3 files changed, 29 insertions, 13 deletions

diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 0cce28c4025b..33e2ca847a26 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -247,7 +247,7 @@ config ACPI_CUSTOM_DSDT_FILE
           Enter the full path name to the file wich includes the AmlCode declaration.
 
 config ACPI_BLACKLIST_YEAR
-        int "Disable ACPI for systems before Jan 1st this year" if X86
+        int "Disable ACPI for systems before Jan 1st this year" if X86_32
         default 0
         help
           enter a 4-digit year, eg. 2001 to disable ACPI by default
@@ -285,9 +285,8 @@ config ACPI_SYSTEM
           dump your ACPI DSDT table using /proc/acpi/dsdt.
 
 config X86_PM_TIMER
-        bool "Power Management Timer Support"
+        bool "Power Management Timer Support" if EMBEDDED
         depends on X86
-        depends on !X86_64
         default y
         help
           The Power Management Timer is available on all ACPI-capable,
@@ -298,9 +297,8 @@ config X86_PM_TIMER
           voltage scaling, unlike the commonly used Time Stamp Counter
           (TSC) timing source.
 
-          So, if you see messages like 'Losing too many ticks!' in the
-          kernel logs, and/or you are using this on a notebook which
-          does not yet have an HPET, you should say "Y" here.
+          You should nearly always say Y here because many modern
+          systems require this timer. 
 
 config ACPI_CONTAINER
         tristate "ACPI0004,PNP0A05 and PNP0A06 Container Driver (EXPERIMENTAL)"
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index c2490e270f1f..588e75ec1630 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -2173,15 +2173,17 @@ static int probe_si (struct sx_board *board)
         if ( IS_SI1_BOARD(board)) {
                 /* This should be an SI1 board, which has this
                    location writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10) {
                         func_exit ();
                         return 0; 
+                }
         } else {
                 /* This should be an SI2 board, which has the bottom
                    3 bits non-writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10) {
                         func_exit ();
                         return 0; 
+                }
         }
 
         /* Now we're pretty much convinced that there is an SI board here, 
@@ -2192,15 +2194,17 @@ static int probe_si (struct sx_board *board)
         if ( IS_SI1_BOARD(board)) {
                 /* This should be an SI1 board, which has this
                    location writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) != 0x10) {
                         func_exit();
                         return 0; 
+                }
         } else {
                 /* This should be an SI2 board, which has the bottom
                    3 bits non-writable... */
-                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10)
+                if (read_sx_byte (board, SI2_ISA_ID_BASE) == 0x10) {
                         func_exit ();
                         return 0; 
+                }
         }
 
         printheader ();
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index 930db398d107..9d9872347f56 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -89,6 +89,11 @@
 #define SD_MAX_RETRIES          5
 #define SD_PASSTHROUGH_RETRIES  1
 
+/*
+ * Size of the initial data buffer for mode and read capacity data
+ */
+#define SD_BUF_SIZE             512
+
 static void scsi_disk_release(struct kref *kref);
 
 struct scsi_disk {
@@ -1239,7 +1244,7 @@ sd_do_mode_sense(struct scsi_device *sdp, int dbd, int modepage,
 
 /*
  * read write protect setting, if possible - called only in sd_revalidate_disk()
- * called with buffer of length 512
+ * called with buffer of length SD_BUF_SIZE
  */
 static void
 sd_read_write_protect_flag(struct scsi_disk *sdkp, char *diskname,
@@ -1297,7 +1302,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, char *diskname,
 
 /*
  * sd_read_cache_type - called only from sd_revalidate_disk()
- * called with buffer of length 512
+ * called with buffer of length SD_BUF_SIZE
  */
 static void
 sd_read_cache_type(struct scsi_disk *sdkp, char *diskname,
@@ -1342,6 +1347,8 @@ sd_read_cache_type(struct scsi_disk *sdkp, char *diskname,
 
         /* Take headers and block descriptors into account */
         len += data.header_length + data.block_descriptor_length;
+        if (len > SD_BUF_SIZE)
+                goto bad_sense;
 
         /* Get the data */
         res = sd_do_mode_sense(sdp, dbd, modepage, buffer, len, &data, &sshdr);
@@ -1354,6 +1361,12 @@ sd_read_cache_type(struct scsi_disk *sdkp, char *diskname,
                 int ct = 0;
                 int offset = data.header_length + data.block_descriptor_length;
 
+                if (offset >= SD_BUF_SIZE - 2) {
+                        printk(KERN_ERR "%s: malformed MODE SENSE response",
+                                diskname);
+                        goto defaults;
+                }
+
                 if ((buffer[offset] & 0x3f) != modepage) {
                         printk(KERN_ERR "%s: got wrong page\n", diskname);
                         goto defaults;
@@ -1398,6 +1411,7 @@ defaults:
                diskname);
         sdkp->WCE = 0;
         sdkp->RCD = 0;
+        sdkp->DPOFUA = 0;
 }
 
 /**
@@ -1421,7 +1435,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
         if (!scsi_device_online(sdp))
                 goto out;
 
-        buffer = kmalloc(512, GFP_KERNEL | __GFP_DMA);
+        buffer = kmalloc(SD_BUF_SIZE, GFP_KERNEL | __GFP_DMA);
         if (!buffer) {
                 printk(KERN_WARNING "(sd_revalidate_disk:) Memory allocation "
                        "failure.\n");