15 files changed, 143 insertions, 177 deletions

diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index 7f6ddcb5d485..f8a535afce39 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -269,7 +269,7 @@ static void __init bootmem_init(void)
 
 static void __init bootmem_init(void)
 {
-        unsigned long init_begin, reserved_end;
+        unsigned long reserved_end;
         unsigned long mapstart = ~0UL;
         unsigned long bootmap_size;
         int i;
@@ -344,7 +344,6 @@ static void __init bootmem_init(void)
                                          min_low_pfn, max_low_pfn);
 
 
-        init_begin = PFN_UP(__pa_symbol(&__init_begin));
         for (i = 0; i < boot_mem_map.nr_map; i++) {
                 unsigned long start, end;
 
@@ -352,8 +351,8 @@ static void __init bootmem_init(void)
                 end = PFN_DOWN(boot_mem_map.map[i].addr
                                 + boot_mem_map.map[i].size);
 
-                if (start <= init_begin)
-                        start = init_begin;
+                if (start <= min_low_pfn)
+                        start = min_low_pfn;
                 if (start >= end)
                         continue;
 
diff --git a/arch/mips/lasat/image/Makefile b/arch/mips/lasat/image/Makefile
index 5332449ec040..460626b6d62f 100644
--- a/arch/mips/lasat/image/Makefile
+++ b/arch/mips/lasat/image/Makefile
@@ -12,11 +12,11 @@ endif
 
 MKLASATIMG = mklasatimg
 MKLASATIMG_ARCH = mq2,mqpro,sp100,sp200
-KERNEL_IMAGE = $(TOPDIR)/vmlinux
+KERNEL_IMAGE = vmlinux
 KERNEL_START = $(shell $(NM) $(KERNEL_IMAGE) | grep " _text" | cut -f1 -d\ )
 KERNEL_ENTRY = $(shell $(NM) $(KERNEL_IMAGE) | grep kernel_entry | cut -f1 -d\ )
 
-LDSCRIPT= -L$(obj) -Tromscript.normal
+LDSCRIPT= -L$(srctree)/$(src) -Tromscript.normal
 
 HEAD_DEFINES := -D_kernel_start=0x$(KERNEL_START) \
                 -D_kernel_entry=0x$(KERNEL_ENTRY) \
@@ -24,7 +24,7 @@ HEAD_DEFINES := -D_kernel_start=0x$(KERNEL_START) \
                 -D TIMESTAMP=$(shell date +%s)
 
 $(obj)/head.o: $(obj)/head.S $(KERNEL_IMAGE)
-        $(CC) -fno-pic $(HEAD_DEFINES) -I$(TOPDIR)/include -c -o $@ $<
+        $(CC) -fno-pic $(HEAD_DEFINES) $(LINUXINCLUDE) -c -o $@ $<
 
 OBJECTS = head.o kImage.o
 
diff --git a/arch/mips/mips-boards/generic/memory.c b/arch/mips/mips-boards/generic/memory.c
index 2c5c27c8e86d..dc272c188233 100644
--- a/arch/mips/mips-boards/generic/memory.c
+++ b/arch/mips/mips-boards/generic/memory.c
@@ -169,7 +169,6 @@ void __init prom_meminit(void)
 
 void __init prom_free_prom_memory(void)
 {
-#if 0 /* for now ...  */
         unsigned long addr;
         int i;
 
@@ -181,5 +180,4 @@ void __init prom_free_prom_memory(void)
                 free_init_pages("prom memory",
                                 addr, addr + boot_mem_map.map[i].size);
         }
-#endif
 }
diff --git a/arch/mips/mips-boards/generic/reset.c b/arch/mips/mips-boards/generic/reset.c
index 7a1bb51f81ee..583d468d98a9 100644
--- a/arch/mips/mips-boards/generic/reset.c
+++ b/arch/mips/mips-boards/generic/reset.c
@@ -39,16 +39,18 @@ static void atlas_machine_power_off(void);
 
 static void mips_machine_restart(char *command)
 {
-        unsigned int __iomem *softres_reg = ioremap(SOFTRES_REG, sizeof(unsigned int));
+        unsigned int __iomem *softres_reg =
+                ioremap(SOFTRES_REG, sizeof(unsigned int));
 
-        writew(GORESET, softres_reg);
+        __raw_writel(GORESET, softres_reg);
 }
 
 static void mips_machine_halt(void)
 {
-        unsigned int __iomem *softres_reg = ioremap(SOFTRES_REG, sizeof(unsigned int));
+        unsigned int __iomem *softres_reg =
+                ioremap(SOFTRES_REG, sizeof(unsigned int));
 
-        writew(GORESET, softres_reg);
+        __raw_writel(GORESET, softres_reg);
 }
 
 #if defined(CONFIG_MIPS_ATLAS)
diff --git a/arch/mips/mm/dma-default.c b/arch/mips/mm/dma-default.c
index ae76795685cc..810535dd091b 100644
--- a/arch/mips/mm/dma-default.c
+++ b/arch/mips/mm/dma-default.c
@@ -45,7 +45,7 @@ static gfp_t massage_gfp_flags(const struct device *dev, gfp_t gfp)
         /* ignore region specifiers */
         gfp &= ~(__GFP_DMA | __GFP_DMA32 | __GFP_HIGHMEM);
 
-#ifdef CONFIG_ZONE_DMA32
+#ifdef CONFIG_ZONE_DMA
         if (dev == NULL)
                 gfp |= __GFP_DMA;
         else if (dev->coherent_dma_mask < DMA_BIT_MASK(24))
diff --git a/arch/mips/philips/pnx8550/common/time.c b/arch/mips/philips/pnx8550/common/time.c
index e818fd0f1584..6d494e0de3d9 100644
--- a/arch/mips/philips/pnx8550/common/time.c
+++ b/arch/mips/philips/pnx8550/common/time.c
@@ -22,7 +22,6 @@
 #include <linux/kernel_stat.h>
 #include <linux/spinlock.h>
 #include <linux/interrupt.h>
-#include <linux/module.h>
 
 #include <asm/bootinfo.h>
 #include <asm/cpu.h>
@@ -41,11 +40,60 @@ static cycle_t hpt_read(void)
         return read_c0_count2();
 }
 
+static struct clocksource pnx_clocksource = {
+        .name           = "pnx8xxx",
+        .rating         = 200,
+        .read           = hpt_read,
+        .flags          = CLOCK_SOURCE_IS_CONTINUOUS,
+};
+
 static void timer_ack(void)
 {
         write_c0_compare(cpj);
 }
 
+static irqreturn_t pnx8xxx_timer_interrupt(int irq, void *dev_id)
+{
+        struct clock_event_device *c = dev_id;
+
+        /* clear MATCH, signal the event */
+        c->event_handler(c);
+
+        return IRQ_HANDLED;
+}
+
+static struct irqaction pnx8xxx_timer_irq = {
+        .handler        = pnx8xxx_timer_interrupt,
+        .flags          = IRQF_DISABLED | IRQF_PERCPU,
+        .name           = "pnx8xxx_timer",
+};
+
+static irqreturn_t monotonic_interrupt(int irq, void *dev_id)
+{
+        /* Timer 2 clear interrupt */
+        write_c0_compare2(-1);
+        return IRQ_HANDLED;
+}
+
+static struct irqaction monotonic_irqaction = {
+        .handler = monotonic_interrupt,
+        .flags = IRQF_DISABLED,
+        .name = "Monotonic timer",
+};
+
+static int pnx8xxx_set_next_event(unsigned long delta,
+                                struct clock_event_device *evt)
+{
+        write_c0_compare(delta);
+        return 0;
+}
+
+static struct clock_event_device pnx8xxx_clockevent = {
+        .name           = "pnx8xxx_clockevent",
+        .features       = CLOCK_EVT_FEAT_ONESHOT,
+        .set_next_event = pnx8xxx_set_next_event,
+};
+
 /*
  * plat_time_init() - it does the following things:
  *
@@ -58,11 +106,34 @@ static void timer_ack(void)
 
 __init void plat_time_init(void)
 {
+        unsigned int             configPR;
         unsigned int             n;
         unsigned int             m;
         unsigned int             p;
         unsigned int             pow2p;
 
+        clockevents_register_device(&pnx8xxx_clockevent);
+        clocksource_register(&pnx_clocksource);
+
+        setup_irq(PNX8550_INT_TIMER1, &pnx8xxx_timer_irq);
+        setup_irq(PNX8550_INT_TIMER2, &monotonic_irqaction);
+
+        /* Timer 1 start */
+        configPR = read_c0_config7();
+        configPR &= ~0x00000008;
+        write_c0_config7(configPR);
+
+        /* Timer 2 start */
+        configPR = read_c0_config7();
+        configPR &= ~0x00000010;
+        write_c0_config7(configPR);
+
+        /* Timer 3 stop */
+        configPR = read_c0_config7();
+        configPR |= 0x00000020;
+        write_c0_config7(configPR);
+
+
         /* PLL0 sets MIPS clock (PLL1 <=> TM1, PLL6 <=> TM2, PLL5 <=> mem) */
         /* (but only if CLK_MIPS_CTL select value [bits 3:1] is 1:  FIXME) */
 
@@ -87,42 +158,6 @@ __init void plat_time_init(void)
         write_c0_count2(0);
         write_c0_compare2(0xffffffff);
 
-        clocksource_mips.read = hpt_read;
-        mips_timer_ack = timer_ack;
-}
-
-static irqreturn_t monotonic_interrupt(int irq, void *dev_id)
-{
-        /* Timer 2 clear interrupt */
-        write_c0_compare2(-1);
-        return IRQ_HANDLED;
 }
 
-static struct irqaction monotonic_irqaction = {
-        .handler = monotonic_interrupt,
-        .flags = IRQF_DISABLED,
-        .name = "Monotonic timer",
-};
 
-void __init plat_timer_setup(struct irqaction *irq)
-{
-        int configPR;
-
-        setup_irq(PNX8550_INT_TIMER1, irq);
-        setup_irq(PNX8550_INT_TIMER2, &monotonic_irqaction);
-
-        /* Timer 1 start */
-        configPR = read_c0_config7();
-        configPR &= ~0x00000008;
-        write_c0_config7(configPR);
-
-        /* Timer 2 start */
-        configPR = read_c0_config7();
-        configPR &= ~0x00000010;
-        write_c0_config7(configPR);
-
-        /* Timer 3 stop */
-        configPR = read_c0_config7();
-        configPR |= 0x00000020;
-        write_c0_config7(configPR);
-}
diff --git a/block/blktrace.c b/block/blktrace.c
index 498a0a54a6aa..9b4da4ae3c7d 100644
--- a/block/blktrace.c
+++ b/block/blktrace.c
@@ -25,7 +25,6 @@
 #include <linux/time.h>
 #include <asm/uaccess.h>
 
-static DEFINE_PER_CPU(unsigned long long, blk_trace_cpu_offset) = { 0, };
 static unsigned int blktrace_seq __read_mostly = 1;
 
 /*
@@ -41,7 +40,7 @@ static void trace_note(struct blk_trace *bt, pid_t pid, int action,
                 const int cpu = smp_processor_id();
 
                 t->magic = BLK_IO_TRACE_MAGIC | BLK_IO_TRACE_VERSION;
-                t->time = cpu_clock(cpu) - per_cpu(blk_trace_cpu_offset, cpu);
+                t->time = ktime_to_ns(ktime_get());
                 t->device = bt->dev;
                 t->action = action;
                 t->pid = pid;
@@ -159,7 +158,7 @@ void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
 
                 t->magic = BLK_IO_TRACE_MAGIC | BLK_IO_TRACE_VERSION;
                 t->sequence = ++(*sequence);
-                t->time = cpu_clock(cpu) - per_cpu(blk_trace_cpu_offset, cpu);
+                t->time = ktime_to_ns(ktime_get());
                 t->sector = sector;
                 t->bytes = bytes;
                 t->action = what;
@@ -179,7 +178,7 @@ void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
 EXPORT_SYMBOL_GPL(__blk_add_trace);
 
 static struct dentry *blk_tree_root;
-static struct mutex blk_tree_mutex;
+static DEFINE_MUTEX(blk_tree_mutex);
 static unsigned int root_users;
 
 static inline void blk_remove_root(void)
@@ -505,77 +504,3 @@ void blk_trace_shutdown(struct request_queue *q)
                 blk_trace_remove(q);
         }
 }
-
-/*
- * Average offset over two calls to cpu_clock() with a gettimeofday()
- * in the middle
- */
-static void blk_check_time(unsigned long long *t, int this_cpu)
-{
-        unsigned long long a, b;
-        struct timeval tv;
-
-        a = cpu_clock(this_cpu);
-        do_gettimeofday(&tv);
-        b = cpu_clock(this_cpu);
-
-        *t = tv.tv_sec * 1000000000 + tv.tv_usec * 1000;
-        *t -= (a + b) / 2;
-}
-
-/*
- * calibrate our inter-CPU timings
- */
-static void blk_trace_check_cpu_time(void *data)
-{
-        unsigned long long *t;
-        int this_cpu = get_cpu();
-
-        t = &per_cpu(blk_trace_cpu_offset, this_cpu);
-
-        /*
-         * Just call it twice, hopefully the second call will be cache hot
-         * and a little more precise
-         */
-        blk_check_time(t, this_cpu);
-        blk_check_time(t, this_cpu);
-
-        put_cpu();
-}
-
-static void blk_trace_set_ht_offsets(void)
-{
-#if defined(CONFIG_SCHED_SMT)
-        int cpu, i;
-
-        /*
-         * now make sure HT siblings have the same time offset
-         */
-        preempt_disable();
-        for_each_online_cpu(cpu) {
-                unsigned long long *cpu_off, *sibling_off;
-
-                for_each_cpu_mask(i, per_cpu(cpu_sibling_map, cpu)) {
-                        if (i == cpu)
-                                continue;
-
-                        cpu_off = &per_cpu(blk_trace_cpu_offset, cpu);
-                        sibling_off = &per_cpu(blk_trace_cpu_offset, i);
-                        *sibling_off = *cpu_off;
-                }
-        }
-        preempt_enable();
-#endif
-}
-
-static __init int blk_trace_init(void)
-{
-        mutex_init(&blk_tree_mutex);
-        on_each_cpu(blk_trace_check_cpu_time, NULL, 1, 1);
-        blk_trace_set_ht_offsets();
-
-        return 0;
-}
-
-module_init(blk_trace_init);
-
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 56e23042728a..b8af22e610df 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -610,7 +610,7 @@ static int loop_thread(void *data)
 static int loop_switch(struct loop_device *lo, struct file *file)
 {
         struct switch_request w;
-        struct bio *bio = bio_alloc(GFP_KERNEL, 1);
+        struct bio *bio = bio_alloc(GFP_KERNEL, 0);
         if (!bio)
                 return -ENOMEM;
         init_completion(&w.wait);
diff --git a/drivers/ide/ide-acpi.c b/drivers/ide/ide-acpi.c
index fe6768a7d658..899d56536e80 100644
--- a/drivers/ide/ide-acpi.c
+++ b/drivers/ide/ide-acpi.c
@@ -85,6 +85,8 @@ static const struct dmi_system_id ide_acpi_dmi_table[] = {
                         DMI_MATCH(DMI_BIOS_VERSION, "KAM1.60")
                 },
         },
+
+        { }     /* terminate list */
 };
 
 static int ide_acpi_blacklist(void)
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index a9eb1c516247..1707f98c322c 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -1504,9 +1504,12 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
         int ret, wbufsize, word_gap, words;
         const struct kvec *vec;
         unsigned long vec_seek;
+        unsigned long initial_adr;
+        int initial_len = len;
 
         wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
         adr += chip->start;
+        initial_adr = adr;
         cmd_adr = adr & ~(wbufsize-1);
 
         /* Let's determine this according to the interleave only once */
@@ -1519,7 +1522,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
                 return ret;
         }
 
-        XIP_INVAL_CACHED_RANGE(map, adr, len);
+        XIP_INVAL_CACHED_RANGE(map, initial_adr, initial_len);
         ENABLE_VPP(map);
         xip_disable(map, chip, cmd_adr);
 
@@ -1610,7 +1613,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
         chip->state = FL_WRITING;
 
         ret = INVAL_CACHE_AND_WAIT(map, chip, cmd_adr,
-                                   adr, len,
+                                   initial_adr, initial_len,
                                    chip->buffer_write_time);
         if (ret) {
                 map_write(map, CMD(0x70), cmd_adr);
diff --git a/drivers/video/ps3fb.c b/drivers/video/ps3fb.c
index b3128903d673..044a423a72cb 100644
--- a/drivers/video/ps3fb.c
+++ b/drivers/video/ps3fb.c
@@ -443,8 +443,6 @@ static int ps3fb_sync(struct fb_info *info, u32 frame)
         u32 ddr_line_length, xdr_line_length;
         u64 ddr_base, xdr_base;
 
-        acquire_console_sem();
-
         if (frame > par->num_frames - 1) {
                 dev_dbg(info->device, "%s: invalid frame number (%u)\n",
                         __func__, frame);
@@ -464,7 +462,6 @@ static int ps3fb_sync(struct fb_info *info, u32 frame)
                          xdr_line_length);
 
 out:
-        release_console_sem();
         return error;
 }
 
@@ -479,7 +476,10 @@ static int ps3fb_release(struct fb_info *info, int user)
         if (atomic_dec_and_test(&ps3fb.f_count)) {
                 if (atomic_read(&ps3fb.ext_flip)) {
                         atomic_set(&ps3fb.ext_flip, 0);
-                        ps3fb_sync(info, 0);    /* single buffer */
+                        if (!try_acquire_console_sem()) {
+                                ps3fb_sync(info, 0);    /* single buffer */
+                                release_console_sem();
+                        }
                 }
         }
         return 0;
@@ -865,7 +865,9 @@ static int ps3fb_ioctl(struct fb_info *info, unsigned int cmd,
                         break;
 
                 dev_dbg(info->device, "PS3FB_IOCTL_FSEL:%d\n", val);
+                acquire_console_sem();
                 retval = ps3fb_sync(info, val);
+                release_console_sem();
                 break;
 
         default:
@@ -885,7 +887,9 @@ static int ps3fbd(void *arg)
                 set_current_state(TASK_INTERRUPTIBLE);
                 if (ps3fb.is_kicked) {
                         ps3fb.is_kicked = 0;
+                        acquire_console_sem();
                         ps3fb_sync(info, 0);    /* single buffer */
+                        release_console_sem();
                 }
                 schedule();
         }
@@ -1234,12 +1238,6 @@ static int ps3fb_shutdown(struct ps3_system_bus_device *dev)
         ps3fb_flip_ctl(0, &ps3fb);      /* flip off */
         ps3fb.dinfo->irq.mask = 0;
 
-        if (info) {
-                unregister_framebuffer(info);
-                fb_dealloc_cmap(&info->cmap);
-                framebuffer_release(info);
-        }
-
         ps3av_register_flip_ctl(NULL, NULL);
         if (ps3fb.task) {
                 struct task_struct *task = ps3fb.task;
@@ -1250,6 +1248,12 @@ static int ps3fb_shutdown(struct ps3_system_bus_device *dev)
                 free_irq(ps3fb.irq_no, &dev->core);
                 ps3_irq_plug_destroy(ps3fb.irq_no);
         }
+        if (info) {
+                unregister_framebuffer(info);
+                fb_dealloc_cmap(&info->cmap);
+                framebuffer_release(info);
+                info = dev->core.driver_data = NULL;
+        }
         iounmap((u8 __iomem *)ps3fb.dinfo);
 
         status = lv1_gpu_context_free(ps3fb.context_handle);
diff --git a/fs/xfs/linux-2.6/xfs_file.c b/fs/xfs/linux-2.6/xfs_file.c
index 4847eb83fc18..21a1c2b1c5fc 100644
--- a/fs/xfs/linux-2.6/xfs_file.c
+++ b/fs/xfs/linux-2.6/xfs_file.c
@@ -261,9 +261,9 @@ xfs_file_readdir(
 #else
 
 struct hack_dirent {
-        int             namlen;
-        loff_t          offset;
         u64             ino;
+        loff_t          offset;
+        int             namlen;
         unsigned int    d_type;
         char            name[];
 };
@@ -285,8 +285,10 @@ xfs_hack_filldir(
 {
         struct hack_callback *buf = __buf;
         struct hack_dirent *de = (struct hack_dirent *)(buf->dirent + buf->used);
+        unsigned int reclen;
 
-        if (buf->used + sizeof(struct hack_dirent) + namlen > buf->len)
+        reclen = ALIGN(sizeof(struct hack_dirent) + namlen, sizeof(u64));
+        if (buf->used + reclen > buf->len)
                 return -EINVAL;
 
         de->namlen = namlen;
@@ -294,7 +296,7 @@ xfs_hack_filldir(
         de->ino = ino;
         de->d_type = d_type;
         memcpy(de->name, name, namlen);
-        buf->used += sizeof(struct hack_dirent) + namlen;
+        buf->used += reclen;
         return 0;
 }
 
@@ -334,7 +336,8 @@ xfs_file_readdir(
                 offset = filp->f_pos;
 
         while (!eof) {
-                int reclen;
+                unsigned int reclen;
+
                 start_offset = offset;
 
                 buf.used = 0;
@@ -355,7 +358,8 @@ xfs_file_readdir(
                                 goto done;
                         }
 
-                        reclen = sizeof(struct hack_dirent) + de->namlen;
+                        reclen = ALIGN(sizeof(struct hack_dirent) + de->namlen,
+                                       sizeof(u64));
                         size -= reclen;
                         de = (struct hack_dirent *)((char *)de + reclen);
                         curr_offset = de->offset /* & 0x7fffffff */;
diff --git a/include/asm-sh/cacheflush.h b/include/asm-sh/cacheflush.h
index 9d528ada3c14..e034c3604111 100644
--- a/include/asm-sh/cacheflush.h
+++ b/include/asm-sh/cacheflush.h
@@ -43,6 +43,12 @@ extern void __flush_purge_region(void *start, int size);
 extern void __flush_invalidate_region(void *start, int size);
 #endif
 
+#define ARCH_HAS_FLUSH_KERNEL_DCACHE_PAGE
+static inline void flush_kernel_dcache_page(struct page *page)
+{
+        flush_dcache_page(page);
+}
+
 #if defined(CONFIG_CPU_SH4) && !defined(CONFIG_CACHE_OFF)
 extern void copy_to_user_page(struct vm_area_struct *vma,
         struct page *page, unsigned long vaddr, void *dst, const void *src,
diff --git a/include/asm-sh/uaccess.h b/include/asm-sh/uaccess.h
index f18a1a5c95c0..77c391fa93d6 100644
--- a/include/asm-sh/uaccess.h
+++ b/include/asm-sh/uaccess.h
@@ -73,38 +73,26 @@ static inline int __access_ok(unsigned long addr, unsigned long size)
 /*
  * __access_ok: Check if address with size is OK or not.
  *
- * We do three checks:
- * (1) is it user space?
- * (2) addr + size --> carry?
- * (3) addr + size >= 0x80000000  (PAGE_OFFSET)
+ * Uhhuh, this needs 33-bit arithmetic. We have a carry..
  *
- * (1) (2) (3) | RESULT
- *  0   0   0  |  ok
- *  0   0   1  |  ok
- *  0   1   0  |  bad
- *  0   1   1  |  bad
- *  1   0   0  |  ok
- *  1   0   1  |  bad
- *  1   1   0  |  bad
- *  1   1   1  |  bad
+ * sum := addr + size;  carry? --> flag = true;
+ * if (sum >= addr_limit) flag = true;
  */
 static inline int __access_ok(unsigned long addr, unsigned long size)
 {
-        unsigned long flag, tmp;
-
-        __asm__("stc    r7_bank, %0\n\t"
-                "mov.l  @(8,%0), %0\n\t"
-                "clrt\n\t"
-                "addc   %2, %1\n\t"
-                "and    %1, %0\n\t"
-                "rotcl  %0\n\t"
-                "rotcl  %0\n\t"
-                "and    #3, %0"
-                : "=&z" (flag), "=r" (tmp)
-                : "r" (addr), "1" (size)
-                : "t");
-
+        unsigned long flag, sum;
+
+        __asm__("clrt\n\t"
+                "addc   %3, %1\n\t"
+                "movt   %0\n\t"
+                "cmp/hi %4, %1\n\t"
+                "rotcl  %0"
+                :"=&r" (flag), "=r" (sum)
+                :"1" (addr), "r" (size),
+                 "r" (current_thread_info()->addr_limit.seg)
+                :"t");
         return flag == 0;
+
 }
 #endif /* CONFIG_MMU */
 
diff --git a/include/linux/scatterlist.h b/include/linux/scatterlist.h
index 416e000dfe81..e3ff21dbac53 100644
--- a/include/linux/scatterlist.h
+++ b/include/linux/scatterlist.h
@@ -191,8 +191,8 @@ static inline void sg_chain(struct scatterlist *prv, unsigned int prv_nents,
         /*
          * offset and length are unused for chain entry.  Clear them.
          */
-        prv->offset = 0;
-        prv->length = 0;
+        prv[prv_nents - 1].offset = 0;
+        prv[prv_nents - 1].length = 0;
 
         /*
          * Set lowest bit to indicate a link pointer, and make sure to clear