Merge branch 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'x86-mm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  x86: Ioremap: fix wrong physical address handling in PAT code
  x86, tlb: Clean up and correct used type
  x86, iomap: Fix wrong page aligned size calculation in ioremapping code
  x86, mm: Create symbolic index into address_markers array
  x86, ioremap: Fix normal ram range check
  x86, ioremap: Fix incorrect physical address handling in PAE mode
  x86-64, mm: Initialize VDSO earlier on 64 bits
  x86, kmmio/mmiotrace: Fix double free of kmmio_fault_pages

6 files changed, 69 insertions, 21 deletions

diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
index a725b7f760ae..0002a3a33081 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -37,6 +37,28 @@ struct addr_marker {
         const char *name;
 };
 
+/* indices for address_markers; keep sync'd w/ address_markers below */
+enum address_markers_idx {
+        USER_SPACE_NR = 0,
+#ifdef CONFIG_X86_64
+        KERNEL_SPACE_NR,
+        LOW_KERNEL_NR,
+        VMALLOC_START_NR,
+        VMEMMAP_START_NR,
+        HIGH_KERNEL_NR,
+        MODULES_VADDR_NR,
+        MODULES_END_NR,
+#else
+        KERNEL_SPACE_NR,
+        VMALLOC_START_NR,
+        VMALLOC_END_NR,
+# ifdef CONFIG_HIGHMEM
+        PKMAP_BASE_NR,
+# endif
+        FIXADDR_START_NR,
+#endif
+};
+
 /* Address space markers hints */
 static struct addr_marker address_markers[] = {
         { 0, "User Space" },
@@ -331,14 +353,12 @@ static int pt_dump_init(void)
 
 #ifdef CONFIG_X86_32
         /* Not a compile-time constant on x86-32 */
-        address_markers[2].start_address = VMALLOC_START;
-        address_markers[3].start_address = VMALLOC_END;
+        address_markers[VMALLOC_START_NR].start_address = VMALLOC_START;
+        address_markers[VMALLOC_END_NR].start_address = VMALLOC_END;
 # ifdef CONFIG_HIGHMEM
-        address_markers[4].start_address = PKMAP_BASE;
-        address_markers[5].start_address = FIXADDR_START;
-# else
-        address_markers[4].start_address = FIXADDR_START;
+        address_markers[PKMAP_BASE_NR].start_address = PKMAP_BASE;
 # endif
+        address_markers[FIXADDR_START_NR].start_address = FIXADDR_START;
 #endif
 
         pe = debugfs_create_file("kernel_page_tables", 0600, NULL, NULL,
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index 12e4d2d3c110..3ba6e0608c55 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -62,8 +62,8 @@ int ioremap_change_attr(unsigned long vaddr, unsigned long size,
 static void __iomem *__ioremap_caller(resource_size_t phys_addr,
                 unsigned long size, unsigned long prot_val, void *caller)
 {
-        unsigned long pfn, offset, vaddr;
-        resource_size_t last_addr;
+        unsigned long offset, vaddr;
+        resource_size_t pfn, last_pfn, last_addr;
         const resource_size_t unaligned_phys_addr = phys_addr;
         const unsigned long unaligned_size = size;
         struct vm_struct *area;
@@ -100,10 +100,8 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
         /*
          * Don't allow anybody to remap normal RAM that we're using..
          */
-        for (pfn = phys_addr >> PAGE_SHIFT;
-                                (pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
-                                pfn++) {
-
+        last_pfn = last_addr >> PAGE_SHIFT;
+        for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
                 int is_ram = page_is_ram(pfn);
 
                 if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
@@ -115,7 +113,7 @@ static void __iomem *__ioremap_caller(resource_size_t phys_addr,
          * Mappings have to be page-aligned
          */
         offset = phys_addr & ~PAGE_MASK;
-        phys_addr &= PAGE_MASK;
+        phys_addr &= PHYSICAL_PAGE_MASK;
         size = PAGE_ALIGN(last_addr+1) - phys_addr;
 
         retval = reserve_memtype(phys_addr, (u64)phys_addr + size,
@@ -613,7 +611,7 @@ void __init early_iounmap(void __iomem *addr, unsigned long size)
                 return;
         }
         offset = virt_addr & ~PAGE_MASK;
-        nrpages = PAGE_ALIGN(offset + size - 1) >> PAGE_SHIFT;
+        nrpages = PAGE_ALIGN(offset + size) >> PAGE_SHIFT;
 
         idx = FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*slot;
         while (nrpages > 0) {
diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
index 5d0e67fff1a6..e5d5e2ce9f77 100644
--- a/arch/x86/mm/kmmio.c
+++ b/arch/x86/mm/kmmio.c
@@ -45,6 +45,8 @@ struct kmmio_fault_page {
          * Protected by kmmio_lock, when linked into kmmio_page_table.
          */
         int count;
+
+        bool scheduled_for_release;
 };
 
 struct kmmio_delayed_release {
@@ -398,8 +400,11 @@ static void release_kmmio_fault_page(unsigned long page,
         BUG_ON(f->count < 0);
         if (!f->count) {
                 disarm_kmmio_fault_page(f);
-                f->release_next = *release_list;
-                *release_list = f;
+                if (!f->scheduled_for_release) {
+                        f->release_next = *release_list;
+                        *release_list = f;
+                        f->scheduled_for_release = true;
+                }
         }
 }
 
@@ -471,8 +476,10 @@ static void remove_kmmio_fault_pages(struct rcu_head *head)
                         prevp = &f->release_next;
                 } else {
                         *prevp = f->release_next;
+                        f->release_next = NULL;
+                        f->scheduled_for_release = false;
                 }
-                f = f->release_next;
+                f = *prevp;
         }
         spin_unlock_irqrestore(&kmmio_lock, flags);
 
@@ -510,6 +517,9 @@ void unregister_kmmio_probe(struct kmmio_probe *p)
         kmmio_count--;
         spin_unlock_irqrestore(&kmmio_lock, flags);
 
+        if (!release_list)
+                return;
+
         drelease = kmalloc(sizeof(*drelease), GFP_ATOMIC);
         if (!drelease) {
                 pr_crit("leaking kmmio_fault_page objects.\n");
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index 64121a18b8cb..f6ff57b7efa5 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -158,7 +158,7 @@ static unsigned long pat_x_mtrr_type(u64 start, u64 end, unsigned long req_type)
         return req_type;
 }
 
-static int pat_pagerange_is_ram(unsigned long start, unsigned long end)
+static int pat_pagerange_is_ram(resource_size_t start, resource_size_t end)
 {
         int ram_page = 0, not_rampage = 0;
         unsigned long page_nr;
diff --git a/arch/x86/mm/testmmiotrace.c b/arch/x86/mm/testmmiotrace.c
index 8565d944f7cf..38868adf07ea 100644
--- a/arch/x86/mm/testmmiotrace.c
+++ b/arch/x86/mm/testmmiotrace.c
@@ -90,6 +90,27 @@ static void do_test(unsigned long size)
         iounmap(p);
 }
 
+/*
+ * Tests how mmiotrace behaves in face of multiple ioremap / iounmaps in
+ * a short time. We had a bug in deferred freeing procedure which tried
+ * to free this region multiple times (ioremap can reuse the same address
+ * for many mappings).
+ */
+static void do_test_bulk_ioremapping(void)
+{
+        void __iomem *p;
+        int i;
+
+        for (i = 0; i < 10; ++i) {
+                p = ioremap_nocache(mmio_address, PAGE_SIZE);
+                if (p)
+                        iounmap(p);
+        }
+
+        /* Force freeing. If it will crash we will know why. */
+        synchronize_rcu();
+}
+
 static int __init init(void)
 {
         unsigned long size = (read_far) ? (8 << 20) : (16 << 10);
@@ -104,6 +125,7 @@ static int __init init(void)
                    "and writing 16 kB of rubbish in there.\n",
                    size >> 10, mmio_address);
         do_test(size);
+        do_test_bulk_ioremapping();
         pr_info("All done.\n");
         return 0;
 }
diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c
index 426f3a1a64d3..c03f14ab6667 100644
--- a/arch/x86/mm/tlb.c
+++ b/arch/x86/mm/tlb.c
@@ -278,11 +278,9 @@ void flush_tlb_page(struct vm_area_struct *vma, unsigned long va)
 
 static void do_flush_tlb_all(void *info)
 {
-        unsigned long cpu = smp_processor_id();
-
         __flush_tlb_all();
         if (percpu_read(cpu_tlbstate.state) == TLBSTATE_LAZY)
-                leave_mm(cpu);
+                leave_mm(smp_processor_id());
 }
 
 void flush_tlb_all(void)