Merge branch 'akpm' (Andrew's incoming - part two)

Says Andrew:

 "60 patches.  That's good enough for -rc1 I guess.  I have quite a lot
  of detritus to be rechecked, work through maintainers, etc.

 - most of the remains of MM
 - rtc
 - various misc
 - cgroups
 - memcg
 - cpusets
 - procfs
 - ipc
 - rapidio
 - sysctl
 - pps
 - w1
 - drivers/misc
 - aio"

* akpm: (60 commits)
  memcg: replace ss->id_lock with a rwlock
  aio: allocate kiocbs in batches
  drivers/misc/vmw_balloon.c: fix typo in code comment
  drivers/misc/vmw_balloon.c: determine page allocation flag can_sleep outside loop
  w1: disable irqs in critical section
  drivers/w1/w1_int.c: multiple masters used same init_name
  drivers/power/ds2780_battery.c: fix deadlock upon insertion and removal
  drivers/power/ds2780_battery.c: add a nolock function to w1 interface
  drivers/power/ds2780_battery.c: create central point for calling w1 interface
  w1: ds2760 and ds2780, use ida for id and ida_simple_get() to get it
  pps gpio client: add missing dependency
  pps: new client driver using GPIO
  pps: default echo function
  include/linux/dma-mapping.h: add dma_zalloc_coherent()
  sysctl: make CONFIG_SYSCTL_SYSCALL default to n
  sysctl: add support for poll()
  RapidIO: documentation update
  drivers/net/rionet.c: fix ethernet address macros for LE platforms
  RapidIO: fix potential null deref in rio_setup_device()
  RapidIO: add mport driver for Tsi721 bridge
  ...

7 files changed, 290 insertions, 89 deletions

diff --git a/fs/aio.c b/fs/aio.c
index 632b235f4fbe..78c514cfd212 100644
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -440,8 +440,6 @@ void exit_aio(struct mm_struct *mm)
 static struct kiocb *__aio_get_req(struct kioctx *ctx)
 {
         struct kiocb *req = NULL;
-        struct aio_ring *ring;
-        int okay = 0;
 
         req = kmem_cache_alloc(kiocb_cachep, GFP_KERNEL);
         if (unlikely(!req))
@@ -459,39 +457,114 @@ static struct kiocb *__aio_get_req(struct kioctx *ctx)
         INIT_LIST_HEAD(&req->ki_run_list);
         req->ki_eventfd = NULL;
 
-        /* Check if the completion queue has enough free space to
-         * accept an event from this io.
-         */
+        return req;
+}
+
+/*
+ * struct kiocb's are allocated in batches to reduce the number of
+ * times the ctx lock is acquired and released.
+ */
+#define KIOCB_BATCH_SIZE        32L
+struct kiocb_batch {
+        struct list_head head;
+        long count; /* number of requests left to allocate */
+};
+
+static void kiocb_batch_init(struct kiocb_batch *batch, long total)
+{
+        INIT_LIST_HEAD(&batch->head);
+        batch->count = total;
+}
+
+static void kiocb_batch_free(struct kiocb_batch *batch)
+{
+        struct kiocb *req, *n;
+
+        list_for_each_entry_safe(req, n, &batch->head, ki_batch) {
+                list_del(&req->ki_batch);
+                kmem_cache_free(kiocb_cachep, req);
+        }
+}
+
+/*
+ * Allocate a batch of kiocbs.  This avoids taking and dropping the
+ * context lock a lot during setup.
+ */
+static int kiocb_batch_refill(struct kioctx *ctx, struct kiocb_batch *batch)
+{
+        unsigned short allocated, to_alloc;
+        long avail;
+        bool called_fput = false;
+        struct kiocb *req, *n;
+        struct aio_ring *ring;
+
+        to_alloc = min(batch->count, KIOCB_BATCH_SIZE);
+        for (allocated = 0; allocated < to_alloc; allocated++) {
+                req = __aio_get_req(ctx);
+                if (!req)
+                        /* allocation failed, go with what we've got */
+                        break;
+                list_add(&req->ki_batch, &batch->head);
+        }
+
+        if (allocated == 0)
+                goto out;
+
+retry:
         spin_lock_irq(&ctx->ctx_lock);
-        ring = kmap_atomic(ctx->ring_info.ring_pages[0], KM_USER0);
-        if (ctx->reqs_active < aio_ring_avail(&ctx->ring_info, ring)) {
+        ring = kmap_atomic(ctx->ring_info.ring_pages[0]);
+
+        avail = aio_ring_avail(&ctx->ring_info, ring) - ctx->reqs_active;
+        BUG_ON(avail < 0);
+        if (avail == 0 && !called_fput) {
+                /*
+                 * Handle a potential starvation case.  It is possible that
+                 * we hold the last reference on a struct file, causing us
+                 * to delay the final fput to non-irq context.  In this case,
+                 * ctx->reqs_active is artificially high.  Calling the fput
+                 * routine here may free up a slot in the event completion
+                 * ring, allowing this allocation to succeed.
+                 */
+                kunmap_atomic(ring);
+                spin_unlock_irq(&ctx->ctx_lock);
+                aio_fput_routine(NULL);
+                called_fput = true;
+                goto retry;
+        }
+
+        if (avail < allocated) {
+                /* Trim back the number of requests. */
+                list_for_each_entry_safe(req, n, &batch->head, ki_batch) {
+                        list_del(&req->ki_batch);
+                        kmem_cache_free(kiocb_cachep, req);
+                        if (--allocated <= avail)
+                                break;
+                }
+        }
+
+        batch->count -= allocated;
+        list_for_each_entry(req, &batch->head, ki_batch) {
                 list_add(&req->ki_list, &ctx->active_reqs);
                 ctx->reqs_active++;
-                okay = 1;
         }
-        kunmap_atomic(ring, KM_USER0);
-        spin_unlock_irq(&ctx->ctx_lock);
 
-        if (!okay) {
-                kmem_cache_free(kiocb_cachep, req);
-                req = NULL;
-        }
+        kunmap_atomic(ring);
+        spin_unlock_irq(&ctx->ctx_lock);
 
-        return req;
+out:
+        return allocated;
 }
 
-static inline struct kiocb *aio_get_req(struct kioctx *ctx)
+static inline struct kiocb *aio_get_req(struct kioctx *ctx,
+                                        struct kiocb_batch *batch)
 {
         struct kiocb *req;
-        /* Handle a potential starvation case -- should be exceedingly rare as 
-         * requests will be stuck on fput_head only if the aio_fput_routine is 
-         * delayed and the requests were the last user of the struct file.
-         */
-        req = __aio_get_req(ctx);
-        if (unlikely(NULL == req)) {
-                aio_fput_routine(NULL);
-                req = __aio_get_req(ctx);
-        }
+
+        if (list_empty(&batch->head))
+                if (kiocb_batch_refill(ctx, batch) == 0)
+                        return NULL;
+        req = list_first_entry(&batch->head, struct kiocb, ki_batch);
+        list_del(&req->ki_batch);
         return req;
 }
 
@@ -1515,7 +1588,8 @@ static ssize_t aio_setup_iocb(struct kiocb *kiocb, bool compat)
 }
 
 static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
-                         struct iocb *iocb, bool compat)
+                         struct iocb *iocb, struct kiocb_batch *batch,
+                         bool compat)
 {
         struct kiocb *req;
         struct file *file;
@@ -1541,7 +1615,7 @@ static int io_submit_one(struct kioctx *ctx, struct iocb __user *user_iocb,
         if (unlikely(!file))
                 return -EBADF;
 
-        req = aio_get_req(ctx);         /* returns with 2 references to req */
+        req = aio_get_req(ctx, batch);  /* returns with 2 references to req */
         if (unlikely(!req)) {
                 fput(file);
                 return -EAGAIN;
@@ -1621,8 +1695,9 @@ long do_io_submit(aio_context_t ctx_id, long nr,
 {
         struct kioctx *ctx;
         long ret = 0;
-        int i;
+        int i = 0;
         struct blk_plug plug;
+        struct kiocb_batch batch;
 
         if (unlikely(nr < 0))
                 return -EINVAL;
@@ -1639,6 +1714,8 @@ long do_io_submit(aio_context_t ctx_id, long nr,
                 return -EINVAL;
         }
 
+        kiocb_batch_init(&batch, nr);
+
         blk_start_plug(&plug);
 
         /*
@@ -1659,12 +1736,13 @@ long do_io_submit(aio_context_t ctx_id, long nr,
                         break;
                 }
 
-                ret = io_submit_one(ctx, user_iocb, &tmp, compat);
+                ret = io_submit_one(ctx, user_iocb, &tmp, &batch, compat);
                 if (ret)
                         break;
         }
         blk_finish_plug(&plug);
 
+        kiocb_batch_free(&batch);
         put_ioctx(ctx);
         return i ? i : ret;
 }
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index dd0fdfc56d38..21ac5ee4b43f 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -795,7 +795,16 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
                          * might try to exec.  This is because the brk will
                          * follow the loader, and is not movable.  */
 #if defined(CONFIG_X86) || defined(CONFIG_ARM)
-                        load_bias = 0;
+                        /* Memory randomization might have been switched off
+                         * in runtime via sysctl.
+                         * If that is the case, retain the original non-zero
+                         * load_bias value in order to establish proper
+                         * non-randomized mappings.
+                         */
+                        if (current->flags & PF_RANDOMIZE)
+                                load_bias = 0;
+                        else
+                                load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 #else
                         load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 #endif
diff --git a/fs/hfs/btree.c b/fs/hfs/btree.c
index 3ebc437736fe..1cbdeea1db44 100644
--- a/fs/hfs/btree.c
+++ b/fs/hfs/btree.c
@@ -46,11 +46,26 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
         case HFS_EXT_CNID:
                 hfs_inode_read_fork(tree->inode, mdb->drXTExtRec, mdb->drXTFlSize,
                                     mdb->drXTFlSize, be32_to_cpu(mdb->drXTClpSiz));
+                if (HFS_I(tree->inode)->alloc_blocks >
+                                        HFS_I(tree->inode)->first_blocks) {
+                        printk(KERN_ERR "hfs: invalid btree extent records\n");
+                        unlock_new_inode(tree->inode);
+                        goto free_inode;
+                }
+
                 tree->inode->i_mapping->a_ops = &hfs_btree_aops;
                 break;
         case HFS_CAT_CNID:
                 hfs_inode_read_fork(tree->inode, mdb->drCTExtRec, mdb->drCTFlSize,
                                     mdb->drCTFlSize, be32_to_cpu(mdb->drCTClpSiz));
+
+                if (!HFS_I(tree->inode)->first_blocks) {
+                        printk(KERN_ERR "hfs: invalid btree extent records "
+                                                                "(0 size).\n");
+                        unlock_new_inode(tree->inode);
+                        goto free_inode;
+                }
+
                 tree->inode->i_mapping->a_ops = &hfs_btree_aops;
                 break;
         default:
@@ -59,11 +74,6 @@ struct hfs_btree *hfs_btree_open(struct super_block *sb, u32 id, btree_keycmp ke
         }
         unlock_new_inode(tree->inode);
 
-        if (!HFS_I(tree->inode)->first_blocks) {
-                printk(KERN_ERR "hfs: invalid btree extent records (0 size).\n");
-                goto free_inode;
-        }
-
         mapping = tree->inode->i_mapping;
         page = read_mapping_page(mapping, 0, NULL);
         if (IS_ERR(page))
diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
index 562adabef985..f950059525fc 100644
--- a/fs/isofs/inode.c
+++ b/fs/isofs/inode.c
@@ -20,6 +20,7 @@
 #include <linux/statfs.h>
 #include <linux/cdrom.h>
 #include <linux/parser.h>
+#include <linux/mpage.h>
 
 #include "isofs.h"
 #include "zisofs.h"
@@ -1148,7 +1149,13 @@ struct buffer_head *isofs_bread(struct inode *inode, sector_t block)
 
 static int isofs_readpage(struct file *file, struct page *page)
 {
-        return block_read_full_page(page,isofs_get_block);
+        return mpage_readpage(page, isofs_get_block);
+}
+
+static int isofs_readpages(struct file *file, struct address_space *mapping,
+                        struct list_head *pages, unsigned nr_pages)
+{
+        return mpage_readpages(mapping, pages, nr_pages, isofs_get_block);
 }
 
 static sector_t _isofs_bmap(struct address_space *mapping, sector_t block)
@@ -1158,6 +1165,7 @@ static sector_t _isofs_bmap(struct address_space *mapping, sector_t block)
 
 static const struct address_space_operations isofs_aops = {
         .readpage = isofs_readpage,
+        .readpages = isofs_readpages,
         .bmap = _isofs_bmap
 };
 
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 851ba3dcdc29..2db1bd3173b2 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -1652,12 +1652,46 @@ out:
         return error;
 }
 
+static int proc_pid_fd_link_getattr(struct vfsmount *mnt, struct dentry *dentry,
+                struct kstat *stat)
+{
+        struct inode *inode = dentry->d_inode;
+        struct task_struct *task = get_proc_task(inode);
+        int rc;
+
+        if (task == NULL)
+                return -ESRCH;
+
+        rc = -EACCES;
+        if (lock_trace(task))
+                goto out_task;
+
+        generic_fillattr(inode, stat);
+        unlock_trace(task);
+        rc = 0;
+out_task:
+        put_task_struct(task);
+        return rc;
+}
+
 static const struct inode_operations proc_pid_link_inode_operations = {
         .readlink       = proc_pid_readlink,
         .follow_link    = proc_pid_follow_link,
         .setattr        = proc_setattr,
 };
 
+static const struct inode_operations proc_fdinfo_link_inode_operations = {
+        .setattr        = proc_setattr,
+        .getattr        = proc_pid_fd_link_getattr,
+};
+
+static const struct inode_operations proc_fd_link_inode_operations = {
+        .readlink       = proc_pid_readlink,
+        .follow_link    = proc_pid_follow_link,
+        .setattr        = proc_setattr,
+        .getattr        = proc_pid_fd_link_getattr,
+};
+
 
 /* building an inode */
 
@@ -1889,49 +1923,61 @@ out:
 
 static int proc_fd_info(struct inode *inode, struct path *path, char *info)
 {
-        struct task_struct *task = get_proc_task(inode);
-        struct files_struct *files = NULL;
+        struct task_struct *task;
+        struct files_struct *files;
         struct file *file;
         int fd = proc_fd(inode);
+        int rc;
 
-        if (task) {
-                files = get_files_struct(task);
-                put_task_struct(task);
-        }
-        if (files) {
-                /*
-                 * We are not taking a ref to the file structure, so we must
-                 * hold ->file_lock.
-                 */
-                spin_lock(&files->file_lock);
-                file = fcheck_files(files, fd);
-                if (file) {
-                        unsigned int f_flags;
-                        struct fdtable *fdt;
-
-                        fdt = files_fdtable(files);
-                        f_flags = file->f_flags & ~O_CLOEXEC;
-                        if (FD_ISSET(fd, fdt->close_on_exec))
-                                f_flags |= O_CLOEXEC;
-
-                        if (path) {
-                                *path = file->f_path;
-                                path_get(&file->f_path);
-                        }
-                        if (info)
-                                snprintf(info, PROC_FDINFO_MAX,
-                                         "pos:\t%lli\n"
-                                         "flags:\t0%o\n",
-                                         (long long) file->f_pos,
-                                         f_flags);
-                        spin_unlock(&files->file_lock);
-                        put_files_struct(files);
-                        return 0;
+        task = get_proc_task(inode);
+        if (!task)
+                return -ENOENT;
+
+        rc = -EACCES;
+        if (lock_trace(task))
+                goto out_task;
+
+        rc = -ENOENT;
+        files = get_files_struct(task);
+        if (files == NULL)
+                goto out_unlock;
+
+        /*
+         * We are not taking a ref to the file structure, so we must
+         * hold ->file_lock.
+         */
+        spin_lock(&files->file_lock);
+        file = fcheck_files(files, fd);
+        if (file) {
+                unsigned int f_flags;
+                struct fdtable *fdt;
+
+                fdt = files_fdtable(files);
+                f_flags = file->f_flags & ~O_CLOEXEC;
+                if (FD_ISSET(fd, fdt->close_on_exec))
+                        f_flags |= O_CLOEXEC;
+
+                if (path) {
+                        *path = file->f_path;
+                        path_get(&file->f_path);
                 }
-                spin_unlock(&files->file_lock);
-                put_files_struct(files);
-        }
-        return -ENOENT;
+                if (info)
+                        snprintf(info, PROC_FDINFO_MAX,
+                                 "pos:\t%lli\n"
+                                 "flags:\t0%o\n",
+                                 (long long) file->f_pos,
+                                 f_flags);
+                rc = 0;
+        } else
+                rc = -ENOENT;
+        spin_unlock(&files->file_lock);
+        put_files_struct(files);
+
+out_unlock:
+        unlock_trace(task);
+out_task:
+        put_task_struct(task);
+        return rc;
 }
 
 static int proc_fd_link(struct inode *inode, struct path *path)
@@ -2026,7 +2072,7 @@ static struct dentry *proc_fd_instantiate(struct inode *dir,
         spin_unlock(&files->file_lock);
         put_files_struct(files);
 
-        inode->i_op = &proc_pid_link_inode_operations;
+        inode->i_op = &proc_fd_link_inode_operations;
         inode->i_size = 64;
         ei->op.proc_get_link = proc_fd_link;
         d_set_d_op(dentry, &tid_fd_dentry_operations);
@@ -2058,7 +2104,12 @@ static struct dentry *proc_lookupfd_common(struct inode *dir,
         if (fd == ~0U)
                 goto out;
 
+        result = ERR_PTR(-EACCES);
+        if (lock_trace(task))
+                goto out;
+
         result = instantiate(dir, dentry, task, &fd);
+        unlock_trace(task);
 out:
         put_task_struct(task);
 out_no_task:
@@ -2078,23 +2129,28 @@ static int proc_readfd_common(struct file * filp, void * dirent,
         retval = -ENOENT;
         if (!p)
                 goto out_no_task;
+
+        retval = -EACCES;
+        if (lock_trace(p))
+                goto out;
+
         retval = 0;
 
         fd = filp->f_pos;
         switch (fd) {
                 case 0:
                         if (filldir(dirent, ".", 1, 0, inode->i_ino, DT_DIR) < 0)
-                                goto out;
+                                goto out_unlock;
                         filp->f_pos++;
                 case 1:
                         ino = parent_ino(dentry);
                         if (filldir(dirent, "..", 2, 1, ino, DT_DIR) < 0)
-                                goto out;
+                                goto out_unlock;
                         filp->f_pos++;
                 default:
                         files = get_files_struct(p);
                         if (!files)
-                                goto out;
+                                goto out_unlock;
                         rcu_read_lock();
                         for (fd = filp->f_pos-2;
                              fd < files_fdtable(files)->max_fds;
@@ -2118,6 +2174,9 @@ static int proc_readfd_common(struct file * filp, void * dirent,
                         rcu_read_unlock();
                         put_files_struct(files);
         }
+
+out_unlock:
+        unlock_trace(p);
 out:
         put_task_struct(p);
 out_no_task:
@@ -2195,6 +2254,7 @@ static struct dentry *proc_fdinfo_instantiate(struct inode *dir,
         ei->fd = fd;
         inode->i_mode = S_IFREG | S_IRUSR;
         inode->i_fop = &proc_fdinfo_file_operations;
+        inode->i_op = &proc_fdinfo_link_inode_operations;
         d_set_d_op(dentry, &tid_fd_dentry_operations);
         d_add(dentry, inode);
         /* Close the race of the process dying before we return the dentry */
diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c
index b44113279e30..a6b62173d4c3 100644
--- a/fs/proc/proc_sysctl.c
+++ b/fs/proc/proc_sysctl.c
@@ -3,6 +3,7 @@
  */
 #include <linux/init.h>
 #include <linux/sysctl.h>
+#include <linux/poll.h>
 #include <linux/proc_fs.h>
 #include <linux/security.h>
 #include <linux/namei.h>
@@ -14,6 +15,15 @@ static const struct inode_operations proc_sys_inode_operations;
 static const struct file_operations proc_sys_dir_file_operations;
 static const struct inode_operations proc_sys_dir_operations;
 
+void proc_sys_poll_notify(struct ctl_table_poll *poll)
+{
+        if (!poll)
+                return;
+
+        atomic_inc(&poll->event);
+        wake_up_interruptible(&poll->wait);
+}
+
 static struct inode *proc_sys_make_inode(struct super_block *sb,
                 struct ctl_table_header *head, struct ctl_table *table)
 {
@@ -176,6 +186,39 @@ static ssize_t proc_sys_write(struct file *filp, const char __user *buf,
         return proc_sys_call_handler(filp, (void __user *)buf, count, ppos, 1);
 }
 
+static int proc_sys_open(struct inode *inode, struct file *filp)
+{
+        struct ctl_table *table = PROC_I(inode)->sysctl_entry;
+
+        if (table->poll)
+                filp->private_data = proc_sys_poll_event(table->poll);
+
+        return 0;
+}
+
+static unsigned int proc_sys_poll(struct file *filp, poll_table *wait)
+{
+        struct inode *inode = filp->f_path.dentry->d_inode;
+        struct ctl_table *table = PROC_I(inode)->sysctl_entry;
+        unsigned long event = (unsigned long)filp->private_data;
+        unsigned int ret = DEFAULT_POLLMASK;
+
+        if (!table->proc_handler)
+                goto out;
+
+        if (!table->poll)
+                goto out;
+
+        poll_wait(filp, &table->poll->wait, wait);
+
+        if (event != atomic_read(&table->poll->event)) {
+                filp->private_data = proc_sys_poll_event(table->poll);
+                ret = POLLIN | POLLRDNORM | POLLERR | POLLPRI;
+        }
+
+out:
+        return ret;
+}
 
 static int proc_sys_fill_cache(struct file *filp, void *dirent,
                                 filldir_t filldir,
@@ -364,12 +407,15 @@ static int proc_sys_getattr(struct vfsmount *mnt, struct dentry *dentry, struct
 }
 
 static const struct file_operations proc_sys_file_operations = {
+        .open           = proc_sys_open,
+        .poll           = proc_sys_poll,
         .read           = proc_sys_read,
         .write          = proc_sys_write,
         .llseek         = default_llseek,
 };
 
 static const struct file_operations proc_sys_dir_file_operations = {
+        .read           = generic_read_dir,
         .readdir        = proc_sys_readdir,
         .llseek         = generic_file_llseek,
 };
diff --git a/fs/ramfs/inode.c b/fs/ramfs/inode.c
index eacb166fb259..462ceb38fec6 100644
--- a/fs/ramfs/inode.c
+++ b/fs/ramfs/inode.c
@@ -23,7 +23,6 @@
  * caches is sufficient.
  */
 
-#include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/pagemap.h>
 #include <linux/highmem.h>
@@ -288,14 +287,7 @@ static int __init init_ramfs_fs(void)
 {
         return register_filesystem(&ramfs_fs_type);
 }
-
-static void __exit exit_ramfs_fs(void)
-{
-        unregister_filesystem(&ramfs_fs_type);
-}
-
 module_init(init_ramfs_fs)
-module_exit(exit_ramfs_fs)
 
 int __init init_rootfs(void)
 {
@@ -311,5 +303,3 @@ int __init init_rootfs(void)
 
         return err;
 }
-
-MODULE_LICENSE("GPL");