16 files changed, 97 insertions, 43 deletions

diff --git a/Makefile b/Makefile
index c1825aab77e8..fbb8dfc063d3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 24
-EXTRAVERSION = -rc5
+EXTRAVERSION = -rc6
 NAME = Arr Matey! A Hairy Bilge Rat!
 
 # *DOCUMENTATION*
diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
index 606fe4d55a91..9f530ff43c21 100644
--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
@@ -49,6 +49,7 @@ static struct _cache_table cache_table[] __cpuinitdata =
         { 0x3c, LVL_2,      256 },      /* 4-way set assoc, sectored cache, 64 byte line size */
         { 0x3d, LVL_2,      384 },      /* 6-way set assoc, sectored cache, 64 byte line size */
         { 0x3e, LVL_2,      512 },      /* 4-way set assoc, sectored cache, 64 byte line size */
+        { 0x3f, LVL_2,      256 },      /* 2-way set assoc, 64 byte line size */
         { 0x41, LVL_2,      128 },      /* 4-way set assoc, 32 byte line size */
         { 0x42, LVL_2,      256 },      /* 4-way set assoc, 32 byte line size */
         { 0x43, LVL_2,      512 },      /* 4-way set assoc, 32 byte line size */
diff --git a/arch/x86/kernel/traps_32.c b/arch/x86/kernel/traps_32.c
index ef6010262597..c88bbffcaa03 100644
--- a/arch/x86/kernel/traps_32.c
+++ b/arch/x86/kernel/traps_32.c
@@ -373,14 +373,13 @@ void die(const char * str, struct pt_regs * regs, long err)
 
         if (die.lock_owner != raw_smp_processor_id()) {
                 console_verbose();
+                raw_local_irq_save(flags);
                 __raw_spin_lock(&die.lock);
-                raw_local_save_flags(flags);
                 die.lock_owner = smp_processor_id();
                 die.lock_owner_depth = 0;
                 bust_spinlocks(1);
-        }
-        else
-                raw_local_save_flags(flags);
+        } else
+                raw_local_irq_save(flags);
 
         if (++die.lock_owner_depth < 3) {
                 unsigned long esp;
diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig
index 9b6fbf044fd8..3fa7c77d9bd9 100644
--- a/drivers/md/Kconfig
+++ b/drivers/md/Kconfig
@@ -269,7 +269,7 @@ config DM_MULTIPATH_RDAC
 
 config DM_MULTIPATH_HP
         tristate "HP MSA multipath support (EXPERIMENTAL)"
-        depends on DM_MULTIPATH && BLK_DEV_DM && EXPERIMENTAL
+        depends on DM_MULTIPATH && BLK_DEV_DM && SCSI && EXPERIMENTAL
         ---help---
           Multipath support for HP MSA (Active/Passive) series hardware.
 
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index 28c6ae095c56..6b66ee46b87d 100644
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -398,7 +398,8 @@ static struct bio *crypt_alloc_buffer(struct dm_crypt_io *io, unsigned size)
         struct bio *clone;
         unsigned int nr_iovecs = (size + PAGE_SIZE - 1) >> PAGE_SHIFT;
         gfp_t gfp_mask = GFP_NOIO | __GFP_HIGHMEM;
-        unsigned int i;
+        unsigned i, len;
+        struct page *page;
 
         clone = bio_alloc_bioset(GFP_NOIO, nr_iovecs, cc->bs);
         if (!clone)
@@ -407,10 +408,8 @@ static struct bio *crypt_alloc_buffer(struct dm_crypt_io *io, unsigned size)
         clone_init(io, clone);
 
         for (i = 0; i < nr_iovecs; i++) {
-                struct bio_vec *bv = bio_iovec_idx(clone, i);
-
-                bv->bv_page = mempool_alloc(cc->page_pool, gfp_mask);
-                if (!bv->bv_page)
+                page = mempool_alloc(cc->page_pool, gfp_mask);
+                if (!page)
                         break;
 
                 /*
@@ -421,15 +420,14 @@ static struct bio *crypt_alloc_buffer(struct dm_crypt_io *io, unsigned size)
                 if (i == (MIN_BIO_PAGES - 1))
                         gfp_mask = (gfp_mask | __GFP_NOWARN) & ~__GFP_WAIT;
 
-                bv->bv_offset = 0;
-                if (size > PAGE_SIZE)
-                        bv->bv_len = PAGE_SIZE;
-                else
-                        bv->bv_len = size;
+                len = (size > PAGE_SIZE) ? PAGE_SIZE : size;
+
+                if (!bio_add_page(clone, page, len, 0)) {
+                        mempool_free(page, cc->page_pool);
+                        break;
+                }
 
-                clone->bi_size += bv->bv_len;
-                clone->bi_vcnt++;
-                size -= bv->bv_len;
+                size -= len;
         }
 
         if (!clone->bi_size) {
@@ -511,6 +509,9 @@ static void crypt_endio(struct bio *clone, int error)
         struct crypt_config *cc = io->target->private;
         unsigned read_io = bio_data_dir(clone) == READ;
 
+        if (unlikely(!bio_flagged(clone, BIO_UPTODATE) && !error))
+                error = -EIO;
+
         /*
          * free the processed pages
          */
@@ -519,10 +520,8 @@ static void crypt_endio(struct bio *clone, int error)
                 goto out;
         }
 
-        if (unlikely(!bio_flagged(clone, BIO_UPTODATE))) {
-                error = -EIO;
+        if (unlikely(error))
                 goto out;
-        }
 
         bio_put(clone);
         kcryptd_queue_crypt(io);
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 138200bf5e0b..9627fa0f9470 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -332,6 +332,8 @@ static int dm_hash_rename(const char *old, const char *new)
                 dm_table_put(table);
         }
 
+        dm_kobject_uevent(hc->md);
+
         dm_put(hc->md);
         up_write(&_hash_lock);
         kfree(old_name);
@@ -1250,21 +1252,17 @@ static int target_message(struct dm_ioctl *param, size_t param_size)
         if (!table)
                 goto out_argv;
 
-        if (tmsg->sector >= dm_table_get_size(table)) {
+        ti = dm_table_find_target(table, tmsg->sector);
+        if (!dm_target_is_valid(ti)) {
                 DMWARN("Target message sector outside device.");
                 r = -EINVAL;
-                goto out_table;
-        }
-
-        ti = dm_table_find_target(table, tmsg->sector);
-        if (ti->type->message)
+        } else if (ti->type->message)
                 r = ti->type->message(ti, argc, argv);
         else {
                 DMWARN("Target type does not support messages");
                 r = -EINVAL;
         }
 
- out_table:
         dm_table_put(table);
  out_argv:
         kfree(argv);
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index e298d8d11f24..47818d8249cb 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -99,6 +99,9 @@ static void combine_restrictions_low(struct io_restrictions *lhs,
         lhs->max_segment_size =
                 min_not_zero(lhs->max_segment_size, rhs->max_segment_size);
 
+        lhs->max_hw_sectors =
+                min_not_zero(lhs->max_hw_sectors, rhs->max_hw_sectors);
+
         lhs->seg_boundary_mask =
                 min_not_zero(lhs->seg_boundary_mask, rhs->seg_boundary_mask);
 
@@ -189,8 +192,10 @@ static int alloc_targets(struct dm_table *t, unsigned int num)
 
         /*
          * Allocate both the target array and offset array at once.
+         * Append an empty entry to catch sectors beyond the end of
+         * the device.
          */
-        n_highs = (sector_t *) dm_vcalloc(num, sizeof(struct dm_target) +
+        n_highs = (sector_t *) dm_vcalloc(num + 1, sizeof(struct dm_target) +
                                           sizeof(sector_t));
         if (!n_highs)
                 return -ENOMEM;
@@ -564,6 +569,9 @@ void dm_set_device_limits(struct dm_target *ti, struct block_device *bdev)
         rs->max_segment_size =
                 min_not_zero(rs->max_segment_size, q->max_segment_size);
 
+        rs->max_hw_sectors =
+                min_not_zero(rs->max_hw_sectors, q->max_hw_sectors);
+
         rs->seg_boundary_mask =
                 min_not_zero(rs->seg_boundary_mask,
                              q->seg_boundary_mask);
@@ -701,6 +709,8 @@ static void check_for_valid_limits(struct io_restrictions *rs)
 {
         if (!rs->max_sectors)
                 rs->max_sectors = SAFE_MAX_SECTORS;
+        if (!rs->max_hw_sectors)
+                rs->max_hw_sectors = SAFE_MAX_SECTORS;
         if (!rs->max_phys_segments)
                 rs->max_phys_segments = MAX_PHYS_SEGMENTS;
         if (!rs->max_hw_segments)
@@ -867,6 +877,9 @@ struct dm_target *dm_table_get_target(struct dm_table *t, unsigned int index)
 
 /*
  * Search the btree for the correct target.
+ *
+ * Caller should check returned pointer with dm_target_is_valid()
+ * to trap I/O beyond end of device.
  */
 struct dm_target *dm_table_find_target(struct dm_table *t, sector_t sector)
 {
@@ -896,6 +909,7 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q)
         q->max_hw_segments = t->limits.max_hw_segments;
         q->hardsect_size = t->limits.hardsect_size;
         q->max_segment_size = t->limits.max_segment_size;
+        q->max_hw_sectors = t->limits.max_hw_sectors;
         q->seg_boundary_mask = t->limits.seg_boundary_mask;
         q->bounce_pfn = t->limits.bounce_pfn;
         if (t->limits.no_cluster)
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 07cbbb8eb3e0..88c0fd657825 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -672,13 +672,19 @@ static struct bio *clone_bio(struct bio *bio, sector_t sector,
         return clone;
 }
 
-static void __clone_and_map(struct clone_info *ci)
+static int __clone_and_map(struct clone_info *ci)
 {
         struct bio *clone, *bio = ci->bio;
-        struct dm_target *ti = dm_table_find_target(ci->map, ci->sector);
-        sector_t len = 0, max = max_io_len(ci->md, ci->sector, ti);
+        struct dm_target *ti;
+        sector_t len = 0, max;
         struct dm_target_io *tio;
 
+        ti = dm_table_find_target(ci->map, ci->sector);
+        if (!dm_target_is_valid(ti))
+                return -EIO;
+
+        max = max_io_len(ci->md, ci->sector, ti);
+
         /*
          * Allocate a target io object.
          */
@@ -736,6 +742,9 @@ static void __clone_and_map(struct clone_info *ci)
                 do {
                         if (offset) {
                                 ti = dm_table_find_target(ci->map, ci->sector);
+                                if (!dm_target_is_valid(ti))
+                                        return -EIO;
+
                                 max = max_io_len(ci->md, ci->sector, ti);
 
                                 tio = alloc_tio(ci->md);
@@ -759,6 +768,8 @@ static void __clone_and_map(struct clone_info *ci)
 
                 ci->idx++;
         }
+
+        return 0;
 }
 
 /*
@@ -767,6 +778,7 @@ static void __clone_and_map(struct clone_info *ci)
 static int __split_bio(struct mapped_device *md, struct bio *bio)
 {
         struct clone_info ci;
+        int error = 0;
 
         ci.map = dm_get_table(md);
         if (unlikely(!ci.map))
@@ -784,11 +796,11 @@ static int __split_bio(struct mapped_device *md, struct bio *bio)
         ci.idx = bio->bi_idx;
 
         start_io_acct(ci.io);
-        while (ci.sector_count)
-                __clone_and_map(&ci);
+        while (ci.sector_count && !error)
+                error = __clone_and_map(&ci);
 
         /* drop the extra reference count */
-        dec_pending(ci.io, 0);
+        dec_pending(ci.io, error);
         dm_table_put(ci.map);
 
         return 0;
@@ -1502,7 +1514,7 @@ int dm_resume(struct mapped_device *md)
 
         dm_table_unplug_all(map);
 
-        kobject_uevent(&md->disk->kobj, KOBJ_CHANGE);
+        dm_kobject_uevent(md);
 
         r = 0;
 
@@ -1516,6 +1528,11 @@ out:
 /*-----------------------------------------------------------------
  * Event notification.
  *---------------------------------------------------------------*/
+void dm_kobject_uevent(struct mapped_device *md)
+{
+        kobject_uevent(&md->disk->kobj, KOBJ_CHANGE);
+}
+
 uint32_t dm_next_uevent_seq(struct mapped_device *md)
 {
         return atomic_add_return(1, &md->uevent_seq);
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index 4b3faa45277e..b4584a39383b 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -112,6 +112,11 @@ int dm_table_resume_targets(struct dm_table *t);
 int dm_table_any_congested(struct dm_table *t, int bdi_bits);
 void dm_table_unplug_all(struct dm_table *t);
 
+/*
+ * To check the return value from dm_table_find_target().
+ */
+#define dm_target_is_valid(t) ((t)->table)
+
 /*-----------------------------------------------------------------
  * A registry of target types.
  *---------------------------------------------------------------*/
@@ -182,4 +187,6 @@ union map_info *dm_get_mapinfo(struct bio *bio);
 int dm_open_count(struct mapped_device *md);
 int dm_lock_for_deletion(struct mapped_device *md);
 
+void dm_kobject_uevent(struct mapped_device *md);
+
 #endif
diff --git a/fs/binfmt_aout.c b/fs/binfmt_aout.c
index e176d195e7e5..7596e1e94cde 100644
--- a/fs/binfmt_aout.c
+++ b/fs/binfmt_aout.c
@@ -319,7 +319,6 @@ static int load_aout_binary(struct linux_binprm * bprm, struct pt_regs * regs)
         current->mm->free_area_cache = current->mm->mmap_base;
         current->mm->cached_hole_size = 0;
 
-        current->mm->mmap = NULL;
         compute_creds(bprm);
         current->flags &= ~PF_FORKNOEXEC;
 #ifdef __sparc__
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index e1fcef2eb928..4847eb83fc18 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -347,6 +347,7 @@ xfs_file_readdir(
 
                 size = buf.used;
                 de = (struct hack_dirent *)buf.dirent;
+                curr_offset = de->offset /* & 0x7fffffff */;
                 while (size > 0) {
                         if (filldir(dirent, de->name, de->namlen,
                                         curr_offset & 0x7fffffff,
diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c
index 37e116779eb1..5e8bb7f71b5a 100644
--- a/fs/xfs/linux-2.6/xfs_iops.c
+++ b/fs/xfs/linux-2.6/xfs_iops.c
@@ -332,9 +332,7 @@ xfs_vn_mknod(
                 ASSERT(vp);
                 ip = vn_to_inode(vp);
 
-                if (S_ISCHR(mode) || S_ISBLK(mode))
-                        ip->i_rdev = rdev;
-                else if (S_ISDIR(mode))
+                if (S_ISDIR(mode))
                         xfs_validate_fields(ip);
                 d_instantiate(dentry, ip);
                 xfs_validate_fields(dir);
diff --git a/include/linux/device-mapper.h b/include/linux/device-mapper.h
index b8b7c51389fe..e765e191663d 100644
--- a/include/linux/device-mapper.h
+++ b/include/linux/device-mapper.h
@@ -115,6 +115,7 @@ struct io_restrictions {
         unsigned short          max_hw_segments;
         unsigned short          hardsect_size;
         unsigned int            max_segment_size;
+        unsigned int            max_hw_sectors;
         unsigned long           seg_boundary_mask;
         unsigned long           bounce_pfn;
         unsigned char           no_cluster; /* inverted so that 0 is default */
diff --git a/kernel/panic.c b/kernel/panic.c
index 6f6e03e91595..da4d6bac270e 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -19,6 +19,7 @@
 #include <linux/nmi.h>
 #include <linux/kexec.h>
 #include <linux/debug_locks.h>
+#include <linux/random.h>
 
 int panic_on_oops;
 int tainted;
@@ -266,12 +267,29 @@ void oops_enter(void)
 }
 
 /*
+ * 64-bit random ID for oopses:
+ */
+static u64 oops_id;
+
+static int init_oops_id(void)
+{
+        if (!oops_id)
+                get_random_bytes(&oops_id, sizeof(oops_id));
+
+        return 0;
+}
+late_initcall(init_oops_id);
+
+/*
  * Called when the architecture exits its oops handler, after printing
  * everything.
  */
 void oops_exit(void)
 {
         do_oops_enter_exit();
+        init_oops_id();
+        printk(KERN_WARNING "---[ end trace %016llx ]---\n",
+                (unsigned long long)oops_id);
 }
 
 #ifdef CONFIG_CC_STACKPROTECTOR
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index ee9c8b6529e9..9ba3daa03475 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -208,6 +208,8 @@ move_one_task_rt(struct rq *this_rq, int this_cpu, struct rq *busiest,
 
 static void task_tick_rt(struct rq *rq, struct task_struct *p)
 {
+        update_curr_rt(rq);
+
         /*
          * RR tasks need a special form of timeslice management.
          * FIFO tasks have no timeslices.
diff --git a/mm/slub.c b/mm/slub.c
index b9f37cb0f2e6..3655ad359f03 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -172,7 +172,7 @@ static inline void ClearSlabDebug(struct page *page)
  * Mininum number of partial slabs. These will be left on the partial
  * lists even if they are empty. kmem_cache_shrink may reclaim them.
  */
-#define MIN_PARTIAL 2
+#define MIN_PARTIAL 5
 
 /*
  * Maximum number of desirable partial slabs.
@@ -1613,7 +1613,7 @@ checks_ok:
          * then add it.
          */
         if (unlikely(!prior))
-                add_partial(get_node(s, page_to_nid(page)), page);
+                add_partial_tail(get_node(s, page_to_nid(page)), page);
 
 out_unlock:
         slab_unlock(page);