Merge commit 'v2.6.27-rc7' into x86/microcode

12 files changed, 100 insertions, 58 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index e1d4764435ed..0b504814e378 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -394,7 +394,7 @@ config LOCKDEP
         bool
         depends on DEBUG_KERNEL && TRACE_IRQFLAGS_SUPPORT && STACKTRACE_SUPPORT && LOCKDEP_SUPPORT
         select STACKTRACE
-        select FRAME_POINTER if !X86 && !MIPS
+        select FRAME_POINTER if !X86 && !MIPS && !PPC
         select KALLSYMS
         select KALLSYMS_ALL
 
@@ -676,13 +676,13 @@ config FAULT_INJECTION_STACKTRACE_FILTER
         depends on FAULT_INJECTION_DEBUG_FS && STACKTRACE_SUPPORT
         depends on !X86_64
         select STACKTRACE
-        select FRAME_POINTER
+        select FRAME_POINTER if !PPC
         help
           Provide stacktrace filter for fault-injection capabilities
 
 config LATENCYTOP
         bool "Latency measuring infrastructure"
-        select FRAME_POINTER if !MIPS
+        select FRAME_POINTER if !MIPS && !PPC
         select KALLSYMS
         select KALLSYMS_ALL
         select STACKTRACE
@@ -693,6 +693,14 @@ config LATENCYTOP
           Enable this option if you want to use the LatencyTOP tool
           to find out which userspace is blocking on what kernel operations.
 
+config SYSCTL_SYSCALL_CHECK
+        bool "Sysctl checks"
+        depends on SYSCTL_SYSCALL
+        ---help---
+          sys_sysctl uses binary paths that have been found challenging
+          to properly maintain and use. This enables checks that help
+          you to keep things correct.
+
 source kernel/trace/Kconfig
 
 config PROVIDE_OHCI1394_DMA_INIT
@@ -735,6 +743,15 @@ config FIREWIRE_OHCI_REMOTE_DMA
 
           If unsure, say N.
 
+menuconfig BUILD_DOCSRC
+        bool "Build targets in Documentation/ tree"
+        depends on HEADERS_CHECK
+        help
+          This option attempts to build objects from the source files in the
+          kernel Documentation/ tree.
+
+          Say N if you are unsure.
+
 source "samples/Kconfig"
 
 source "lib/Kconfig.kgdb"
diff --git a/lib/Kconfig.kgdb b/lib/Kconfig.kgdb
index 2cfd2721f7ed..9b5d1d7f2ef7 100644
--- a/lib/Kconfig.kgdb
+++ b/lib/Kconfig.kgdb
@@ -4,14 +4,17 @@ config HAVE_ARCH_KGDB
 
 menuconfig KGDB
         bool "KGDB: kernel debugging with remote gdb"
-        select FRAME_POINTER
         depends on HAVE_ARCH_KGDB
         depends on DEBUG_KERNEL && EXPERIMENTAL
         help
           If you say Y here, it will be possible to remotely debug the
-          kernel using gdb.  Documentation of kernel debugger is available
-          at http://kgdb.sourceforge.net as well as in DocBook form
-          in Documentation/DocBook/.  If unsure, say N.
+          kernel using gdb.  It is recommended but not required, that
+          you also turn on the kernel config option
+          CONFIG_FRAME_POINTER to aid in producing more reliable stack
+          backtraces in the external debugger.  Documentation of
+          kernel debugger is available at http://kgdb.sourceforge.net
+          as well as in DocBook form in Documentation/DocBook/.  If
+          unsure, say N.
 
 if KGDB
 
diff --git a/lib/bitmap.c b/lib/bitmap.c
index 482df94ea21e..06fb57c86de0 100644
--- a/lib/bitmap.c
+++ b/lib/bitmap.c
@@ -316,6 +316,17 @@ int bitmap_scnprintf(char *buf, unsigned int buflen,
 EXPORT_SYMBOL(bitmap_scnprintf);
 
 /**
+ * bitmap_scnprintf_len - return buffer length needed to convert
+ * bitmap to an ASCII hex string
+ * @nr_bits: number of bits to be converted
+ */
+int bitmap_scnprintf_len(unsigned int nr_bits)
+{
+        unsigned int nr_nibbles = ALIGN(nr_bits, 4) / 4;
+        return nr_nibbles + ALIGN(nr_nibbles, CHUNKSZ / 4) / (CHUNKSZ / 4) - 1;
+}
+
+/**
  * __bitmap_parse - convert an ASCII hex string into a bitmap.
  * @buf: pointer to buffer containing string.
  * @buflen: buffer size in bytes.  If string is smaller than this
diff --git a/lib/debug_locks.c b/lib/debug_locks.c
index 0ef01d14727c..0218b4693dd8 100644
--- a/lib/debug_locks.c
+++ b/lib/debug_locks.c
@@ -8,6 +8,7 @@
  *
  *  Copyright (C) 2006 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
  */
+#include <linux/kernel.h>
 #include <linux/rwsem.h>
 #include <linux/mutex.h>
 #include <linux/module.h>
@@ -37,6 +38,7 @@ int debug_locks_off(void)
 {
         if (xchg(&debug_locks, 0)) {
                 if (!debug_locks_silent) {
+                        oops_in_progress = 1;
                         console_verbose();
                         return 1;
                 }
diff --git a/lib/debugobjects.c b/lib/debugobjects.c
index 45a6bde762d1..e3ab374e1334 100644
--- a/lib/debugobjects.c
+++ b/lib/debugobjects.c
@@ -112,6 +112,7 @@ static struct debug_obj *lookup_object(void *addr, struct debug_bucket *b)
 
 /*
  * Allocate a new object. If the pool is empty, switch off the debugger.
+ * Must be called with interrupts disabled.
  */
 static struct debug_obj *
 alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
@@ -148,17 +149,18 @@ alloc_object(void *addr, struct debug_bucket *b, struct debug_obj_descr *descr)
 static void free_object(struct debug_obj *obj)
 {
         unsigned long idx = (unsigned long)(obj - obj_static_pool);
+        unsigned long flags;
 
         if (obj_pool_free < ODEBUG_POOL_SIZE || idx < ODEBUG_POOL_SIZE) {
-                spin_lock(&pool_lock);
+                spin_lock_irqsave(&pool_lock, flags);
                 hlist_add_head(&obj->node, &obj_pool);
                 obj_pool_free++;
                 obj_pool_used--;
-                spin_unlock(&pool_lock);
+                spin_unlock_irqrestore(&pool_lock, flags);
         } else {
-                spin_lock(&pool_lock);
+                spin_lock_irqsave(&pool_lock, flags);
                 obj_pool_used--;
-                spin_unlock(&pool_lock);
+                spin_unlock_irqrestore(&pool_lock, flags);
                 kmem_cache_free(obj_cache, obj);
         }
 }
@@ -171,6 +173,7 @@ static void debug_objects_oom(void)
 {
         struct debug_bucket *db = obj_hash;
         struct hlist_node *node, *tmp;
+        HLIST_HEAD(freelist);
         struct debug_obj *obj;
         unsigned long flags;
         int i;
@@ -179,11 +182,14 @@ static void debug_objects_oom(void)
 
         for (i = 0; i < ODEBUG_HASH_SIZE; i++, db++) {
                 spin_lock_irqsave(&db->lock, flags);
-                hlist_for_each_entry_safe(obj, node, tmp, &db->list, node) {
+                hlist_move_list(&db->list, &freelist);
+                spin_unlock_irqrestore(&db->lock, flags);
+
+                /* Now free them */
+                hlist_for_each_entry_safe(obj, node, tmp, &freelist, node) {
                         hlist_del(&obj->node);
                         free_object(obj);
                 }
-                spin_unlock_irqrestore(&db->lock, flags);
         }
 }
 
@@ -498,8 +504,9 @@ void debug_object_free(void *addr, struct debug_obj_descr *descr)
                 return;
         default:
                 hlist_del(&obj->node);
+                spin_unlock_irqrestore(&db->lock, flags);
                 free_object(obj);
-                break;
+                return;
         }
 out_unlock:
         spin_unlock_irqrestore(&db->lock, flags);
@@ -510,6 +517,7 @@ static void __debug_check_no_obj_freed(const void *address, unsigned long size)
 {
         unsigned long flags, oaddr, saddr, eaddr, paddr, chunks;
         struct hlist_node *node, *tmp;
+        HLIST_HEAD(freelist);
         struct debug_obj_descr *descr;
         enum debug_obj_state state;
         struct debug_bucket *db;
@@ -545,11 +553,18 @@ repeat:
                                 goto repeat;
                         default:
                                 hlist_del(&obj->node);
-                                free_object(obj);
+                                hlist_add_head(&obj->node, &freelist);
                                 break;
                         }
                 }
                 spin_unlock_irqrestore(&db->lock, flags);
+
+                /* Now free them */
+                hlist_for_each_entry_safe(obj, node, tmp, &freelist, node) {
+                        hlist_del(&obj->node);
+                        free_object(obj);
+                }
+
                 if (cnt > debug_objects_maxchain)
                         debug_objects_maxchain = cnt;
         }
diff --git a/lib/iommu-helper.c b/lib/iommu-helper.c
index 889ddce2021e..a3b8d4c3f77a 100644
--- a/lib/iommu-helper.c
+++ b/lib/iommu-helper.c
@@ -80,11 +80,3 @@ void iommu_area_free(unsigned long *map, unsigned long start, unsigned int nr)
         }
 }
 EXPORT_SYMBOL(iommu_area_free);
-
-unsigned long iommu_num_pages(unsigned long addr, unsigned long len)
-{
-        unsigned long size = roundup((addr & ~PAGE_MASK) + len, PAGE_SIZE);
-
-        return size >> PAGE_SHIFT;
-}
-EXPORT_SYMBOL(iommu_num_pages);
diff --git a/lib/kobject.c b/lib/kobject.c
index bd732ffebc85..fbf0ae282376 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -223,8 +223,7 @@ static int kobject_set_name_vargs(struct kobject *kobj, const char *fmt,
                 return -ENOMEM;
 
         /* ewww... some of these buggers have '/' in the name ... */
-        s = strchr(kobj->name, '/');
-        if (s)
+        while ((s = strchr(kobj->name, '/')))
                 s[0] = '!';
 
         kfree(old_name);
diff --git a/lib/lmb.c b/lib/lmb.c
index 5d7b9286503e..97e547037084 100644
--- a/lib/lmb.c
+++ b/lib/lmb.c
@@ -462,6 +462,8 @@ void __init lmb_enforce_memory_limit(u64 memory_limit)
         if (lmb.memory.region[0].size < lmb.rmo_size)
                 lmb.rmo_size = lmb.memory.region[0].size;
 
+        memory_limit = lmb_end_of_DRAM();
+
         /* And truncate any reserves above the limit also. */
         for (i = 0; i < lmb.reserved.cnt; i++) {
                 p = &lmb.reserved.region[i];
diff --git a/lib/random32.c b/lib/random32.c
index ca87d86992bd..217d5c4b666d 100644
--- a/lib/random32.c
+++ b/lib/random32.c
@@ -56,23 +56,12 @@ static u32 __random32(struct rnd_state *state)
         return (state->s1 ^ state->s2 ^ state->s3);
 }
 
-static void __set_random32(struct rnd_state *state, unsigned long s)
+/*
+ * Handle minimum values for seeds
+ */
+static inline u32 __seed(u32 x, u32 m)
 {
-        if (s == 0)
-                s = 1;      /* default seed is 1 */
-
-#define LCG(n) (69069 * n)
-        state->s1 = LCG(s);
-        state->s2 = LCG(state->s1);
-        state->s3 = LCG(state->s2);
-
-        /* "warm it up" */
-        __random32(state);
-        __random32(state);
-        __random32(state);
-        __random32(state);
-        __random32(state);
-        __random32(state);
+        return (x < m) ? x + m : x;
 }
 
 /**
@@ -107,7 +96,7 @@ void srandom32(u32 entropy)
          */
         for_each_possible_cpu (i) {
                 struct rnd_state *state = &per_cpu(net_rand_state, i);
-                __set_random32(state, state->s1 ^ entropy);
+                state->s1 = __seed(state->s1 ^ entropy, 1);
         }
 }
 EXPORT_SYMBOL(srandom32);
@@ -122,7 +111,19 @@ static int __init random32_init(void)
 
         for_each_possible_cpu(i) {
                 struct rnd_state *state = &per_cpu(net_rand_state,i);
-                __set_random32(state, i + jiffies);
+
+#define LCG(x)  ((x) * 69069)   /* super-duper LCG */
+                state->s1 = __seed(LCG(i + jiffies), 1);
+                state->s2 = __seed(LCG(state->s1), 7);
+                state->s3 = __seed(LCG(state->s2), 15);
+
+                /* "warm it up" */
+                __random32(state);
+                __random32(state);
+                __random32(state);
+                __random32(state);
+                __random32(state);
+                __random32(state);
         }
         return 0;
 }
@@ -135,13 +136,18 @@ core_initcall(random32_init);
 static int __init random32_reseed(void)
 {
         int i;
-        unsigned long seed;
 
         for_each_possible_cpu(i) {
                 struct rnd_state *state = &per_cpu(net_rand_state,i);
+                u32 seeds[3];
+
+                get_random_bytes(&seeds, sizeof(seeds));
+                state->s1 = __seed(seeds[0], 1);
+                state->s2 = __seed(seeds[1], 7);
+                state->s3 = __seed(seeds[2], 15);
 
-                get_random_bytes(&seed, sizeof(seed));
-                __set_random32(state, seed);
+                /* mix it in */
+                __random32(state);
         }
         return 0;
 }
diff --git a/lib/scatterlist.c b/lib/scatterlist.c
index 876ba6d5b670..8d2688ff1352 100644
--- a/lib/scatterlist.c
+++ b/lib/scatterlist.c
@@ -422,9 +422,12 @@ static size_t sg_copy_buffer(struct scatterlist *sgl, unsigned int nents,
 {
         unsigned int offset = 0;
         struct sg_mapping_iter miter;
+        unsigned long flags;
 
         sg_miter_start(&miter, sgl, nents, SG_MITER_ATOMIC);
 
+        local_irq_save(flags);
+
         while (sg_miter_next(&miter) && offset < buflen) {
                 unsigned int len;
 
@@ -442,6 +445,7 @@ static size_t sg_copy_buffer(struct scatterlist *sgl, unsigned int nents,
 
         sg_miter_stop(&miter);
 
+        local_irq_restore(flags);
         return offset;
 }
 
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 977edbdbc1de..8826fdf0f180 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -491,7 +491,7 @@ swiotlb_alloc_coherent(struct device *hwdev, size_t size,
                  * the lowest available address range.
                  */
                 dma_addr_t handle;
-                handle = swiotlb_map_single(NULL, NULL, size, DMA_FROM_DEVICE);
+                handle = swiotlb_map_single(hwdev, NULL, size, DMA_FROM_DEVICE);
                 if (swiotlb_dma_mapping_error(hwdev, handle))
                         return NULL;
 
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 1dc2d1d18fa8..c399bc1093cb 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -27,6 +27,7 @@
 
 #include <asm/page.h>           /* for PAGE_SIZE */
 #include <asm/div64.h>
+#include <asm/sections.h>       /* for dereference_function_descriptor() */
 
 /* Works only for digits and letters, but small and fast */
 #define TOLOWER(x) ((x) | 0x20)
@@ -220,7 +221,7 @@ int strict_strtou##type(const char *cp, unsigned int base, valtype *res)\
         if (len == 0)                                                   \
                 return -EINVAL;                                         \
                                                                         \
-        val = simple_strtoul(cp, &tail, base);                          \
+        val = simple_strtou##type(cp, &tail, base);                     \
         if ((*tail == '\0') ||                                          \
                 ((len == (size_t)(tail - cp) + 1) && (*tail == '\n'))) {\
                 *res = val;                                             \
@@ -513,16 +514,6 @@ static char *string(char *buf, char *end, char *s, int field_width, int precisio
         return buf;
 }
 
-static inline void *dereference_function_descriptor(void *ptr)
-{
-#if defined(CONFIG_IA64) || defined(CONFIG_PPC64)
-        void *p;
-        if (!probe_kernel_address(ptr, p))
-                ptr = p;
-#endif
-        return ptr;
-}
-
 static char *symbol_string(char *buf, char *end, void *ptr, int field_width, int precision, int flags)
 {
         unsigned long value = (unsigned long) ptr;