21 files changed, 312 insertions, 188 deletions

diff --git a/Documentation/hw_random.txt b/Documentation/hw_random.txt
index bb58c36b5845..690f52550c80 100644
--- a/Documentation/hw_random.txt
+++ b/Documentation/hw_random.txt
@@ -1,33 +1,26 @@
-        Hardware driver for Intel/AMD/VIA Random Number Generators (RNG)
-        Copyright 2000,2001 Jeff Garzik <jgarzik@pobox.com>
-        Copyright 2000,2001 Philipp Rumpf <prumpf@mandrakesoft.com>
-
 Introduction:
 
-        The hw_random device driver is software that makes use of a
+        The hw_random framework is software that makes use of a
         special hardware feature on your CPU or motherboard,
-        a Random Number Generator (RNG).
+        a Random Number Generator (RNG).  The software has two parts:
+        a core providing the /dev/hw_random character device and its
+        sysfs support, plus a hardware-specific driver that plugs
+        into that core.
 
-        In order to make effective use of this device driver, you
+        To make the most effective use of these mechanisms, you
         should download the support software as well.  Download the
         latest version of the "rng-tools" package from the
         hw_random driver's official Web site:
 
                 http://sourceforge.net/projects/gkernel/
 
-About the Intel RNG hardware, from the firmware hub datasheet:
-
-        The Firmware Hub integrates a Random Number Generator (RNG)
-        using thermal noise generated from inherently random quantum
-        mechanical properties of silicon. When not generating new random
-        bits the RNG circuitry will enter a low power state. Intel will
-        provide a binary software driver to give third party software
-        access to our RNG for use as a security feature. At this time,
-        the RNG is only to be used with a system in an OS-present state.
+        Those tools use /dev/hw_random to fill the kernel entropy pool,
+        which is used internally and exported by the /dev/urandom and
+        /dev/random special files.
 
 Theory of operation:
 
-        Character driver.  Using the standard open()
+        CHARACTER DEVICE.  Using the standard open()
         and read() system calls, you can read random data from
         the hardware RNG device.  This data is NOT CHECKED by any
         fitness tests, and could potentially be bogus (if the
@@ -36,9 +29,37 @@ Theory of operation:
         a security-conscious person would run fitness tests on the
         data before assuming it is truly random.
 
-        /dev/hwrandom is char device major 10, minor 183.
+        The rng-tools package uses such tests in "rngd", and lets you
+        run them by hand with a "rngtest" utility.
+
+        /dev/hw_random is char device major 10, minor 183.
+
+        CLASS DEVICE.  There is a /sys/class/misc/hw_random node with
+        two unique attributes, "rng_available" and "rng_current".  The
+        "rng_available" attribute lists the hardware-specific drivers
+        available, while "rng_current" lists the one which is currently
+        connected to /dev/hw_random.  If your system has more than one
+        RNG available, you may change the one used by writing a name from
+        the list in "rng_available" into "rng_current".
+
+==========================================================================
+
+        Hardware driver for Intel/AMD/VIA Random Number Generators (RNG)
+        Copyright 2000,2001 Jeff Garzik <jgarzik@pobox.com>
+        Copyright 2000,2001 Philipp Rumpf <prumpf@mandrakesoft.com>
+
+
+About the Intel RNG hardware, from the firmware hub datasheet:
+
+        The Firmware Hub integrates a Random Number Generator (RNG)
+        using thermal noise generated from inherently random quantum
+        mechanical properties of silicon. When not generating new random
+        bits the RNG circuitry will enter a low power state. Intel will
+        provide a binary software driver to give third party software
+        access to our RNG for use as a security feature. At this time,
+        the RNG is only to be used with a system in an OS-present state.
 
-Driver notes:
+Intel RNG Driver notes:
 
         * FIXME: support poll(2)
 
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 650b0d8aa89b..508e2a2c9864 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -1130,6 +1130,10 @@ and is between 256 and 4096 characters. It is defined in the file
         memmap=nn[KMG]$ss[KMG]
                         [KNL,ACPI] Mark specific memory as reserved.
                         Region of memory to be used, from ss to ss+nn.
+                        Example: Exclude memory from 0x18690000-0x1869ffff
+                                 memmap=64K$0x18690000
+                                 or
+                                 memmap=0x10000$0x18690000
 
         meye.*=         [HW] Set MotionEye Camera parameters
                         See Documentation/video4linux/meye.txt.
diff --git a/Makefile b/Makefile
index 7a4d34b91e03..1c4c8f87f6c5 100644
--- a/Makefile
+++ b/Makefile
@@ -189,7 +189,7 @@ SUBARCH := $(shell uname -m | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ \
 # Alternatively CROSS_COMPILE can be set in the environment.
 # Default value for CROSS_COMPILE is not to prefix executables
 # Note: Some architectures assign CROSS_COMPILE in their arch/*/Makefile
-
+export KBUILD_BUILDHOST := $(SUBARCH)
 ARCH            ?= $(SUBARCH)
 CROSS_COMPILE   ?=
 
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 17ee6ed985d9..b1eb4e24c86a 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -433,6 +433,7 @@ static const struct ata_port_info ahci_port_info[] = {
         /* board_ahci_sb600 */
         {
                 AHCI_HFLAGS     (AHCI_HFLAG_IGN_SERR_INTERNAL |
+                                 AHCI_HFLAG_32BIT_ONLY |
                                  AHCI_HFLAG_SECT255 | AHCI_HFLAG_NO_PMP),
                 .flags          = AHCI_FLAG_COMMON,
                 .link_flags     = AHCI_LFLAG_COMMON,
@@ -1217,8 +1218,11 @@ static void ahci_dev_config(struct ata_device *dev)
 {
         struct ahci_host_priv *hpriv = dev->link->ap->host->private_data;
 
-        if (hpriv->flags & AHCI_HFLAG_SECT255)
+        if (hpriv->flags & AHCI_HFLAG_SECT255) {
                 dev->max_sectors = 255;
+                ata_dev_printk(dev, KERN_INFO,
+                               "SB600 AHCI: limiting to 255 sectors per cmd\n");
+        }
 }
 
 static unsigned int ahci_dev_classify(struct ata_port *ap)
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 4bbe31f98ef8..c4248b37ff64 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -1416,12 +1416,12 @@ static int ata_hpa_resize(struct ata_device *dev)
         /* read native max address */
         rc = ata_read_native_max_address(dev, &native_sectors);
         if (rc) {
-                /* If HPA isn't going to be unlocked, skip HPA
-                 * resizing from the next try.
+                /* If device aborted the command or HPA isn't going to
+                 * be unlocked, skip HPA resizing.
                  */
-                if (!ata_ignore_hpa) {
+                if (rc == -EACCES || !ata_ignore_hpa) {
                         ata_dev_printk(dev, KERN_WARNING, "HPA support seems "
-                                       "broken, will skip HPA handling\n");
+                                       "broken, skipping HPA handling\n");
                         dev->horkage |= ATA_HORKAGE_BROKEN_HPA;
 
                         /* we can continue if device aborted the command */
@@ -2092,24 +2092,34 @@ int ata_dev_read_id(struct ata_device *dev, unsigned int *p_class,
                                      id, sizeof(id[0]) * ATA_ID_WORDS, 0);
         if (err_mask) {
                 if (err_mask & AC_ERR_NODEV_HINT) {
-                        DPRINTK("ata%u.%d: NODEV after polling detection\n",
-                                ap->print_id, dev->devno);
+                        ata_dev_printk(dev, KERN_DEBUG,
+                                       "NODEV after polling detection\n");
                         return -ENOENT;
                 }
 
-                /* Device or controller might have reported the wrong
-                 * device class.  Give a shot at the other IDENTIFY if
-                 * the current one is aborted by the device.
-                 */
-                if (may_fallback &&
-                    (err_mask == AC_ERR_DEV) && (tf.feature & ATA_ABORTED)) {
-                        may_fallback = 0;
+                if ((err_mask == AC_ERR_DEV) && (tf.feature & ATA_ABORTED)) {
+                        /* Device or controller might have reported
+                         * the wrong device class.  Give a shot at the
+                         * other IDENTIFY if the current one is
+                         * aborted by the device.
+                         */
+                        if (may_fallback) {
+                                may_fallback = 0;
 
-                        if (class == ATA_DEV_ATA)
-                                class = ATA_DEV_ATAPI;
-                        else
-                                class = ATA_DEV_ATA;
-                        goto retry;
+                                if (class == ATA_DEV_ATA)
+                                        class = ATA_DEV_ATAPI;
+                                else
+                                        class = ATA_DEV_ATA;
+                                goto retry;
+                        }
+
+                        /* Control reaches here iff the device aborted
+                         * both flavors of IDENTIFYs which happens
+                         * sometimes with phantom devices.
+                         */
+                        ata_dev_printk(dev, KERN_DEBUG,
+                                       "both IDENTIFYs aborted, assuming NODEV\n");
+                        return -ENOENT;
                 }
 
                 rc = -EIO;
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 8f0e8f2bc628..15795394b0a8 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -527,6 +527,14 @@ static struct ata_queued_cmd *ata_scsi_qc_new(struct ata_device *dev,
         return qc;
 }
 
+static void ata_qc_set_pc_nbytes(struct ata_queued_cmd *qc)
+{
+        struct scsi_cmnd *scmd = qc->scsicmd;
+
+        qc->extrabytes = scmd->request->extra_len;
+        qc->nbytes = scsi_bufflen(scmd) + qc->extrabytes;
+}
+
 /**
  *      ata_dump_status - user friendly display of error info
  *      @id: id of the port in question
@@ -2539,7 +2547,7 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
         }
 
         qc->tf.command = ATA_CMD_PACKET;
-        qc->nbytes = scsi_bufflen(scmd) + scmd->request->extra_len;
+        ata_qc_set_pc_nbytes(qc);
 
         /* check whether ATAPI DMA is safe */
         if (!using_pio && ata_check_atapi_dma(qc))
@@ -2550,7 +2558,7 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc)
          * want to set it properly, and for DMA where it is
          * effectively meaningless.
          */
-        nbytes = min(scmd->request->data_len, (unsigned int)63 * 1024);
+        nbytes = min(ata_qc_raw_nbytes(qc), (unsigned int)63 * 1024);
 
         /* Most ATAPI devices which honor transfer chunk size don't
          * behave according to the spec when odd chunk size which
@@ -2876,7 +2884,7 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
          * TODO: find out if we need to do more here to
          *       cover scatter/gather case.
          */
-        qc->nbytes = scsi_bufflen(scmd) + scmd->request->extra_len;
+        ata_qc_set_pc_nbytes(qc);
 
         /* request result TF and be quiet about device error */
         qc->flags |= ATA_QCFLAG_RESULT_TF | ATA_QCFLAG_QUIET;
diff --git a/drivers/ata/pata_it821x.c b/drivers/ata/pata_it821x.c
index 109ddd42c266..257951d03dbb 100644
--- a/drivers/ata/pata_it821x.c
+++ b/drivers/ata/pata_it821x.c
@@ -564,7 +564,7 @@ static int it821x_check_atapi_dma(struct ata_queued_cmd *qc)
         struct it821x_dev *itdev = ap->private_data;
 
         /* Only use dma for transfers to/from the media. */
-        if (qc->nbytes < 2048)
+        if (ata_qc_raw_nbytes(qc) < 2048)
                 return -EOPNOTSUPP;
 
         /* No ATAPI DMA in smart mode */
diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
index f251a5f569d5..11c1afea2db2 100644
--- a/drivers/ata/sata_promise.c
+++ b/drivers/ata/sata_promise.c
@@ -46,7 +46,7 @@
 #include "sata_promise.h"
 
 #define DRV_NAME        "sata_promise"
-#define DRV_VERSION     "2.11"
+#define DRV_VERSION     "2.12"
 
 enum {
         PDC_MAX_PORTS           = 4,
@@ -145,7 +145,9 @@ static int pdc_old_sata_check_atapi_dma(struct ata_queued_cmd *qc);
 static void pdc_irq_clear(struct ata_port *ap);
 static unsigned int pdc_qc_issue_prot(struct ata_queued_cmd *qc);
 static void pdc_freeze(struct ata_port *ap);
+static void pdc_sata_freeze(struct ata_port *ap);
 static void pdc_thaw(struct ata_port *ap);
+static void pdc_sata_thaw(struct ata_port *ap);
 static void pdc_pata_error_handler(struct ata_port *ap);
 static void pdc_sata_error_handler(struct ata_port *ap);
 static void pdc_post_internal_cmd(struct ata_queued_cmd *qc);
@@ -180,8 +182,8 @@ static const struct ata_port_operations pdc_sata_ops = {
 
         .qc_prep                = pdc_qc_prep,
         .qc_issue               = pdc_qc_issue_prot,
-        .freeze                 = pdc_freeze,
-        .thaw                   = pdc_thaw,
+        .freeze                 = pdc_sata_freeze,
+        .thaw                   = pdc_sata_thaw,
         .error_handler          = pdc_sata_error_handler,
         .post_internal_cmd      = pdc_post_internal_cmd,
         .cable_detect           = pdc_sata_cable_detect,
@@ -205,8 +207,8 @@ static const struct ata_port_operations pdc_old_sata_ops = {
 
         .qc_prep                = pdc_qc_prep,
         .qc_issue               = pdc_qc_issue_prot,
-        .freeze                 = pdc_freeze,
-        .thaw                   = pdc_thaw,
+        .freeze                 = pdc_sata_freeze,
+        .thaw                   = pdc_sata_thaw,
         .error_handler          = pdc_sata_error_handler,
         .post_internal_cmd      = pdc_post_internal_cmd,
         .cable_detect           = pdc_sata_cable_detect,
@@ -631,6 +633,41 @@ static void pdc_qc_prep(struct ata_queued_cmd *qc)
         }
 }
 
+static int pdc_is_sataii_tx4(unsigned long flags)
+{
+        const unsigned long mask = PDC_FLAG_GEN_II | PDC_FLAG_4_PORTS;
+        return (flags & mask) == mask;
+}
+
+static unsigned int pdc_port_no_to_ata_no(unsigned int port_no,
+                                          int is_sataii_tx4)
+{
+        static const unsigned char sataii_tx4_port_remap[4] = { 3, 1, 0, 2};
+        return is_sataii_tx4 ? sataii_tx4_port_remap[port_no] : port_no;
+}
+
+static unsigned int pdc_sata_nr_ports(const struct ata_port *ap)
+{
+        return (ap->flags & PDC_FLAG_4_PORTS) ? 4 : 2;
+}
+
+static unsigned int pdc_sata_ata_port_to_ata_no(const struct ata_port *ap)
+{
+        const struct ata_host *host = ap->host;
+        unsigned int nr_ports = pdc_sata_nr_ports(ap);
+        unsigned int i;
+
+        for(i = 0; i < nr_ports && host->ports[i] != ap; ++i)
+                ;
+        BUG_ON(i >= nr_ports);
+        return pdc_port_no_to_ata_no(i, pdc_is_sataii_tx4(ap->flags));
+}
+
+static unsigned int pdc_sata_hotplug_offset(const struct ata_port *ap)
+{
+        return (ap->flags & PDC_FLAG_GEN_II) ? PDC2_SATA_PLUG_CSR : PDC_SATA_PLUG_CSR;
+}
+
 static void pdc_freeze(struct ata_port *ap)
 {
         void __iomem *mmio = ap->ioaddr.cmd_addr;
@@ -643,6 +680,29 @@ static void pdc_freeze(struct ata_port *ap)
         readl(mmio + PDC_CTLSTAT); /* flush */
 }
 
+static void pdc_sata_freeze(struct ata_port *ap)
+{
+        struct ata_host *host = ap->host;
+        void __iomem *host_mmio = host->iomap[PDC_MMIO_BAR];
+        unsigned int hotplug_offset = pdc_sata_hotplug_offset(ap);
+        unsigned int ata_no = pdc_sata_ata_port_to_ata_no(ap);
+        u32 hotplug_status;
+
+        /* Disable hotplug events on this port.
+         *
+         * Locking:
+         * 1) hotplug register accesses must be serialised via host->lock
+         * 2) ap->lock == &ap->host->lock
+         * 3) ->freeze() and ->thaw() are called with ap->lock held
+         */
+        hotplug_status = readl(host_mmio + hotplug_offset);
+        hotplug_status |= 0x11 << (ata_no + 16);
+        writel(hotplug_status, host_mmio + hotplug_offset);
+        readl(host_mmio + hotplug_offset); /* flush */
+
+        pdc_freeze(ap);
+}
+
 static void pdc_thaw(struct ata_port *ap)
 {
         void __iomem *mmio = ap->ioaddr.cmd_addr;
@@ -658,6 +718,26 @@ static void pdc_thaw(struct ata_port *ap)
         readl(mmio + PDC_CTLSTAT); /* flush */
 }
 
+static void pdc_sata_thaw(struct ata_port *ap)
+{
+        struct ata_host *host = ap->host;
+        void __iomem *host_mmio = host->iomap[PDC_MMIO_BAR];
+        unsigned int hotplug_offset = pdc_sata_hotplug_offset(ap);
+        unsigned int ata_no = pdc_sata_ata_port_to_ata_no(ap);
+        u32 hotplug_status;
+
+        pdc_thaw(ap);
+
+        /* Enable hotplug events on this port.
+         * Locking: see pdc_sata_freeze().
+         */
+        hotplug_status = readl(host_mmio + hotplug_offset);
+        hotplug_status |= 0x11 << ata_no;
+        hotplug_status &= ~(0x11 << (ata_no + 16));
+        writel(hotplug_status, host_mmio + hotplug_offset);
+        readl(host_mmio + hotplug_offset); /* flush */
+}
+
 static void pdc_common_error_handler(struct ata_port *ap, ata_reset_fn_t hardreset)
 {
         if (!(ap->pflags & ATA_PFLAG_FROZEN))
@@ -765,19 +845,6 @@ static void pdc_irq_clear(struct ata_port *ap)
         readl(mmio + PDC_INT_SEQMASK);
 }
 
-static int pdc_is_sataii_tx4(unsigned long flags)
-{
-        const unsigned long mask = PDC_FLAG_GEN_II | PDC_FLAG_4_PORTS;
-        return (flags & mask) == mask;
-}
-
-static unsigned int pdc_port_no_to_ata_no(unsigned int port_no,
-                                          int is_sataii_tx4)
-{
-        static const unsigned char sataii_tx4_port_remap[4] = { 3, 1, 0, 2};
-        return is_sataii_tx4 ? sataii_tx4_port_remap[port_no] : port_no;
-}
-
 static irqreturn_t pdc_interrupt(int irq, void *dev_instance)
 {
         struct ata_host *host = dev_instance;
@@ -799,6 +866,8 @@ static irqreturn_t pdc_interrupt(int irq, void *dev_instance)
 
         mmio_base = host->iomap[PDC_MMIO_BAR];
 
+        spin_lock(&host->lock);
+
         /* read and clear hotplug flags for all ports */
         if (host->ports[0]->flags & PDC_FLAG_GEN_II)
                 hotplug_offset = PDC2_SATA_PLUG_CSR;
@@ -814,11 +883,9 @@ static irqreturn_t pdc_interrupt(int irq, void *dev_instance)
 
         if (mask == 0xffffffff && hotplug_status == 0) {
                 VPRINTK("QUICK EXIT 2\n");
-                return IRQ_NONE;
+                goto done_irq;
         }
 
-        spin_lock(&host->lock);
-
         mask &= 0xffff;         /* only 16 tags possible */
         if (mask == 0 && hotplug_status == 0) {
                 VPRINTK("QUICK EXIT 3\n");
diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig
index 6bbd4fa50f3b..8d6c2089d2a8 100644
--- a/drivers/char/hw_random/Kconfig
+++ b/drivers/char/hw_random/Kconfig
@@ -9,7 +9,14 @@ config HW_RANDOM
           Hardware Random Number Generator Core infrastructure.
 
           To compile this driver as a module, choose M here: the
-          module will be called rng-core.
+          module will be called rng-core.  This provides a device
+          that's usually called /dev/hw_random, and which exposes one
+          of possibly several hardware random number generators.
+
+          These hardware random number generators do not feed directly
+          into the kernel's random number generator.  That is usually
+          handled by the "rngd" daemon.  Documentation/hw_random.txt
+          has more information.
 
           If unsure, say Y.
 
diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
index eeaaa9dce6ef..ad1880c67518 100644
--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -408,7 +408,6 @@ static int block2mtd_setup2(const char *val)
         if (token[1]) {
                 ret = parse_num(&erase_size, token[1]);
                 if (ret) {
-                        kfree(name);
                         parse_err("illegal erase size");
                 }
         }
diff --git a/include/linux/libata.h b/include/linux/libata.h
index a05f60013642..269cdba09578 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -463,6 +463,7 @@ struct ata_queued_cmd {
         unsigned int            sect_size;
 
         unsigned int            nbytes;
+        unsigned int            extrabytes;
         unsigned int            curbytes;
 
         struct scatterlist      *cursg;
@@ -1336,6 +1337,11 @@ static inline struct ata_queued_cmd *ata_qc_from_tag(struct ata_port *ap,
         return NULL;
 }
 
+static inline unsigned int ata_qc_raw_nbytes(struct ata_queued_cmd *qc)
+{
+        return qc->nbytes - min(qc->extrabytes, qc->nbytes);
+}
+
 static inline void ata_tf_init(struct ata_device *dev, struct ata_taskfile *tf)
 {
         memset(tf, 0, sizeof(*tf));
@@ -1354,7 +1360,7 @@ static inline void ata_qc_reinit(struct ata_queued_cmd *qc)
         qc->flags = 0;
         qc->cursg = NULL;
         qc->cursg_ofs = 0;
-        qc->nbytes = qc->curbytes = 0;
+        qc->nbytes = qc->extrabytes = qc->curbytes = 0;
         qc->n_elem = 0;
         qc->err_mask = 0;
         qc->sect_size = ATA_SECT_SIZE;
diff --git a/kernel/acct.c b/kernel/acct.c
index 521dfa53cb99..91e1cfd734d2 100644
--- a/kernel/acct.c
+++ b/kernel/acct.c
@@ -58,6 +58,7 @@
 #include <asm/uaccess.h>
 #include <asm/div64.h>
 #include <linux/blkdev.h> /* sector_div */
+#include <linux/pid_namespace.h>
 
 /*
  * These constants control the amount of freespace that suspend and
@@ -74,7 +75,7 @@ int acct_parm[3] = {4, 2, 30};
 /*
  * External references and all of the globals.
  */
-static void do_acct_process(struct file *);
+static void do_acct_process(struct pid_namespace *ns, struct file *);
 
 /*
  * This structure is used so that all the data protected by lock
@@ -86,6 +87,7 @@ struct acct_glbs {
         volatile int            active;
         volatile int            needcheck;
         struct file             *file;
+        struct pid_namespace    *ns;
         struct timer_list       timer;
 };
 
@@ -175,9 +177,11 @@ out:
 static void acct_file_reopen(struct file *file)
 {
         struct file *old_acct = NULL;
+        struct pid_namespace *old_ns = NULL;
 
         if (acct_globals.file) {
                 old_acct = acct_globals.file;
+                old_ns = acct_globals.ns;
                 del_timer(&acct_globals.timer);
                 acct_globals.active = 0;
                 acct_globals.needcheck = 0;
@@ -185,6 +189,7 @@ static void acct_file_reopen(struct file *file)
         }
         if (file) {
                 acct_globals.file = file;
+                acct_globals.ns = get_pid_ns(task_active_pid_ns(current));
                 acct_globals.needcheck = 0;
                 acct_globals.active = 1;
                 /* It's been deleted if it was used before so this is safe */
@@ -196,8 +201,9 @@ static void acct_file_reopen(struct file *file)
         if (old_acct) {
                 mnt_unpin(old_acct->f_path.mnt);
                 spin_unlock(&acct_globals.lock);
-                do_acct_process(old_acct);
+                do_acct_process(old_ns, old_acct);
                 filp_close(old_acct, NULL);
+                put_pid_ns(old_ns);
                 spin_lock(&acct_globals.lock);
         }
 }
@@ -419,7 +425,7 @@ static u32 encode_float(u64 value)
 /*
  *  do_acct_process does all actual work. Caller holds the reference to file.
  */
-static void do_acct_process(struct file *file)
+static void do_acct_process(struct pid_namespace *ns, struct file *file)
 {
         struct pacct_struct *pacct = &current->signal->pacct;
         acct_t ac;
@@ -481,8 +487,10 @@ static void do_acct_process(struct file *file)
         ac.ac_gid16 = current->gid;
 #endif
 #if ACCT_VERSION==3
-        ac.ac_pid = current->tgid;
-        ac.ac_ppid = current->real_parent->tgid;
+        ac.ac_pid = task_tgid_nr_ns(current, ns);
+        rcu_read_lock();
+        ac.ac_ppid = task_tgid_nr_ns(rcu_dereference(current->real_parent), ns);
+        rcu_read_unlock();
 #endif
 
         spin_lock_irq(&current->sighand->siglock);
@@ -578,6 +586,7 @@ void acct_collect(long exitcode, int group_dead)
 void acct_process(void)
 {
         struct file *file = NULL;
+        struct pid_namespace *ns;
 
         /*
          * accelerate the common fastpath:
@@ -592,8 +601,10 @@ void acct_process(void)
                 return;
         }
         get_file(file);
+        ns = get_pid_ns(acct_globals.ns);
         spin_unlock(&acct_globals.lock);
 
-        do_acct_process(file);
+        do_acct_process(ns, file);
         fput(file);
+        put_pid_ns(ns);
 }
diff --git a/kernel/marker.c b/kernel/marker.c
index 48a4ea5afffd..041c33e3e95c 100644
--- a/kernel/marker.c
+++ b/kernel/marker.c
@@ -104,18 +104,18 @@ void marker_probe_cb(const struct marker *mdata, void *call_private,
         char ptype;
 
         /*
-         * disabling preemption to make sure the teardown of the callbacks can
-         * be done correctly when they are in modules and they insure RCU read
-         * coherency.
+         * preempt_disable does two things : disabling preemption to make sure
+         * the teardown of the callbacks can be done correctly when they are in
+         * modules and they insure RCU read coherency.
          */
         preempt_disable();
-        ptype = ACCESS_ONCE(mdata->ptype);
+        ptype = mdata->ptype;
         if (likely(!ptype)) {
                 marker_probe_func *func;
                 /* Must read the ptype before ptr. They are not data dependant,
                  * so we put an explicit smp_rmb() here. */
                 smp_rmb();
-                func = ACCESS_ONCE(mdata->single.func);
+                func = mdata->single.func;
                 /* Must read the ptr before private data. They are not data
                  * dependant, so we put an explicit smp_rmb() here. */
                 smp_rmb();
@@ -133,7 +133,7 @@ void marker_probe_cb(const struct marker *mdata, void *call_private,
                  * in the fast path, so put the explicit barrier here.
                  */
                 smp_read_barrier_depends();
-                multi = ACCESS_ONCE(mdata->multi);
+                multi = mdata->multi;
                 for (i = 0; multi[i].func; i++) {
                         va_start(args, fmt);
                         multi[i].func(multi[i].probe_private, call_private, fmt,
@@ -161,13 +161,13 @@ void marker_probe_cb_noarg(const struct marker *mdata,
         char ptype;
 
         preempt_disable();
-        ptype = ACCESS_ONCE(mdata->ptype);
+        ptype = mdata->ptype;
         if (likely(!ptype)) {
                 marker_probe_func *func;
                 /* Must read the ptype before ptr. They are not data dependant,
                  * so we put an explicit smp_rmb() here. */
                 smp_rmb();
-                func = ACCESS_ONCE(mdata->single.func);
+                func = mdata->single.func;
                 /* Must read the ptr before private data. They are not data
                  * dependant, so we put an explicit smp_rmb() here. */
                 smp_rmb();
@@ -183,7 +183,7 @@ void marker_probe_cb_noarg(const struct marker *mdata,
                  * in the fast path, so put the explicit barrier here.
                  */
                 smp_read_barrier_depends();
-                multi = ACCESS_ONCE(mdata->multi);
+                multi = mdata->multi;
                 for (i = 0; multi[i].func; i++)
                         multi[i].func(multi[i].probe_private, call_private, fmt,
                                 &args);
@@ -551,9 +551,9 @@ static int set_marker(struct marker_entry **entry, struct marker *elem,
 
 /*
  * Disable a marker and its probe callback.
- * Note: only after a synchronize_sched() issued after setting elem->call to the
- * empty function insures that the original callback is not used anymore. This
- * insured by preemption disabling around the call site.
+ * Note: only waiting an RCU period after setting elem->call to the empty
+ * function insures that the original callback is not used anymore. This insured
+ * by preempt_disable around the call site.
  */
 static void disable_marker(struct marker *elem)
 {
@@ -565,8 +565,8 @@ static void disable_marker(struct marker *elem)
         elem->ptype = 0;        /* single probe */
         /*
          * Leave the private data and id there, because removal is racy and
-         * should be done only after a synchronize_sched(). These are never used
-         * until the next initialization anyway.
+         * should be done only after an RCU period. These are never used until
+         * the next initialization anyway.
          */
 }
 
@@ -601,9 +601,6 @@ void marker_update_probe_range(struct marker *begin,
 
 /*
  * Update probes, removing the faulty probes.
- * Issues a synchronize_sched() when no reference to the module passed
- * as parameter is found in the probes so the probe module can be
- * safely unloaded from now on.
  *
  * Internal callback only changed before the first probe is connected to it.
  * Single probe private data can only be changed on 0 -> 1 and 2 -> 1
diff --git a/kernel/printk.c b/kernel/printk.c
index 9adc2a473e6e..c46a20a19a15 100644
--- a/kernel/printk.c
+++ b/kernel/printk.c
@@ -616,6 +616,40 @@ asmlinkage int printk(const char *fmt, ...)
 /* cpu currently holding logbuf_lock */
 static volatile unsigned int printk_cpu = UINT_MAX;
 
+/*
+ * Can we actually use the console at this time on this cpu?
+ *
+ * Console drivers may assume that per-cpu resources have
+ * been allocated. So unless they're explicitly marked as
+ * being able to cope (CON_ANYTIME) don't call them until
+ * this CPU is officially up.
+ */
+static inline int can_use_console(unsigned int cpu)
+{
+        return cpu_online(cpu) || have_callable_console();
+}
+
+/*
+ * Try to get console ownership to actually show the kernel
+ * messages from a 'printk'. Return true (and with the
+ * console_semaphore held, and 'console_locked' set) if it
+ * is successful, false otherwise.
+ *
+ * This gets called with the 'logbuf_lock' spinlock held and
+ * interrupts disabled. It should return with 'lockbuf_lock'
+ * released but interrupts still disabled.
+ */
+static int acquire_console_semaphore_for_printk(unsigned int cpu)
+{
+        int retval = 0;
+
+        if (can_use_console(cpu))
+                retval = !try_acquire_console_sem();
+        printk_cpu = UINT_MAX;
+        spin_unlock(&logbuf_lock);
+        return retval;
+}
+
 const char printk_recursion_bug_msg [] =
                         KERN_CRIT "BUG: recent printk recursion!\n";
 static int printk_recursion_bug;
@@ -725,43 +759,22 @@ asmlinkage int vprintk(const char *fmt, va_list args)
                         log_level_unknown = 1;
         }
 
-        if (!down_trylock(&console_sem)) {
-                /*
-                 * We own the drivers.  We can drop the spinlock and
-                 * let release_console_sem() print the text, maybe ...
-                 */
-                console_locked = 1;
-                printk_cpu = UINT_MAX;
-                spin_unlock(&logbuf_lock);
+        /*
+         * Try to acquire and then immediately release the
+         * console semaphore. The release will do all the
+         * actual magic (print out buffers, wake up klogd,
+         * etc). 
+         *
+         * The acquire_console_semaphore_for_printk() function
+         * will release 'logbuf_lock' regardless of whether it
+         * actually gets the semaphore or not.
+         */
+        if (acquire_console_semaphore_for_printk(this_cpu))
+                release_console_sem();
 
-                /*
-                 * Console drivers may assume that per-cpu resources have
-                 * been allocated. So unless they're explicitly marked as
-                 * being able to cope (CON_ANYTIME) don't call them until
-                 * this CPU is officially up.
-                 */
-                if (cpu_online(smp_processor_id()) || have_callable_console()) {
-                        console_may_schedule = 0;
-                        release_console_sem();
-                } else {
-                        /* Release by hand to avoid flushing the buffer. */
-                        console_locked = 0;
-                        up(&console_sem);
-                }
-                lockdep_on();
-                raw_local_irq_restore(flags);
-        } else {
-                /*
-                 * Someone else owns the drivers.  We drop the spinlock, which
-                 * allows the semaphore holder to proceed and to call the
-                 * console drivers with the output which we just produced.
-                 */
-                printk_cpu = UINT_MAX;
-                spin_unlock(&logbuf_lock);
-                lockdep_on();
+        lockdep_on();
 out_restore_irqs:
-                raw_local_irq_restore(flags);
-        }
+        raw_local_irq_restore(flags);
 
         preempt_enable();
         return printed_len;
diff --git a/mm/bootmem.c b/mm/bootmem.c
index f6ff4337b424..2ccea700968f 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -125,6 +125,7 @@ static int __init reserve_bootmem_core(bootmem_data_t *bdata,
         BUG_ON(!size);
         BUG_ON(PFN_DOWN(addr) >= bdata->node_low_pfn);
         BUG_ON(PFN_UP(addr + size) > bdata->node_low_pfn);
+        BUG_ON(addr < bdata->node_boot_start);
 
         sidx = PFN_DOWN(addr - bdata->node_boot_start);
         eidx = PFN_UP(addr + size - bdata->node_boot_start);
@@ -156,21 +157,31 @@ static void __init free_bootmem_core(bootmem_data_t *bdata, unsigned long addr,
         unsigned long sidx, eidx;
         unsigned long i;
 
+        BUG_ON(!size);
+
+        /* out range */
+        if (addr + size < bdata->node_boot_start ||
+                PFN_DOWN(addr) > bdata->node_low_pfn)
+                return;
         /*
          * round down end of usable mem, partially free pages are
          * considered reserved.
          */
-        BUG_ON(!size);
-        BUG_ON(PFN_DOWN(addr + size) > bdata->node_low_pfn);
 
-        if (addr < bdata->last_success)
+        if (addr >= bdata->node_boot_start && addr < bdata->last_success)
                 bdata->last_success = addr;
 
         /*
-         * Round up the beginning of the address.
+         * Round up to index to the range.
          */
-        sidx = PFN_UP(addr) - PFN_DOWN(bdata->node_boot_start);
+        if (PFN_UP(addr) > PFN_DOWN(bdata->node_boot_start))
+                sidx = PFN_UP(addr) - PFN_DOWN(bdata->node_boot_start);
+        else
+                sidx = 0;
+
         eidx = PFN_DOWN(addr + size - bdata->node_boot_start);
+        if (eidx > bdata->node_low_pfn - PFN_DOWN(bdata->node_boot_start))
+                eidx = bdata->node_low_pfn - PFN_DOWN(bdata->node_boot_start);
 
         for (i = sidx; i < eidx; i++) {
                 if (unlikely(!test_and_clear_bit(i, bdata->node_bootmem_map)))
@@ -421,7 +432,9 @@ int __init reserve_bootmem(unsigned long addr, unsigned long size,
 
 void __init free_bootmem(unsigned long addr, unsigned long size)
 {
-        free_bootmem_core(NODE_DATA(0)->bdata, addr, size);
+        bootmem_data_t *bdata;
+        list_for_each_entry(bdata, &bdata_list, list)
+                free_bootmem_core(bdata, addr, size);
 }
 
 unsigned long __init free_all_bootmem(void)
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 45711585684e..4046434046e6 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -70,13 +70,6 @@ struct scan_control {
 
         int order;
 
-        /*
-         * Pages that have (or should have) IO pending.  If we run into
-         * a lot of these, we're better off waiting a little for IO to
-         * finish rather than scanning more pages in the VM.
-         */
-        int nr_io_pages;
-
         /* Which cgroup do we reclaim from */
         struct mem_cgroup *mem_cgroup;
 
@@ -512,10 +505,8 @@ static unsigned long shrink_page_list(struct list_head *page_list,
                          */
                         if (sync_writeback == PAGEOUT_IO_SYNC && may_enter_fs)
                                 wait_on_page_writeback(page);
-                        else {
-                                sc->nr_io_pages++;
+                        else
                                 goto keep_locked;
-                        }
                 }
 
                 referenced = page_referenced(page, 1, sc->mem_cgroup);
@@ -554,10 +545,8 @@ static unsigned long shrink_page_list(struct list_head *page_list,
                 if (PageDirty(page)) {
                         if (sc->order <= PAGE_ALLOC_COSTLY_ORDER && referenced)
                                 goto keep_locked;
-                        if (!may_enter_fs) {
-                                sc->nr_io_pages++;
+                        if (!may_enter_fs)
                                 goto keep_locked;
-                        }
                         if (!sc->may_writepage)
                                 goto keep_locked;
 
@@ -568,10 +557,8 @@ static unsigned long shrink_page_list(struct list_head *page_list,
                         case PAGE_ACTIVATE:
                                 goto activate_locked;
                         case PAGE_SUCCESS:
-                                if (PageWriteback(page) || PageDirty(page)) {
-                                        sc->nr_io_pages++;
+                                if (PageWriteback(page) || PageDirty(page))
                                         goto keep;
-                                }
                                 /*
                                  * A synchronous write - probably a ramdisk.  Go
                                  * ahead and try to reclaim the page.
@@ -1344,7 +1331,6 @@ static unsigned long do_try_to_free_pages(struct zone **zones, gfp_t gfp_mask,
 
         for (priority = DEF_PRIORITY; priority >= 0; priority--) {
                 sc->nr_scanned = 0;
-                sc->nr_io_pages = 0;
                 if (!priority)
                         disable_swap_token();
                 nr_reclaimed += shrink_zones(priority, zones, sc);
@@ -1379,8 +1365,7 @@ static unsigned long do_try_to_free_pages(struct zone **zones, gfp_t gfp_mask,
                 }
 
                 /* Take a nap, wait for some writeback to complete */
-                if (sc->nr_scanned && priority < DEF_PRIORITY - 2 &&
-                                sc->nr_io_pages > sc->swap_cluster_max)
+                if (sc->nr_scanned && priority < DEF_PRIORITY - 2)
                         congestion_wait(WRITE, HZ/10);
         }
         /* top priority shrink_caches still had more to do? don't OOM, then */
@@ -1514,7 +1499,6 @@ loop_again:
                 if (!priority)
                         disable_swap_token();
 
-                sc.nr_io_pages = 0;
                 all_zones_ok = 1;
 
                 /*
@@ -1607,8 +1591,7 @@ loop_again:
                  * OK, kswapd is getting into trouble.  Take a nap, then take
                  * another pass across the zones.
                  */
-                if (total_scanned && priority < DEF_PRIORITY - 2 &&
-                                        sc.nr_io_pages > sc.swap_cluster_max)
+                if (total_scanned && priority < DEF_PRIORITY - 2)
                         congestion_wait(WRITE, HZ/10);
 
                 /*
diff --git a/scripts/Makefile.modpost b/scripts/Makefile.modpost
index cfc004e04417..2d20640854b7 100644
--- a/scripts/Makefile.modpost
+++ b/scripts/Makefile.modpost
@@ -58,6 +58,9 @@ modules   := $(patsubst %.o,%.ko, $(wildcard $(__modules:.ko=.o)))
 # Stop after building .o files if NOFINAL is set. Makes compile tests quicker
 _modpost: $(if $(KBUILD_MODPOST_NOFINAL), $(modules:.ko:.o),$(modules))
 
+ifneq ($(KBUILD_BUILDHOST),$(ARCH))
+        cross_build := 1
+endif
 
 # Step 2), invoke modpost
 #  Includes step 3,4
@@ -70,7 +73,8 @@ modpost = scripts/mod/modpost                    \
  $(if $(CONFIG_DEBUG_SECTION_MISMATCH),,-S)      \
  $(if $(CONFIG_MARKERS),-K $(kernelmarkersfile)) \
  $(if $(CONFIG_MARKERS),-M $(markersfile))       \
- $(if $(KBUILD_EXTMOD)$(KBUILD_MODPOST_WARN),-w)
+ $(if $(KBUILD_EXTMOD)$(KBUILD_MODPOST_WARN),-w) \
+ $(if $(cross_build),-c)
 
 quiet_cmd_modpost = MODPOST $(words $(filter-out vmlinux FORCE, $^)) modules
       cmd_modpost = $(modpost) -s
diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
index 9ddf944cce29..348d8687b7c9 100644
--- a/scripts/mod/file2alias.c
+++ b/scripts/mod/file2alias.c
@@ -51,11 +51,13 @@ do {                                                            \
                 sprintf(str + strlen(str), "*");                \
 } while(0)
 
+unsigned int cross_build = 0;
 /**
  * Check that sizeof(device_id type) are consistent with size of section
  * in .o file. If in-consistent then userspace and kernel does not agree
  * on actual size which is a bug.
  * Also verify that the final entry in the table is all zeros.
+ * Ignore both checks if build host differ from target host and size differs.
  **/
 static void device_id_check(const char *modname, const char *device_id,
                             unsigned long size, unsigned long id_size,
@@ -64,6 +66,8 @@ static void device_id_check(const char *modname, const char *device_id,
         int i;
 
         if (size % id_size || size < id_size) {
+                if (cross_build != 0)
+                        return;
                 fatal("%s: sizeof(struct %s_device_id)=%lu is not a modulo "
                       "of the size of section __mod_%s_device_table=%lu.\n"
                       "Fix definition of struct %s_device_id "
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 695b5d657cf5..110cf243fa4e 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -2026,7 +2026,7 @@ int main(int argc, char **argv)
         int opt;
         int err;
 
-        while ((opt = getopt(argc, argv, "i:I:msSo:awM:K:")) != -1) {
+        while ((opt = getopt(argc, argv, "i:I:cmsSo:awM:K:")) != -1) {
                 switch (opt) {
                 case 'i':
                         kernel_read = optarg;
@@ -2035,6 +2035,9 @@ int main(int argc, char **argv)
                         module_read = optarg;
                         external_module = 1;
                         break;
+                case 'c':
+                        cross_build = 1;
+                        break;
                 case 'm':
                         modversions = 1;
                         break;
diff --git a/scripts/mod/modpost.h b/scripts/mod/modpost.h
index 565c5872407e..09f58e33d227 100644
--- a/scripts/mod/modpost.h
+++ b/scripts/mod/modpost.h
@@ -135,6 +135,7 @@ struct elf_info {
 };
 
 /* file2alias.c */
+extern unsigned int cross_build;
 void handle_moddevtable(struct module *mod, struct elf_info *info,
                         Elf_Sym *sym, const char *symname);
 void add_moddevtable(struct buffer *buf, struct module *mod);
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index afe7c9b0732a..cfae8afcc262 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -74,11 +74,6 @@ struct smk_list_entry *smack_list;
 #define SEQ_READ_FINISHED       1
 
 /*
- * Disable concurrent writing open() operations
- */
-static struct semaphore smack_write_sem;
-
-/*
  * Values for parsing cipso rules
  * SMK_DIGITLEN: Length of a digit field in a rule.
  * SMK_CIPSOMIN: Minimum possible cipso rule length.
@@ -168,32 +163,7 @@ static struct seq_operations load_seq_ops = {
  */
 static int smk_open_load(struct inode *inode, struct file *file)
 {
-        if ((file->f_flags & O_ACCMODE) == O_RDONLY)
-                return seq_open(file, &load_seq_ops);
-
-        if (down_interruptible(&smack_write_sem))
-                return -ERESTARTSYS;
-
-        return 0;
-}
-
-/**
- * smk_release_load - release() for /smack/load
- * @inode: inode structure representing file
- * @file: "load" file pointer
- *
- * For a reading session, use the seq_file release
- * implementation.
- * Otherwise, we are at the end of a writing session so
- * clean everything up.
- */
-static int smk_release_load(struct inode *inode, struct file *file)
-{
-        if ((file->f_flags & O_ACCMODE) == O_RDONLY)
-                return seq_release(inode, file);
-
-        up(&smack_write_sem);
-        return 0;
+        return seq_open(file, &load_seq_ops);
 }
 
 /**
@@ -341,7 +311,7 @@ static const struct file_operations smk_load_ops = {
         .read           = seq_read,
         .llseek         = seq_lseek,
         .write          = smk_write_load,
-        .release        = smk_release_load,
+        .release        = seq_release,
 };
 
 /**
@@ -1011,7 +981,6 @@ static int __init init_smk_fs(void)
                 }
         }
 
-        sema_init(&smack_write_sem, 1);
         smk_cipso_doi();
         smk_unlbl_ambient(NULL);