30 files changed, 236 insertions, 125 deletions

diff --git a/arch/alpha/kernel/sys_titan.c b/arch/alpha/kernel/sys_titan.c
index 1d3c1398c428..52c91ccc1648 100644
--- a/arch/alpha/kernel/sys_titan.c
+++ b/arch/alpha/kernel/sys_titan.c
@@ -271,6 +271,19 @@ titan_dispatch_irqs(u64 mask)
  * Titan Family
  */
 static void __init
+titan_request_irq(unsigned int irq, irq_handler_t handler,
+                  unsigned long irqflags, const char *devname,
+                  void *dev_id)
+{
+        int err;
+        err = request_irq(irq, handler, irqflags, devname, dev_id);
+        if (err) {
+                printk("titan_request_irq for IRQ %d returned %d; ignoring\n",
+                       irq, err);
+        }
+}
+
+static void __init
 titan_late_init(void)
 {
         /*
@@ -278,15 +291,15 @@ titan_late_init(void)
          * all reported to the kernel as machine checks, so the handler
          * is a nop so it can be called to count the individual events.
          */
-        request_irq(63+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(63+16, titan_intr_nop, IRQF_DISABLED,
                     "CChip Error", NULL);
-        request_irq(62+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(62+16, titan_intr_nop, IRQF_DISABLED,
                     "PChip 0 H_Error", NULL);
-        request_irq(61+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(61+16, titan_intr_nop, IRQF_DISABLED,
                     "PChip 1 H_Error", NULL);
-        request_irq(60+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(60+16, titan_intr_nop, IRQF_DISABLED,
                     "PChip 0 C_Error", NULL);
-        request_irq(59+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(59+16, titan_intr_nop, IRQF_DISABLED,
                     "PChip 1 C_Error", NULL);
 
         /* 
@@ -345,9 +358,9 @@ privateer_init_pci(void)
          * Hook a couple of extra err interrupts that the
          * common titan code won't.
          */
-        request_irq(53+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(53+16, titan_intr_nop, IRQF_DISABLED,
                     "NMI", NULL);
-        request_irq(50+16, titan_intr_nop, IRQF_DISABLED,
+        titan_request_irq(50+16, titan_intr_nop, IRQF_DISABLED,
                     "Temperature Warning", NULL);
 
         /*
diff --git a/arch/blackfin/kernel/init_task.c b/arch/blackfin/kernel/init_task.c
index b45188f8512e..673c860ffc23 100644
--- a/arch/blackfin/kernel/init_task.c
+++ b/arch/blackfin/kernel/init_task.c
@@ -31,6 +31,7 @@
 #include <linux/module.h>
 #include <linux/init_task.h>
 #include <linux/mqueue.h>
+#include <linux/fs.h>
 
 static struct fs_struct init_fs = INIT_FS;
 static struct files_struct init_files = INIT_FILES;
diff --git a/arch/blackfin/kernel/process.c b/arch/blackfin/kernel/process.c
index 5a51dd6ab280..6a7aefe48346 100644
--- a/arch/blackfin/kernel/process.c
+++ b/arch/blackfin/kernel/process.c
@@ -33,6 +33,8 @@
 #include <linux/user.h>
 #include <linux/a.out.h>
 #include <linux/uaccess.h>
+#include <linux/fs.h>
+#include <linux/err.h>
 
 #include <asm/blackfin.h>
 #include <asm/fixed_code.h>
diff --git a/arch/blackfin/kernel/sys_bfin.c b/arch/blackfin/kernel/sys_bfin.c
index f5e1ae3d1705..abcd14817d0e 100644
--- a/arch/blackfin/kernel/sys_bfin.c
+++ b/arch/blackfin/kernel/sys_bfin.c
@@ -37,6 +37,7 @@
 #include <linux/syscalls.h>
 #include <linux/mman.h>
 #include <linux/file.h>
+#include <linux/fs.h>
 #include <linux/uaccess.h>
 #include <linux/ipc.h>
 #include <linux/unistd.h>
diff --git a/arch/blackfin/kernel/traps.c b/arch/blackfin/kernel/traps.c
index 8766bd612b47..792a8416fe10 100644
--- a/arch/blackfin/kernel/traps.c
+++ b/arch/blackfin/kernel/traps.c
@@ -31,6 +31,7 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/kallsyms.h>
+#include <linux/fs.h>
 #include <asm/traps.h>
 #include <asm/cacheflush.h>
 #include <asm/blackfin.h>
diff --git a/arch/cris/Kconfig b/arch/cris/Kconfig
index 4b41248b61ad..6b4d026a00a1 100644
--- a/arch/cris/Kconfig
+++ b/arch/cris/Kconfig
@@ -180,8 +180,6 @@ source "drivers/isdn/Kconfig"
 
 source "drivers/telephony/Kconfig"
 
-source "drivers/cdrom/Kconfig"
-
 #
 # input before char - char/joystick depends on it. As does USB.
 #
diff --git a/arch/frv/kernel/entry.S b/arch/frv/kernel/entry.S
index 275673c192aa..1e74f3c5cee2 100644
--- a/arch/frv/kernel/entry.S
+++ b/arch/frv/kernel/entry.S
@@ -1496,6 +1496,7 @@ sys_call_table:
         .long sys_signalfd
         .long sys_timerfd
         .long sys_eventfd
+        .long sys_fallocate
 
 
 syscall_table_size = (. - sys_call_table)
diff --git a/arch/i386/kernel/alternative.c b/arch/i386/kernel/alternative.c
index c85598acb8fd..1b66d5c70eaf 100644
--- a/arch/i386/kernel/alternative.c
+++ b/arch/i386/kernel/alternative.c
@@ -11,6 +11,8 @@
 #include <asm/mce.h>
 #include <asm/nmi.h>
 
+#define MAX_PATCH_LEN (255-1)
+
 #ifdef CONFIG_HOTPLUG_CPU
 static int smp_alt_once;
 
@@ -148,7 +150,8 @@ static unsigned char** find_nop_table(void)
 
 #endif /* CONFIG_X86_64 */
 
-static void nop_out(void *insns, unsigned int len)
+/* Use this to add nops to a buffer, then text_poke the whole buffer. */
+static void add_nops(void *insns, unsigned int len)
 {
         unsigned char **noptable = find_nop_table();
 
@@ -156,7 +159,7 @@ static void nop_out(void *insns, unsigned int len)
                 unsigned int noplen = len;
                 if (noplen > ASM_NOP_MAX)
                         noplen = ASM_NOP_MAX;
-                text_poke(insns, noptable[noplen], noplen);
+                memcpy(insns, noptable[noplen], noplen);
                 insns += noplen;
                 len -= noplen;
         }
@@ -174,15 +177,15 @@ extern u8 *__smp_locks[], *__smp_locks_end[];
 void apply_alternatives(struct alt_instr *start, struct alt_instr *end)
 {
         struct alt_instr *a;
-        u8 *instr;
-        int diff;
+        char insnbuf[MAX_PATCH_LEN];
 
         DPRINTK("%s: alt table %p -> %p\n", __FUNCTION__, start, end);
         for (a = start; a < end; a++) {
+                u8 *instr = a->instr;
                 BUG_ON(a->replacementlen > a->instrlen);
+                BUG_ON(a->instrlen > sizeof(insnbuf));
                 if (!boot_cpu_has(a->cpuid))
                         continue;
-                instr = a->instr;
 #ifdef CONFIG_X86_64
                 /* vsyscall code is not mapped yet. resolve it manually. */
                 if (instr >= (u8 *)VSYSCALL_START && instr < (u8*)VSYSCALL_END) {
@@ -191,9 +194,10 @@ void apply_alternatives(struct alt_instr *start, struct alt_instr *end)
                                 __FUNCTION__, a->instr, instr);
                 }
 #endif
-                memcpy(instr, a->replacement, a->replacementlen);
-                diff = a->instrlen - a->replacementlen;
-                nop_out(instr + a->replacementlen, diff);
+                memcpy(insnbuf, a->replacement, a->replacementlen);
+                add_nops(insnbuf + a->replacementlen,
+                         a->instrlen - a->replacementlen);
+                text_poke(instr, insnbuf, a->instrlen);
         }
 }
 
@@ -215,16 +219,18 @@ static void alternatives_smp_lock(u8 **start, u8 **end, u8 *text, u8 *text_end)
 static void alternatives_smp_unlock(u8 **start, u8 **end, u8 *text, u8 *text_end)
 {
         u8 **ptr;
+        char insn[1];
 
         if (noreplace_smp)
                 return;
 
+        add_nops(insn, 1);
         for (ptr = start; ptr < end; ptr++) {
                 if (*ptr < text)
                         continue;
                 if (*ptr > text_end)
                         continue;
-                nop_out(*ptr, 1);
+                text_poke(*ptr, insn, 1);
         };
 }
 
@@ -351,6 +357,7 @@ void apply_paravirt(struct paravirt_patch_site *start,
                     struct paravirt_patch_site *end)
 {
         struct paravirt_patch_site *p;
+        char insnbuf[MAX_PATCH_LEN];
 
         if (noreplace_paravirt)
                 return;
@@ -358,13 +365,15 @@ void apply_paravirt(struct paravirt_patch_site *start,
         for (p = start; p < end; p++) {
                 unsigned int used;
 
-                used = paravirt_ops.patch(p->instrtype, p->clobbers, p->instr,
-                                          p->len);
+                BUG_ON(p->len > MAX_PATCH_LEN);
+                used = paravirt_ops.patch(p->instrtype, p->clobbers, insnbuf,
+                                          (unsigned long)p->instr, p->len);
 
                 BUG_ON(used > p->len);
 
                 /* Pad the rest with nops */
-                nop_out(p->instr + used, p->len - used);
+                add_nops(insnbuf + used, p->len - used);
+                text_poke(p->instr, insnbuf, p->len);
         }
 }
 extern struct paravirt_patch_site __start_parainstructions[],
@@ -379,7 +388,7 @@ void __init alternative_instructions(void)
            that might execute the to be patched code.
            Other CPUs are not running. */
         stop_nmi();
-#ifdef CONFIG_MCE
+#ifdef CONFIG_X86_MCE
         stop_mce();
 #endif
 
@@ -417,7 +426,7 @@ void __init alternative_instructions(void)
         local_irq_restore(flags);
 
         restart_nmi();
-#ifdef CONFIG_MCE
+#ifdef CONFIG_X86_MCE
         restart_mce();
 #endif
 }
diff --git a/arch/i386/kernel/apic.c b/arch/i386/kernel/apic.c
index bfc6cb7df7e7..f9fff29e01a9 100644
--- a/arch/i386/kernel/apic.c
+++ b/arch/i386/kernel/apic.c
@@ -61,8 +61,9 @@ static int enable_local_apic __initdata = 0;
 
 /* Local APIC timer verification ok */
 static int local_apic_timer_verify_ok;
-/* Disable local APIC timer from the kernel commandline or via dmi quirk */
-static int local_apic_timer_disabled;
+/* Disable local APIC timer from the kernel commandline or via dmi quirk
+   or using CPU MSR check */
+int local_apic_timer_disabled;
 /* Local APIC timer works in C2 */
 int local_apic_timer_c2_ok;
 EXPORT_SYMBOL_GPL(local_apic_timer_c2_ok);
@@ -370,12 +371,9 @@ void __init setup_boot_APIC_clock(void)
         long delta, deltapm;
         int pm_referenced = 0;
 
-        if (boot_cpu_has(X86_FEATURE_LAPIC_TIMER_BROKEN))
-                local_apic_timer_disabled = 1;
-
         /*
          * The local apic timer can be disabled via the kernel
-         * commandline or from the test above. Register the lapic
+         * commandline or from the CPU detection code. Register the lapic
          * timer as a dummy clock event source on SMP systems, so the
          * broadcast mechanism is used. On UP systems simply ignore it.
          */
diff --git a/arch/i386/kernel/cpu/amd.c b/arch/i386/kernel/cpu/amd.c
index c7ba455d5ac7..dcf6bbb1c7c0 100644
--- a/arch/i386/kernel/cpu/amd.c
+++ b/arch/i386/kernel/cpu/amd.c
@@ -3,6 +3,7 @@
 #include <linux/mm.h>
 #include <asm/io.h>
 #include <asm/processor.h>
+#include <asm/apic.h>
 
 #include "cpu.h"
 
@@ -22,6 +23,7 @@
 extern void vide(void);
 __asm__(".align 4\nvide: ret");
 
+#ifdef CONFIG_X86_LOCAL_APIC
 #define ENABLE_C1E_MASK         0x18000000
 #define CPUID_PROCESSOR_SIGNATURE       1
 #define CPUID_XFAM              0x0ff00000
@@ -52,6 +54,7 @@ static __cpuinit int amd_apic_timer_broken(void)
         }
         return 0;
 }
+#endif
 
 int force_mwait __cpuinitdata;
 
@@ -282,8 +285,10 @@ static void __cpuinit init_amd(struct cpuinfo_x86 *c)
                         num_cache_leaves = 3;
         }
 
+#ifdef CONFIG_X86_LOCAL_APIC
         if (amd_apic_timer_broken())
-                set_bit(X86_FEATURE_LAPIC_TIMER_BROKEN, c->x86_capability);
+                local_apic_timer_disabled = 1;
+#endif
 
         if (c->x86 == 0x10 && !force_mwait)
                 clear_bit(X86_FEATURE_MWAIT, c->x86_capability);
diff --git a/arch/i386/kernel/doublefault.c b/arch/i386/kernel/doublefault.c
index 265c5597efb0..40978af630e7 100644
--- a/arch/i386/kernel/doublefault.c
+++ b/arch/i386/kernel/doublefault.c
@@ -13,7 +13,7 @@
 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
 #define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
 
-#define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + 0x1000000)
+#define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
 
 static void doublefault_fn(void)
 {
@@ -23,23 +23,23 @@ static void doublefault_fn(void)
         store_gdt(&gdt_desc);
         gdt = gdt_desc.address;
 
-        printk("double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
+        printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
 
         if (ptr_ok(gdt)) {
                 gdt += GDT_ENTRY_TSS << 3;
                 tss = *(u16 *)(gdt+2);
                 tss += *(u8 *)(gdt+4) << 16;
                 tss += *(u8 *)(gdt+7) << 24;
-                printk("double fault, tss at %08lx\n", tss);
+                printk(KERN_EMERG "double fault, tss at %08lx\n", tss);
 
                 if (ptr_ok(tss)) {
                         struct i386_hw_tss *t = (struct i386_hw_tss *)tss;
 
-                        printk("eip = %08lx, esp = %08lx\n", t->eip, t->esp);
+                        printk(KERN_EMERG "eip = %08lx, esp = %08lx\n", t->eip, t->esp);
 
-                        printk("eax = %08lx, ebx = %08lx, ecx = %08lx, edx = %08lx\n",
+                        printk(KERN_EMERG "eax = %08lx, ebx = %08lx, ecx = %08lx, edx = %08lx\n",
                                 t->eax, t->ebx, t->ecx, t->edx);
-                        printk("esi = %08lx, edi = %08lx\n",
+                        printk(KERN_EMERG "esi = %08lx, edi = %08lx\n",
                                 t->esi, t->edi);
                 }
         }
@@ -63,6 +63,7 @@ struct tss_struct doublefault_tss __cacheline_aligned = {
                 .cs             = __KERNEL_CS,
                 .ss             = __KERNEL_DS,
                 .ds             = __USER_DS,
+                .fs             = __KERNEL_PERCPU,
 
                 .__cr3          = __pa(swapper_pg_dir)
         }
diff --git a/arch/i386/kernel/head.S b/arch/i386/kernel/head.S
index 7c52b222207e..8f0382161c91 100644
--- a/arch/i386/kernel/head.S
+++ b/arch/i386/kernel/head.S
@@ -162,9 +162,7 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
  * which will be freed later
  */
 
-#ifdef CONFIG_HOTPLUG_CPU
-.section .text,"ax",@progbits
-#else
+#ifndef CONFIG_HOTPLUG_CPU
 .section .init.text,"ax",@progbits
 #endif
 
diff --git a/arch/i386/kernel/paravirt.c b/arch/i386/kernel/paravirt.c
index ea962c0667d5..739cfb207dd7 100644
--- a/arch/i386/kernel/paravirt.c
+++ b/arch/i386/kernel/paravirt.c
@@ -69,7 +69,8 @@ DEF_NATIVE(read_tsc, "rdtsc");
 
 DEF_NATIVE(ud2a, "ud2a");
 
-static unsigned native_patch(u8 type, u16 clobbers, void *insns, unsigned len)
+static unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
+                             unsigned long addr, unsigned len)
 {
         const unsigned char *start, *end;
         unsigned ret;
@@ -90,7 +91,7 @@ static unsigned native_patch(u8 type, u16 clobbers, void *insns, unsigned len)
 #undef SITE
 
         patch_site:
-                ret = paravirt_patch_insns(insns, len, start, end);
+                ret = paravirt_patch_insns(ibuf, len, start, end);
                 break;
 
         case PARAVIRT_PATCH(make_pgd):
@@ -107,7 +108,7 @@ static unsigned native_patch(u8 type, u16 clobbers, void *insns, unsigned len)
                 break;
 
         default:
-                ret = paravirt_patch_default(type, clobbers, insns, len);
+                ret = paravirt_patch_default(type, clobbers, ibuf, addr, len);
                 break;
         }
 
@@ -129,68 +130,67 @@ struct branch {
         u32 delta;
 } __attribute__((packed));
 
-unsigned paravirt_patch_call(void *target, u16 tgt_clobbers,
-                             void *site, u16 site_clobbers,
+unsigned paravirt_patch_call(void *insnbuf,
+                             const void *target, u16 tgt_clobbers,
+                             unsigned long addr, u16 site_clobbers,
                              unsigned len)
 {
-        unsigned char *call = site;
-        unsigned long delta = (unsigned long)target - (unsigned long)(call+5);
-        struct branch b;
+        struct branch *b = insnbuf;
+        unsigned long delta = (unsigned long)target - (addr+5);
 
         if (tgt_clobbers & ~site_clobbers)
                 return len;     /* target would clobber too much for this site */
         if (len < 5)
                 return len;     /* call too long for patch site */
 
-        b.opcode = 0xe8; /* call */
-        b.delta = delta;
-        BUILD_BUG_ON(sizeof(b) != 5);
-        text_poke(call, (unsigned char *)&b, 5);
+        b->opcode = 0xe8; /* call */
+        b->delta = delta;
+        BUILD_BUG_ON(sizeof(*b) != 5);
 
         return 5;
 }
 
-unsigned paravirt_patch_jmp(void *target, void *site, unsigned len)
+unsigned paravirt_patch_jmp(const void *target, void *insnbuf,
+                            unsigned long addr, unsigned len)
 {
-        unsigned char *jmp = site;
-        unsigned long delta = (unsigned long)target - (unsigned long)(jmp+5);
-        struct branch b;
+        struct branch *b = insnbuf;
+        unsigned long delta = (unsigned long)target - (addr+5);
 
         if (len < 5)
                 return len;     /* call too long for patch site */
 
-        b.opcode = 0xe9;        /* jmp */
-        b.delta = delta;
-        text_poke(jmp, (unsigned char *)&b, 5);
+        b->opcode = 0xe9;       /* jmp */
+        b->delta = delta;
 
         return 5;
 }
 
-unsigned paravirt_patch_default(u8 type, u16 clobbers, void *site, unsigned len)
+unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
+                                unsigned long addr, unsigned len)
 {
         void *opfunc = *((void **)&paravirt_ops + type);
         unsigned ret;
 
         if (opfunc == NULL)
                 /* If there's no function, patch it with a ud2a (BUG) */
-                ret = paravirt_patch_insns(site, len, start_ud2a, end_ud2a);
+                ret = paravirt_patch_insns(insnbuf, len, start_ud2a, end_ud2a);
         else if (opfunc == paravirt_nop)
                 /* If the operation is a nop, then nop the callsite */
                 ret = paravirt_patch_nop();
         else if (type == PARAVIRT_PATCH(iret) ||
                  type == PARAVIRT_PATCH(irq_enable_sysexit))
                 /* If operation requires a jmp, then jmp */
-                ret = paravirt_patch_jmp(opfunc, site, len);
+                ret = paravirt_patch_jmp(opfunc, insnbuf, addr, len);
         else
                 /* Otherwise call the function; assume target could
                    clobber any caller-save reg */
-                ret = paravirt_patch_call(opfunc, CLBR_ANY,
-                                          site, clobbers, len);
+                ret = paravirt_patch_call(insnbuf, opfunc, CLBR_ANY,
+                                          addr, clobbers, len);
 
         return ret;
 }
 
-unsigned paravirt_patch_insns(void *site, unsigned len,
+unsigned paravirt_patch_insns(void *insnbuf, unsigned len,
                               const char *start, const char *end)
 {
         unsigned insn_len = end - start;
@@ -198,7 +198,7 @@ unsigned paravirt_patch_insns(void *site, unsigned len,
         if (insn_len > len || start == NULL)
                 insn_len = len;
         else
-                memcpy(site, start, insn_len);
+                memcpy(insnbuf, start, insn_len);
 
         return insn_len;
 }
diff --git a/arch/i386/kernel/vmi.c b/arch/i386/kernel/vmi.c
index 72042bb7ec94..18673e0f193b 100644
--- a/arch/i386/kernel/vmi.c
+++ b/arch/i386/kernel/vmi.c
@@ -87,12 +87,14 @@ struct vmi_timer_ops vmi_timer_ops;
 #define IRQ_PATCH_INT_MASK 0
 #define IRQ_PATCH_DISABLE  5
 
-static inline void patch_offset(unsigned char *eip, unsigned char *dest)
+static inline void patch_offset(void *insnbuf,
+                                unsigned long eip, unsigned long dest)
 {
-        *(unsigned long *)(eip+1) = dest-eip-5;
+        *(unsigned long *)(insnbuf+1) = dest-eip-5;
 }
 
-static unsigned patch_internal(int call, unsigned len, void *insns)
+static unsigned patch_internal(int call, unsigned len, void *insnbuf,
+                               unsigned long eip)
 {
         u64 reloc;
         struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
@@ -100,14 +102,14 @@ static unsigned patch_internal(int call, unsigned len, void *insns)
         switch(rel->type) {
                 case VMI_RELOCATION_CALL_REL:
                         BUG_ON(len < 5);
-                        *(char *)insns = MNEM_CALL;
-                        patch_offset(insns, rel->eip);
+                        *(char *)insnbuf = MNEM_CALL;
+                        patch_offset(insnbuf, eip, (unsigned long)rel->eip);
                         return 5;
 
                 case VMI_RELOCATION_JUMP_REL:
                         BUG_ON(len < 5);
-                        *(char *)insns = MNEM_JMP;
-                        patch_offset(insns, rel->eip);
+                        *(char *)insnbuf = MNEM_JMP;
+                        patch_offset(insnbuf, eip, (unsigned long)rel->eip);
                         return 5;
 
                 case VMI_RELOCATION_NOP:
@@ -128,21 +130,26 @@ static unsigned patch_internal(int call, unsigned len, void *insns)
  * Apply patch if appropriate, return length of new instruction
  * sequence.  The callee does nop padding for us.
  */
-static unsigned vmi_patch(u8 type, u16 clobbers, void *insns, unsigned len)
+static unsigned vmi_patch(u8 type, u16 clobbers, void *insns,
+                          unsigned long eip, unsigned len)
 {
         switch (type) {
                 case PARAVIRT_PATCH(irq_disable):
-                        return patch_internal(VMI_CALL_DisableInterrupts, len, insns);
+                        return patch_internal(VMI_CALL_DisableInterrupts, len,
+                                              insns, eip);
                 case PARAVIRT_PATCH(irq_enable):
-                        return patch_internal(VMI_CALL_EnableInterrupts, len, insns);
+                        return patch_internal(VMI_CALL_EnableInterrupts, len,
+                                              insns, eip);
                 case PARAVIRT_PATCH(restore_fl):
-                        return patch_internal(VMI_CALL_SetInterruptMask, len, insns);
+                        return patch_internal(VMI_CALL_SetInterruptMask, len,
+                                              insns, eip);
                 case PARAVIRT_PATCH(save_fl):
-                        return patch_internal(VMI_CALL_GetInterruptMask, len, insns);
+                        return patch_internal(VMI_CALL_GetInterruptMask, len,
+                                              insns, eip);
                 case PARAVIRT_PATCH(iret):
-                        return patch_internal(VMI_CALL_IRET, len, insns);
+                        return patch_internal(VMI_CALL_IRET, len, insns, eip);
                 case PARAVIRT_PATCH(irq_enable_sysexit):
-                        return patch_internal(VMI_CALL_SYSEXIT, len, insns);
+                        return patch_internal(VMI_CALL_SYSEXIT, len, insns, eip);
                 default:
                         break;
         }
diff --git a/arch/i386/mm/pageattr.c b/arch/i386/mm/pageattr.c
index 8927222b3ab2..4241a74d16c8 100644
--- a/arch/i386/mm/pageattr.c
+++ b/arch/i386/mm/pageattr.c
@@ -82,7 +82,7 @@ static void flush_kernel_map(void *arg)
         struct page *p;
 
         /* High level code is not ready for clflush yet */
-        if (cpu_has_clflush) {
+        if (0 && cpu_has_clflush) {
                 list_for_each_entry (p, lh, lru)
                         cache_flush_page(p);
         } else if (boot_cpu_data.x86_model >= 4)
diff --git a/arch/i386/pci/common.c b/arch/i386/pci/common.c
index 85503deeda46..ebc6f3c66340 100644
--- a/arch/i386/pci/common.c
+++ b/arch/i386/pci/common.c
@@ -455,3 +455,26 @@ void pcibios_disable_device (struct pci_dev *dev)
         if (!dev->msi_enabled && pcibios_disable_irq)
                 pcibios_disable_irq(dev);
 }
+
+struct pci_bus *pci_scan_bus_with_sysdata(int busno)
+{
+        struct pci_bus *bus = NULL;
+        struct pci_sysdata *sd;
+
+        /*
+         * Allocate per-root-bus (not per bus) arch-specific data.
+         * TODO: leak; this memory is never freed.
+         * It's arguable whether it's worth the trouble to care.
+         */
+        sd = kzalloc(sizeof(*sd), GFP_KERNEL);
+        if (!sd) {
+                printk(KERN_ERR "PCI: OOM, skipping PCI bus %02x\n", busno);
+                return NULL;
+        }
+        sd->node = -1;
+        bus = pci_scan_bus(busno, &pci_root_ops, sd);
+        if (!bus)
+                kfree(sd);
+
+        return bus;
+}
diff --git a/arch/i386/pci/fixup.c b/arch/i386/pci/fixup.c
index e7306dbf6c42..c82cbf4c7226 100644
--- a/arch/i386/pci/fixup.c
+++ b/arch/i386/pci/fixup.c
@@ -25,9 +25,9 @@ static void __devinit pci_fixup_i450nx(struct pci_dev *d)
                 pci_read_config_byte(d, reg++, &subb);
                 DBG("i450NX PXB %d: %02x/%02x/%02x\n", pxb, busno, suba, subb);
                 if (busno)
-                        pci_scan_bus(busno, &pci_root_ops, NULL);       /* Bus A */
+                        pci_scan_bus_with_sysdata(busno);       /* Bus A */
                 if (suba < subb)
-                        pci_scan_bus(suba+1, &pci_root_ops, NULL);      /* Bus B */
+                        pci_scan_bus_with_sysdata(suba+1);      /* Bus B */
         }
         pcibios_last_bus = -1;
 }
@@ -42,7 +42,7 @@ static void __devinit pci_fixup_i450gx(struct pci_dev *d)
         u8 busno;
         pci_read_config_byte(d, 0x4a, &busno);
         printk(KERN_INFO "PCI: i440KX/GX host bridge %s: secondary bus %02x\n", pci_name(d), busno);
-        pci_scan_bus(busno, &pci_root_ops, NULL);
+        pci_scan_bus_with_sysdata(busno);
         pcibios_last_bus = -1;
 }
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82454GX, pci_fixup_i450gx);
diff --git a/arch/i386/pci/irq.c b/arch/i386/pci/irq.c
index f2cb942f8281..665db063a40a 100644
--- a/arch/i386/pci/irq.c
+++ b/arch/i386/pci/irq.c
@@ -138,8 +138,9 @@ static void __init pirq_peer_trick(void)
         for(i = 1; i < 256; i++) {
                 if (!busmap[i] || pci_find_bus(0, i))
                         continue;
-                if (pci_scan_bus(i, &pci_root_ops, NULL))
-                        printk(KERN_INFO "PCI: Discovered primary peer bus %02x [IRQ]\n", i);
+                if (pci_scan_bus_with_sysdata(i))
+                        printk(KERN_INFO "PCI: Discovered primary peer "
+                               "bus %02x [IRQ]\n", i);
         }
         pcibios_last_bus = -1;
 }
diff --git a/arch/i386/pci/legacy.c b/arch/i386/pci/legacy.c
index 149a9588c256..5565d7016b75 100644
--- a/arch/i386/pci/legacy.c
+++ b/arch/i386/pci/legacy.c
@@ -26,7 +26,7 @@ static void __devinit pcibios_fixup_peer_bridges(void)
                             l != 0x0000 && l != 0xffff) {
                                 DBG("Found device at %02x:%02x [%04x]\n", n, devfn, l);
                                 printk(KERN_INFO "PCI: Discovered peer bus %02x\n", n);
-                                pci_scan_bus(n, &pci_root_ops, NULL);
+                                pci_scan_bus_with_sysdata(n);
                                 break;
                         }
                 }
diff --git a/arch/i386/pci/mmconfig.c b/arch/i386/pci/mmconfig.c
index bb1afd9e589d..0d46b7a88b3b 100644
--- a/arch/i386/pci/mmconfig.c
+++ b/arch/i386/pci/mmconfig.c
@@ -82,16 +82,15 @@ static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
 
         switch (len) {
         case 1:
-                *value = readb(mmcfg_virt_addr + reg);
+                *value = mmio_config_readb(mmcfg_virt_addr + reg);
                 break;
         case 2:
-                *value = readw(mmcfg_virt_addr + reg);
+                *value = mmio_config_readw(mmcfg_virt_addr + reg);
                 break;
         case 4:
-                *value = readl(mmcfg_virt_addr + reg);
+                *value = mmio_config_readl(mmcfg_virt_addr + reg);
                 break;
         }
-
         spin_unlock_irqrestore(&pci_config_lock, flags);
 
         return 0;
@@ -116,16 +115,15 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
 
         switch (len) {
         case 1:
-                writeb(value, mmcfg_virt_addr + reg);
+                mmio_config_writeb(mmcfg_virt_addr, value);
                 break;
         case 2:
-                writew(value, mmcfg_virt_addr + reg);
+                mmio_config_writew(mmcfg_virt_addr, value);
                 break;
         case 4:
-                writel(value, mmcfg_virt_addr + reg);
+                mmio_config_writel(mmcfg_virt_addr, value);
                 break;
         }
-
         spin_unlock_irqrestore(&pci_config_lock, flags);
 
         return 0;
diff --git a/arch/i386/pci/numa.c b/arch/i386/pci/numa.c
index adbe17a38f6f..f5f165f69e0c 100644
--- a/arch/i386/pci/numa.c
+++ b/arch/i386/pci/numa.c
@@ -96,10 +96,14 @@ static void __devinit pci_fixup_i450nx(struct pci_dev *d)
                 pci_read_config_byte(d, reg++, &suba);
                 pci_read_config_byte(d, reg++, &subb);
                 DBG("i450NX PXB %d: %02x/%02x/%02x\n", pxb, busno, suba, subb);
-                if (busno)
-                        pci_scan_bus(QUADLOCAL2BUS(quad,busno), &pci_root_ops, NULL);   /* Bus A */
-                if (suba < subb)
-                        pci_scan_bus(QUADLOCAL2BUS(quad,suba+1), &pci_root_ops, NULL);  /* Bus B */
+                if (busno) {
+                        /* Bus A */
+                        pci_scan_bus_with_sysdata(QUADLOCAL2BUS(quad, busno));
+                }
+                if (suba < subb) {
+                        /* Bus B */
+                        pci_scan_bus_with_sysdata(QUADLOCAL2BUS(quad, suba+1));
+                }
         }
         pcibios_last_bus = -1;
 }
@@ -123,8 +127,7 @@ static int __init pci_numa_init(void)
                                 continue;
                         printk("Scanning PCI bus %d for quad %d\n", 
                                 QUADLOCAL2BUS(quad,0), quad);
-                        pci_scan_bus(QUADLOCAL2BUS(quad,0), 
-                                &pci_root_ops, NULL);
+                        pci_scan_bus_with_sysdata(QUADLOCAL2BUS(quad, 0));
                 }
         return 0;
 }
diff --git a/arch/i386/pci/pci.h b/arch/i386/pci/pci.h
index e58bae2076ad..8c66f275756f 100644
--- a/arch/i386/pci/pci.h
+++ b/arch/i386/pci/pci.h
@@ -104,3 +104,46 @@ extern DECLARE_BITMAP(pci_mmcfg_fallback_slots, 32*PCI_MMCFG_MAX_CHECK_BUS);
 extern int __init pci_mmcfg_arch_reachable(unsigned int seg, unsigned int bus,
                                            unsigned int devfn);
 extern int __init pci_mmcfg_arch_init(void);
+
+/*
+ * AMD Fam10h CPUs are buggy, and cannot access MMIO config space
+ * on their northbrige except through the * %eax register. As such, you MUST
+ * NOT use normal IOMEM accesses, you need to only use the magic mmio-config
+ * accessor functions.
+ * In fact just use pci_config_*, nothing else please.
+ */
+static inline unsigned char mmio_config_readb(void __iomem *pos)
+{
+        u8 val;
+        asm volatile("movb (%1),%%al" : "=a" (val) : "r" (pos));
+        return val;
+}
+
+static inline unsigned short mmio_config_readw(void __iomem *pos)
+{
+        u16 val;
+        asm volatile("movw (%1),%%ax" : "=a" (val) : "r" (pos));
+        return val;
+}
+
+static inline unsigned int mmio_config_readl(void __iomem *pos)
+{
+        u32 val;
+        asm volatile("movl (%1),%%eax" : "=a" (val) : "r" (pos));
+        return val;
+}
+
+static inline void mmio_config_writeb(void __iomem *pos, u8 val)
+{
+        asm volatile("movb %%al,(%1)" :: "a" (val), "r" (pos) : "memory");
+}
+
+static inline void mmio_config_writew(void __iomem *pos, u16 val)
+{
+        asm volatile("movw %%ax,(%1)" :: "a" (val), "r" (pos) : "memory");
+}
+
+static inline void mmio_config_writel(void __iomem *pos, u32 val)
+{
+        asm volatile("movl %%eax,(%1)" :: "a" (val), "r" (pos) : "memory");
+}
diff --git a/arch/i386/pci/visws.c b/arch/i386/pci/visws.c
index f1b486d4190b..8ecb1c722594 100644
--- a/arch/i386/pci/visws.c
+++ b/arch/i386/pci/visws.c
@@ -101,8 +101,8 @@ static int __init pcibios_init(void)
                 "bridge B (PIIX4) bus: %u\n", pci_bus1, pci_bus0);
 
         raw_pci_ops = &pci_direct_conf1;
-        pci_scan_bus(pci_bus0, &pci_root_ops, NULL);
-        pci_scan_bus(pci_bus1, &pci_root_ops, NULL);
+        pci_scan_bus_with_sysdata(pci_bus0);
+        pci_scan_bus_with_sysdata(pci_bus1);
         pci_fixup_irqs(visws_swizzle, visws_map_irq);
         pcibios_resource_survey();
         return 0;
diff --git a/arch/i386/xen/enlighten.c b/arch/i386/xen/enlighten.c
index 9a8c1181c001..f0c37511d8da 100644
--- a/arch/i386/xen/enlighten.c
+++ b/arch/i386/xen/enlighten.c
@@ -842,7 +842,8 @@ void __init xen_setup_vcpu_info_placement(void)
         }
 }
 
-static unsigned xen_patch(u8 type, u16 clobbers, void *insns, unsigned len)
+static unsigned xen_patch(u8 type, u16 clobbers, void *insnbuf,
+                          unsigned long addr, unsigned len)
 {
         char *start, *end, *reloc;
         unsigned ret;
@@ -869,7 +870,7 @@ static unsigned xen_patch(u8 type, u16 clobbers, void *insns, unsigned len)
                 if (start == NULL || (end-start) > len)
                         goto default_patch;
 
-                ret = paravirt_patch_insns(insns, len, start, end);
+                ret = paravirt_patch_insns(insnbuf, len, start, end);
 
                 /* Note: because reloc is assigned from something that
                    appears to be an array, gcc assumes it's non-null,
@@ -877,8 +878,8 @@ static unsigned xen_patch(u8 type, u16 clobbers, void *insns, unsigned len)
                    end. */
                 if (reloc > start && reloc < end) {
                         int reloc_off = reloc - start;
-                        long *relocp = (long *)(insns + reloc_off);
-                        long delta = start - (char *)insns;
+                        long *relocp = (long *)(insnbuf + reloc_off);
+                        long delta = start - (char *)addr;
 
                         *relocp += delta;
                 }
@@ -886,7 +887,8 @@ static unsigned xen_patch(u8 type, u16 clobbers, void *insns, unsigned len)
 
         default_patch:
         default:
-                ret = paravirt_patch_default(type, clobbers, insns, len);
+                ret = paravirt_patch_default(type, clobbers, insnbuf,
+                                             addr, len);
                 break;
         }
 
diff --git a/arch/x86_64/boot/compressed/head.S b/arch/x86_64/boot/compressed/head.S
index 1312bfaff306..9fd8030cc54f 100644
--- a/arch/x86_64/boot/compressed/head.S
+++ b/arch/x86_64/boot/compressed/head.S
@@ -195,6 +195,11 @@ ENTRY(startup_64)
         movl    %eax, %ds
         movl    %eax, %es
         movl    %eax, %ss
+        movl    %eax, %fs
+        movl    %eax, %gs
+        lldt    %ax
+        movl    $0x20, %eax
+        ltr     %ax
 
         /* Compute the decompressed kernel start address.  It is where
          * we were loaded at aligned to a 2M boundary. %rbp contains the
@@ -295,6 +300,8 @@ gdt:
         .quad   0x0000000000000000      /* NULL descriptor */
         .quad   0x00af9a000000ffff      /* __KERNEL_CS */
         .quad   0x00cf92000000ffff      /* __KERNEL_DS */
+        .quad   0x0080890000000000      /* TS descriptor */
+        .quad   0x0000000000000000      /* TS continued */
 gdt_end:
         .bss
 /* Stack for uncompression */
diff --git a/arch/x86_64/kernel/apic.c b/arch/x86_64/kernel/apic.c
index 900ff38d68de..925758dbca0c 100644
--- a/arch/x86_64/kernel/apic.c
+++ b/arch/x86_64/kernel/apic.c
@@ -791,10 +791,8 @@ static void setup_APIC_timer(unsigned int clocks)
 
         /* wait for irq slice */
         if (hpet_address && hpet_use_timer) {
-                int trigger = hpet_readl(HPET_T0_CMP);
-                while (hpet_readl(HPET_COUNTER) >= trigger)
-                        /* do nothing */ ;
-                while (hpet_readl(HPET_COUNTER) <  trigger)
+                u32 trigger = hpet_readl(HPET_T0_CMP);
+                while (hpet_readl(HPET_T0_CMP) == trigger)
                         /* do nothing */ ;
         } else {
                 int c1, c2;
diff --git a/arch/x86_64/kernel/pci-calgary.c b/arch/x86_64/kernel/pci-calgary.c
index ba16c968ca3f..71da01e73f03 100644
--- a/arch/x86_64/kernel/pci-calgary.c
+++ b/arch/x86_64/kernel/pci-calgary.c
@@ -367,16 +367,15 @@ static inline struct iommu_table *find_iommu_table(struct device *dev)
 
         pdev = to_pci_dev(dev);
 
-        /* is the device behind a bridge? */
-        if (unlikely(pdev->bus->parent))
-                pbus = pdev->bus->parent;
-        else
-                pbus = pdev->bus;
+        pbus = pdev->bus;
+
+        /* is the device behind a bridge? Look for the root bus */
+        while (pbus->parent)
+                pbus = pbus->parent;
 
         tbl = pci_iommu(pbus);
 
-        BUG_ON(pdev->bus->parent &&
-               (tbl->it_busno != pdev->bus->parent->number));
+        BUG_ON(tbl && (tbl->it_busno != pbus->number));
 
         return tbl;
 }
diff --git a/arch/x86_64/mm/pageattr.c b/arch/x86_64/mm/pageattr.c
index 7e161c698af4..10b9809ce821 100644
--- a/arch/x86_64/mm/pageattr.c
+++ b/arch/x86_64/mm/pageattr.c
@@ -75,7 +75,8 @@ static void flush_kernel_map(void *arg)
 
         /* When clflush is available always use it because it is
            much cheaper than WBINVD. */
-        if (!cpu_has_clflush)
+        /* clflush is still broken. Disable for now. */
+        if (1 || !cpu_has_clflush)
                 asm volatile("wbinvd" ::: "memory");
         else list_for_each_entry(pg, l, lru) {
                 void *adr = page_address(pg);
diff --git a/arch/x86_64/pci/mmconfig.c b/arch/x86_64/pci/mmconfig.c
index 65d82736987e..4095e4d66a1d 100644
--- a/arch/x86_64/pci/mmconfig.c
+++ b/arch/x86_64/pci/mmconfig.c
@@ -66,13 +66,13 @@ static int pci_mmcfg_read(unsigned int seg, unsigned int bus,
 
         switch (len) {
         case 1:
-                *value = readb(addr + reg);
+                *value = mmio_config_readb(addr + reg);
                 break;
         case 2:
-                *value = readw(addr + reg);
+                *value = mmio_config_readw(addr + reg);
                 break;
         case 4:
-                *value = readl(addr + reg);
+                *value = mmio_config_readl(addr + reg);
                 break;
         }
 
@@ -94,13 +94,13 @@ static int pci_mmcfg_write(unsigned int seg, unsigned int bus,
 
         switch (len) {
         case 1:
-                writeb(value, addr + reg);
+                mmio_config_writeb(addr + reg, value);
                 break;
         case 2:
-                writew(value, addr + reg);
+                mmio_config_writew(addr + reg, value);
                 break;
         case 4:
-                writel(value, addr + reg);
+                mmio_config_writel(addr + reg, value);
                 break;
         }
 
diff --git a/arch/x86_64/vdso/.gitignore b/arch/x86_64/vdso/.gitignore
new file mode 100644
index 000000000000..f8b69d84238e
--- /dev/null
+++ b/arch/x86_64/vdso/.gitignore
@@ -0,0 +1 @@
+vdso.lds