.len < 12 || s->bca.len > 188) {
                 cdinfo(CD_WARNING, "Received invalid BCA length (%d)\n", s->bca.len);
-                ret = -EIO;
-                goto err;
+                return -EIO;
         }
         memcpy(s->bca.value, &buf[4], s->bca.len);
-        ret = 0;
-err:
-        kfree(buf);
-        return ret;
+
+        return 0;
 }
 
 static int dvd_read_manufact(struct cdrom_device_info *cdi, dvd_struct *s)
@@ -2020,13 +1939,9 @@ static int cdrom_read_subchannel(struct cdrom_device_info *cdi,
 {
         struct cdrom_device_ops *cdo = cdi->ops;
         struct packet_command cgc;
-        char *buffer;
+        char buffer[32];
         int ret;
 
-        buffer = kmalloc(32, GFP_KERNEL);
-        if (!buffer)
-                return -ENOMEM;
-
         init_cdrom_command(&cgc, buffer, 16, CGC_DATA_READ);
         cgc.cmd[0] = GPCMD_READ_SUBCHANNEL;
         cgc.cmd[1] = 2;     /* MSF addressing */
@@ -2035,7 +1950,7 @@ static int cdrom_read_subchannel(struct cdrom_device_info *cdi,
         cgc.cmd[8] = 16;
 
         if ((ret = cdo->generic_packet(cdi, &cgc)))
-                goto err;
+                return ret;
 
         subchnl->cdsc_audiostatus = cgc.buffer[1];
         subchnl->cdsc_format = CDROM_MSF;
@@ -2050,10 +1965,7 @@ static int cdrom_read_subchannel(struct cdrom_device_info *cdi,
         subchnl->cdsc_absaddr.msf.second = cgc.buffer[10];
         subchnl->cdsc_absaddr.msf.frame = cgc.buffer[11];
 
-        ret = 0;
-err:
-        kfree(buffer);
-        return ret;
+        return 0;
 }
 
 /*
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index 10748240cb2f..6a866d7c8ae5 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -50,17 +50,19 @@ static inline dev_info_t *which_dev(mddev_t *mddev, sector_t sector)
 /**
  *      linear_mergeable_bvec -- tell bio layer if two requests can be merged
  *      @q: request queue
- *      @bio: the buffer head that's been built up so far
+ *      @bvm: properties of new bio
  *      @biovec: the request that could be merged to it.
  *
  *      Return amount of bytes we can take at this offset
  */
-static int linear_mergeable_bvec(struct request_queue *q, struct bio *bio, struct bio_vec *biovec)
+static int linear_mergeable_bvec(struct request_queue *q,
+                                 struct bvec_merge_data *bvm,
+                                 struct bio_vec *biovec)
 {
         mddev_t *mddev = q->queuedata;
         dev_info_t *dev0;
-        unsigned long maxsectors, bio_sectors = bio->bi_size >> 9;
-        sector_t sector = bio->bi_sector + get_start_sect(bio->bi_bdev);
+        unsigned long maxsectors, bio_sectors = bvm->bi_size >> 9;
+        sector_t sector = bvm->bi_sector + get_start_sect(bvm->bi_bdev);
 
         dev0 = which_dev(mddev, sector);
         maxsectors = (dev0->size << 1) - (sector - (dev0->offset<<1));
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 914c04ddec7c..bcbb82594a19 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -241,18 +241,20 @@ static int create_strip_zones (mddev_t *mddev)
 /**
  *      raid0_mergeable_bvec -- tell bio layer if a two requests can be merged
  *      @q: request queue
- *      @bio: the buffer head that's been built up so far
+ *      @bvm: properties of new bio
  *      @biovec: the request that could be merged to it.
  *
  *      Return amount of bytes we can accept at this offset
  */
-static int raid0_mergeable_bvec(struct request_queue *q, struct bio *bio, struct bio_vec *biovec)
+static int raid0_mergeable_bvec(struct request_queue *q,
+                                struct bvec_merge_data *bvm,
+                                struct bio_vec *biovec)
 {
         mddev_t *mddev = q->queuedata;
-        sector_t sector = bio->bi_sector + get_start_sect(bio->bi_bdev);
+        sector_t sector = bvm->bi_sector + get_start_sect(bvm->bi_bdev);
         int max;
         unsigned int chunk_sectors = mddev->chunk_size >> 9;
-        unsigned int bio_sectors = bio->bi_size >> 9;
+        unsigned int bio_sectors = bvm->bi_size >> 9;
 
         max =  (chunk_sectors - ((sector & (chunk_sectors - 1)) + bio_sectors)) << 9;
         if (max < 0) max = 0; /* bio_add cannot handle a negative return */
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index a71277b640ab..22bb2b1b886d 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -439,26 +439,27 @@ static sector_t raid10_find_virt(conf_t *conf, sector_t sector, int dev)
 /**
  *      raid10_mergeable_bvec -- tell bio layer if a two requests can be merged
  *      @q: request queue
- *      @bio: the buffer head that's been built up so far
+ *      @bvm: properties of new bio
  *      @biovec: the request that could be merged to it.
  *
  *      Return amount of bytes we can accept at this offset
  *      If near_copies == raid_disk, there are no striping issues,
  *      but in that case, the function isn't called at all.
  */
-static int raid10_mergeable_bvec(struct request_queue *q, struct bio *bio,
-                                struct bio_vec *bio_vec)
+static int raid10_mergeable_bvec(struct request_queue *q,
+                                 struct bvec_merge_data *bvm,
+                                 struct bio_vec *biovec)
 {
         mddev_t *mddev = q->queuedata;
-        sector_t sector = bio->bi_sector + get_start_sect(bio->bi_bdev);
+        sector_t sector = bvm->bi_sector + get_start_sect(bvm->bi_bdev);
         int max;
         unsigned int chunk_sectors = mddev->chunk_size >> 9;
-        unsigned int bio_sectors = bio->bi_size >> 9;
+        unsigned int bio_sectors = bvm->bi_size >> 9;
 
         max =  (chunk_sectors - ((sector & (chunk_sectors - 1)) + bio_sectors)) << 9;
         if (max < 0) max = 0; /* bio_add cannot handle a negative return */
-        if (max <= bio_vec->bv_len && bio_sectors == 0)
-                return bio_vec->bv_len;
+        if (max <= biovec->bv_len && bio_sectors == 0)
+                return biovec->bv_len;
         else
                 return max;
 }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 3b27df52456b..9ce7154845c6 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3314,15 +3314,17 @@ static int raid5_congested(void *data, int bits)
 /* We want read requests to align with chunks where possible,
  * but write requests don't need to.
  */
-static int raid5_mergeable_bvec(struct request_queue *q, struct bio *bio, struct bio_vec *biovec)
+static int raid5_mergeable_bvec(struct request_queue *q,
+                                struct bvec_merge_data *bvm,
+                                struct bio_vec *biovec)
 {
         mddev_t *mddev = q->queuedata;
-        sector_t sector = bio->bi_sector + get_start_sect(bio->bi_bdev);
+        sector_t sector = bvm->bi_sector + get_start_sect(bvm->bi_bdev);
         int max;
         unsigned int chunk_sectors = mddev->chunk_size >> 9;
-        unsigned int bio_sectors = bio->bi_size >> 9;
+        unsigned int bio_sectors = bvm->bi_size >> 9;
 
-        if (bio_data_dir(bio) == WRITE)
+        if ((bvm->bi_rw & 1) == WRITE)
                 return biovec->bv_len; /* always allow writes to be mergeable */
 
         max =  (chunk_sectors - ((sector & (chunk_sectors - 1)) + bio_sectors)) << 9;
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index d26f69b0184f..ef671d1a3bf0 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -1324,7 +1324,7 @@ static int setup_netfront(struct xenbus_device *dev, struct netfront_info *info)
                 goto fail;
         }
 
-        txs = (struct xen_netif_tx_sring *)get_zeroed_page(GFP_KERNEL);
+        txs = (struct xen_netif_tx_sring *)get_zeroed_page(GFP_NOIO | __GFP_HIGH);
         if (!txs) {
                 err = -ENOMEM;
                 xenbus_dev_fatal(dev, err, "allocating tx ring page");
@@ -1340,7 +1340,7 @@ static int setup_netfront(struct xenbus_device *dev, struct netfront_info *info)
         }
 
         info->tx_ring_ref = err;
-        rxs = (struct xen_netif_rx_sring *)get_zeroed_page(GFP_KERNEL);
+        rxs = (struct xen_netif_rx_sring *)get_zeroed_page(GFP_NOIO | __GFP_HIGH);
         if (!rxs) {
                 err = -ENOMEM;
                 xenbus_dev_fatal(dev, err, "allocating rx ring page");
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index ea0edd1b2e76..fe694f0ee19a 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -182,8 +182,9 @@ static int sg_build_sgat(Sg_scatter_hold * schp, const Sg_fd * sfp,
                          int tablesize);
 static ssize_t sg_new_read(Sg_fd * sfp, char __user *buf, size_t count,
                            Sg_request * srp);
-static ssize_t sg_new_write(Sg_fd * sfp, const char __user *buf, size_t count,
-                            int blocking, int read_only, Sg_request ** o_srp);
+static ssize_t sg_new_write(Sg_fd *sfp, struct file *file,
+                        const char __user *buf, size_t count, int blocking,
+                        int read_only, Sg_request **o_srp);
 static int sg_common_write(Sg_fd * sfp, Sg_request * srp,
                            unsigned char *cmnd, int timeout, int blocking);
 static int sg_u_iovec(sg_io_hdr_t * hp, int sg_num, int ind,
@@ -204,7 +205,6 @@ static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id);
 static Sg_request *sg_add_request(Sg_fd * sfp);
 static int sg_remove_request(Sg_fd * sfp, Sg_request * srp);
 static int sg_res_in_use(Sg_fd * sfp);
-static int sg_allow_access(unsigned char opcode, char dev_type);
 static int sg_build_direct(Sg_request * srp, Sg_fd * sfp, int dxfer_len);
 static Sg_device *sg_get_dev(int dev);
 #ifdef CONFIG_SCSI_PROC_FS
@@ -544,7 +544,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
                 return -EFAULT;
         blocking = !(filp->f_flags & O_NONBLOCK);
         if (old_hdr.reply_len < 0)
-                return sg_new_write(sfp, buf, count, blocking, 0, NULL);
+                return sg_new_write(sfp, filp, buf, count, blocking, 0, NULL);
         if (count < (SZ_SG_HEADER + 6))
                 return -EIO;    /* The minimum scsi command length is 6 bytes. */
 
@@ -621,8 +621,9 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos)
 }
 
 static ssize_t
-sg_new_write(Sg_fd * sfp, const char __user *buf, size_t count,
-             int blocking, int read_only, Sg_request ** o_srp)
+sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf,
+                 size_t count, int blocking, int read_only,
+                 Sg_request **o_srp)
 {
         int k;
         Sg_request *srp;
@@ -678,8 +679,7 @@ sg_new_write(Sg_fd * sfp, const char __user *buf, size_t count,
                 sg_remove_request(sfp, srp);
                 return -EFAULT;
         }
-        if (read_only &&
-            (!sg_allow_access(cmnd[0], sfp->parentdp->device->type))) {
+        if (read_only && !blk_verify_command(file, cmnd)) {
                 sg_remove_request(sfp, srp);
                 return -EPERM;
         }
@@ -799,7 +799,7 @@ sg_ioctl(struct inode *inode, struct file *filp,
                         if (!access_ok(VERIFY_WRITE, p, SZ_SG_IO_HDR))
                                 return -EFAULT;
                         result =
-                            sg_new_write(sfp, p, SZ_SG_IO_HDR,
+                            sg_new_write(sfp, filp, p, SZ_SG_IO_HDR,
                                          blocking, read_only, &srp);
                         if (result < 0)
                                 return result;
@@ -1048,7 +1048,7 @@ sg_ioctl(struct inode *inode, struct file *filp,
 
                         if (copy_from_user(&opcode, siocp->data, 1))
                                 return -EFAULT;
-                        if (!sg_allow_access(opcode, sdp->device->type))
+                        if (!blk_verify_command(filp, &opcode))
                                 return -EPERM;
                 }
                 return sg_scsi_ioctl(filp, sdp->device->request_queue, NULL, p);
@@ -2502,30 +2502,6 @@ sg_page_free(struct page *page, int size)
         __free_pages(page, order);
 }
 
-#ifndef MAINTENANCE_IN_CMD
-#define MAINTENANCE_IN_CMD 0xa3
-#endif
-
-static unsigned char allow_ops[] = { TEST_UNIT_READY, REQUEST_SENSE,
-        INQUIRY, READ_CAPACITY, READ_BUFFER, READ_6, READ_10, READ_12,
-        READ_16, MODE_SENSE, MODE_SENSE_10, LOG_SENSE, REPORT_LUNS,
-        SERVICE_ACTION_IN, RECEIVE_DIAGNOSTIC, READ_LONG, MAINTENANCE_IN_CMD
-};
-
-static int
-sg_allow_access(unsigned char opcode, char dev_type)
-{
-        int k;
-
-        if (TYPE_SCANNER == dev_type)   /* TYPE_ROM maybe burner */
-                return 1;
-        for (k = 0; k < sizeof (allow_ops); ++k) {
-                if (opcode == allow_ops[k])
-                        return 1;
-        }
-        return 0;
-}
-
 #ifdef CONFIG_SCSI_PROC_FS
 static int
 sg_idr_max_id(int id, void *p, void *data)
diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c
index c82df8bd4d89..27f5bfd1def3 100644
--- a/drivers/scsi/sr.c
+++ b/drivers/scsi/sr.c
@@ -673,24 +673,20 @@ fail:
 static void get_sectorsize(struct scsi_cd *cd)
 {
         unsigned char cmd[10];
-        unsigned char *buffer;
+        unsigned char buffer[8];
         int the_result, retries = 3;
         int sector_size;
         struct request_queue *queue;
 
-        buffer = kmalloc(512, GFP_KERNEL | GFP_DMA);
-        if (!buffer)
-                goto Enomem;
-
         do {
                 cmd[0] = READ_CAPACITY;
                 memset((void *) &cmd[1], 0, 9);
-                memset(buffer, 0, 8);
+                memset(buffer, 0, sizeof(buffer));
 
                 /* Do the command and wait.. */
                 the_result = scsi_execute_req(cd->device, cmd, DMA_FROM_DEVICE,
-                                              buffer, 8, NULL, SR_TIMEOUT,
-                                              MAX_RETRIES);
+                                              buffer, sizeof(buffer), NULL,
+                                              SR_TIMEOUT, MAX_RETRIES);
 
                 retries--;
 
@@ -745,14 +741,8 @@ static void get_sectorsize(struct scsi_cd *cd)
 
         queue = cd->device->request_queue;
         blk_queue_hardsect_size(queue, sector_size);
-out:
-        kfree(buffer);
-        return;
 
-Enomem:
-        cd->capacity = 0x1fffff;
-        cd->device->sector_size = 2048; /* A guess, just in case */
-        goto out;
+        return;
 }
 
 static void get_capabilities(struct scsi_cd *cd)
diff --git a/drivers/xen/xenbus/xenbus_client.c b/drivers/xen/xenbus/xenbus_client.c
index 0f86b0ff7879..9678b3e98c63 100644
--- a/drivers/xen/xenbus/xenbus_client.c
+++ b/drivers/xen/xenbus/xenbus_client.c
@@ -117,7 +117,7 @@ int xenbus_watch_pathfmt(struct xenbus_device *dev,
         char *path;
 
         va_start(ap, pathfmt);
-        path = kvasprintf(GFP_KERNEL, pathfmt, ap);
+        path = kvasprintf(GFP_NOIO | __GFP_HIGH, pathfmt, ap);
         va_end(ap);
 
         if (!path) {
diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index 227d53b12a5c..7f2f91c0e11d 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -283,9 +283,9 @@ static char *join(const char *dir, const char *name)
         char *buffer;
 
         if (strlen(name) == 0)
-                buffer = kasprintf(GFP_KERNEL, "%s", dir);
+                buffer = kasprintf(GFP_NOIO | __GFP_HIGH, "%s", dir);
         else
-                buffer = kasprintf(GFP_KERNEL, "%s/%s", dir, name);
+                buffer = kasprintf(GFP_NOIO | __GFP_HIGH, "%s/%s", dir, name);
         return (!buffer) ? ERR_PTR(-ENOMEM) : buffer;
 }
 
@@ -297,7 +297,7 @@ static char **split(char *strings, unsigned int len, unsigned int *num)
         *num = count_strings(strings, len);
 
         /* Transfer to one big alloc for easy freeing. */
-        ret = kmalloc(*num * sizeof(char *) + len, GFP_KERNEL);
+        ret = kmalloc(*num * sizeof(char *) + len, GFP_NOIO | __GFP_HIGH);
         if (!ret) {
                 kfree(strings);
                 return ERR_PTR(-ENOMEM);
@@ -751,7 +751,7 @@ static int process_msg(void)
         }
 
 
-        msg = kmalloc(sizeof(*msg), GFP_KERNEL);
+        msg = kmalloc(sizeof(*msg), GFP_NOIO | __GFP_HIGH);
         if (msg == NULL) {
                 err = -ENOMEM;
                 goto out;
@@ -763,7 +763,7 @@ static int process_msg(void)
                 goto out;
         }
 
-        body = kmalloc(msg->hdr.len + 1, GFP_KERNEL);
+        body = kmalloc(msg->hdr.len + 1, GFP_NOIO | __GFP_HIGH);
         if (body == NULL) {
                 kfree(msg);
                 err = -ENOMEM;