mm/slab.c's offlab_limit logic is totally broken.

Firstly, "offslab_limit" is a global variable while it should either be
calculated in situ or should be passed in as a parameter.

Secondly, the more serious problem with it is that the condition for
calculating it:

               if (!(OFF_SLAB(sizes->cs_cachep))) {
                       offslab_limit = sizes->cs_size - sizeof(struct slab);
                       offslab_limit /= sizeof(kmem_bufctl_t);

is in total disconnect with the condition that makes use of it:

               /* More than offslab_limit objects will cause problems */
               if ((flags & CFLGS_OFF_SLAB) && num > offslab_limit)
                       break;

but due to offslab_limit being a global variable this breakage was
hidden.

Up until lockdep came along and perturbed the slab sizes sufficiently so
that the first off-slab cache would still see a (non-calculated) zero
value for offslab_limit and would panic with:

  kmem_cache_create: couldn't create cache size-512.

  Call Trace:
   [<ffffffff8020a5b9>] show_trace+0x96/0x1c8
   [<ffffffff8020a8f0>] dump_stack+0x13/0x15
   [<ffffffff8022994f>] panic+0x39/0x21a
   [<ffffffff80270814>] kmem_cache_create+0x5a0/0x5d0
   [<ffffffff80aced62>] kmem_cache_init+0x193/0x379
   [<ffffffff80abf779>] start_kernel+0x17f/0x218
   [<ffffffff80abf263>] _sinittext+0x263/0x26a

  Kernel panic - not syncing: kmem_cache_create(): failed to create slab `size-512'

Paolo Ornati's config on x86_64 managed to trigger it.

The fix is to move the calculation to the place that makes use of it.
This also makes slab.o 54 bytes smaller.

Btw., the check itself is quite silly. Its intention is to test whether
the number of objects per slab would be higher than the number of slab
control pointers possible. In theory it could be triggered: if someone
tried to allocate 4-byte objects cache and explicitly requested with
CFLGS_OFF_SLAB. So i kept the check.

Out of historic interest i checked how old this bug was and it's
ancient, 10 years old! It is the oldest hidden and then truly triggering
bugs i ever saw being fixed in the kernel!
Signed-off-by: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

Now that we select busy_rr for possible service, insert entries at the
back of that list instead of at the front.
Signed-off-by: Jens Axboe <axboe@suse.de>

There's a small window from when the timer is entered and we grab
the queue lock, where cfq_set_active_queue() could be rearming the
timer for us. Seen in the wild on a 12-way ppc box. Fix this by
just using mod_timer(), which will do the right thing for us.
Signed-off-by: Jens Axboe <axboe@suse.de>

If the hardware is doing real queueing, decide that it's worthless to
idle the hardware. It does reasonable simultaneous io in that case
anyways, and the idling hurts some work loads.
Signed-off-by: Jens Axboe <axboe@suse.de>

If we are anticipating a sync request from this process and we are
waiting for that and see an async request come in, expire that slice
and move on.
Signed-off-by: Jens Axboe <axboe@suse.de>

For just one busy queue (like async write out), we often overlooked
that we could queue more io and decided we were idle instead. This causes
us quite a bit of performance loss.
Signed-off-by: Jens Axboe <axboe@suse.de>

* 'upstream' of git://ftp.linux-mips.org/pub/scm/upstream-linus:
  [MIPS] Treat R14000 like R10000.
  [MIPS] Remove EXPERIMENTAL from PAGE_SIZE_16KB
  [MIPS] Update/Fix instruction definitions
  [MIPS] DSP and MDMX share the same config flag bit.
  [MIPS] Fix deadlock on MP with cache aliases.
  [MIPS] Use generic STABS_DEBUG macro.
  [MIPS] Create consistency in "system type" selection.
  [MIPS] Use generic DWARF_DEBUG
  [MIPS] Fix kgdb exception handler from user mode.
  [MIPS] Update struct sigcontext member names
  [MIPS] Update/fix futex assembly
  [MIPS] Remove support for sysmips(2) SETNAME and MIPS_RDNVRAM operations.
  [MIPS] Fix detection and handling of the 74K processor.
  [MIPS] Add missing 34K processor IDs
  [MIPS] Fix marking buddy of pte global for MIPS32 w/36-bit physical address
  [MIPS] AU1xxx mips_timer_interrupt() fixes
  [MIPS] Fix typo

Signed-off-by: Joshua Kinard <kumba@gentoo.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
This is known to be working fine for a while.  While at it also update
and fix the help texts.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
A small bugfix for up to now unused instruction definitions, and a
somewhat larger update to cover MIPS32R2 instructions.
Signed-off-by: Thiemo Seufer <ths@networkno.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
Clarify comment.
Signed-off-by: Thiemo Seufer <ths@networkno.de>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

A proper fix would involve introducing the notion of shared caches but
at this stage of 2.6.17 that's going to be too intrusive and not needed
for current hardware; aside I think some discussion will be needed.

So for now on the affected SMP configurations which happen to suffer from
cache aliases we make use of the fact that a single cache will be shared
by all processors.  This solves the deadlock issue and will improve
performance by getting rid of the smp_call_function overhead.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
The "system type" Kconfig options on MIPS are not consistent.  For
some platforms, only the name is listed while other entries are
prepended with "Support for".  Remove this as it doesn't make sense
when describing the "system type".
Signed-off-by: Martin Michlmayr <tbm@cyrius.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
When debugging a kernel compiled by gcc 4.1 with gdb 6.4, gdb could
not show filename, linenumber, etc.  It seems fixed if I used generic
DWARF_DEBUG macro.  Although gcc 3.x seems work without this change,
it would be better to use the generic macro unless there were
something MIPS specific.
Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
Fix a calculation of saved vector address in trap_low.
    
(damage done by lmo f4c72cc7)
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
Rename the 64-bit sc_hi and sc_lo arrays to use the same names
as the 32-bit struct sigcontext (sc_mdhi, sc_hi1, et cetera).
Signed-off-by: Daniel Jacobowitz <dan@codesourcery.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
 o Implement futex_atomic_op_inuser() operation
 o Don't use the R10000-ll/sc bug workaround version for every processor.
   branch likely is deprecated and some historic ll/sc processors don't
   implement it.  In any case it's slow.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
SETNAME only had a minor defect but probably never had a user and
MIPS_RDNVRAM was unimplemented anyway.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
Nothing exciting; Linux just didn't know it yet so this is most adding
a value to a case statement.
Signed-off-by: Chris Dearman <chris@mips.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
The 34K is very much like a 24K on steroids.
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
In case of CONFIG_64BIT_PHYS_ADDR, set_pte() and pte_clear() functions
only set _PAGE_GLOBAL bit in the pte_low field of the buddy PTEs,
forgetting to propagate ito to pte_high. Thus, the both pages might not
really be made global for the CPU (since it AND's the G-bit of the
odd / even PTEs together to decide whether they're global or not). Thus,
if only a single page is allocated via vmalloc() or ioremap(), it's not
really global for CPU (and it must be, since this is kernel mapping),
and thus its ASID is compared against the current process' one -- so,
we'll get into trouble sooner or later...  Also, pte_none() will fail
on global pages because _PAGE_GLOBAL bit is set in both pte_low and
pte_high, and pte_val() will return u64 value consisting of those fields
concateneted.
Signed-off-by: Sergei Shtylyov <sshtylyov@ru.mvista.com>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
common/au1000/irq.c was missing a mips_timer_interrupt() prototype,
whereas in common/au1000/time.c the actual mips_timer_interrupt()
implementation was missing an irq_exit() invocation, causing a
preempt_count() leak.
Signed-off-by: Herbert Valerio Riedel <hvr@hvrlab.org>
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

    
Found by Chris Dearman (chris@mips.com).
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

The ARM Architecture Reference Manual lists bit 4 of the PMD as "implementation
defined" and it must be set to zero on Intel XScale CPUs or the cache does
not behave properly. Found by Mike Rapoport while debugging a flash issue
on the PXA255:

	http://marc.10east.com/?l=linux-arm-kernel&m=114845287600782&w=1Signed-off-by: Deepak Saxena <dsaxena@plexity.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Andrew Morton <akpm@osdl.org>

Move the forward decl outside the ifdef, since we use it in both legs.

Should fix the spacr64 build error reported in
	http://bugzilla.kernel.org/show_bug.cgi?id=6625Acked-by: "David S. Miller" <davem@davemloft.net>
Cc: Cedric Pellerin <cedric@bidouillesoft.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: NeilBrown <neilb@suse.de>

If an error is reported by a drive in a RAID array (which is done via
bi_end_io - in interrupt context), we call md_error and md_new_event which
calls sysfs_notify.  However sysfs_notify grabs a mutex and so cannot be
called in interrupt context.

This patch just creates a variant of md_new_event which avoids the sysfs
call, and uses that.  A better fix for later is to arrange for the event to
be called from user-context.

Note: avoiding the sysfs call isn't a problem as an error will not, by
itself, modify the sync_action attribute.  (We do still need to
wake_up(&md_event_waiters) as an error by itself will modify /proc/mdstat).
Signed-off-by: Neil Brown <neilb@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Jeremy Higdon <jeremy@sgi.com>

This patch fixes a bug in sgiioc4 where it was using the default IDE port
I/O operations instead of MMIO.

The IDE part of the IOC4 chip uses MMIO to map the chip registers.
Unfortunately, the sgiioc4 driver uses the default port IO operations,
which happens to have worked for the past few years.  That's about to
change, however, thus this change from inX/outX to readX/writeX.
Signed-off-by: Jeremy Higdon <jeremy@sgi.com>
Cc: Bartlomiej Zolnierkiewicz <B.Zolnierkiewicz@elka.pw.edu.pl>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Martin Michlmayr <tbm@cyrius.com>

Fix the following compilation error:

CC      drivers/video/maxinefb.o
drivers/video/maxinefb.c:58: warning: initializer-string for array of chars is too long
drivers/video/maxinefb.c:58: warning: (near initialization for \u2018maxinefb_fix.id\u2019)
drivers/video/maxinefb.c:110: error: unknown field \u2018fb_get_fix\u2019 specified in initializer
drivers/video/maxinefb.c:110: error: \u2018gen_get_fix\u2019 undeclared here (not in a function)
drivers/video/maxinefb.c:111: error: unknown field \u2018fb_get_var\u2019 specified in initializer
drivers/video/maxinefb.c:111: error: \u2018gen_get_var\u2019 undeclared here (not in a function)
make[2]: *** [drivers/video/maxinefb.o] Error 1
Signed-off-by: Martin Michlmayr <tbm@cyrius.com>
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Rodolfo Giometti <giometti@linux.it>

Fix the following warning on compilation:

drivers/video/au1100fb.c: In function `au1100fb_fb_setcolreg':
drivers/video/au1100fb.c:219: warning: ISO C90 forbids mixed declarations and code
drivers/video/au1100fb.c: In function `au1100fb_fb_pan_display':
drivers/video/au1100fb.c:321: warning: ISO C90 forbids mixed declarations and code
drivers/video/au1100fb.c: In function `au1100fb_fb_mmap':
drivers/video/au1100fb.c:387: warning: ISO C90 forbids mixed declarations and code
drivers/video/au1100fb.c: In function `au1100fb_drv_probe':
drivers/video/au1100fb.c:471: warning: unsigned int format, long unsigned int arg (arg 2)
drivers/video/au1100fb.c: At top level:
drivers/video/au1100fb.c:617: warning: initialization from incompatible pointer type
drivers/video/au1100fb.c:618: warning: initialization from incompatible pointer type
Signed-off-by: Rodolfo Giometti <giometti@linux.it>
Signed-off-by: Antonino Daplas <adaplas@pol.net>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Benjamin Herrenschmidt <benh@kernel.crashing.org>

Prevent calling of some platform functions on the clock chips of the eMac
as it seems to cause it to lockup at boot.  For now, add a quirk to prevent
that from happening.  Later, I might find out what's wrong and fix it but
that doesn't seem to be important as the machine appear to work fine
without running those.  It's possible that Darwin doesn't run them.
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Nathan Pilatzke <nathanpilatzke@gmail.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Jean Delvare <khali@linux-fr.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Stephen Hemminger <shemminger@osdl.org>

I want to use the hrtimer's in the netem (Network Emulator) qdisc.  But the
necessary symbols aren't exported for module use.

Also needed by SystemTap.
Signed-off-by: Stephen Hemminger <shemminger@osdl.org>
Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "Stone, Joshua I" <joshua.i.stone@intel.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Andrew Morton <akpm@osdl.org>

Revert commit ff4da2e2.

It broke APM suspend, probably because APM doesn't switch back to a VT
when suspending.

Tracked down by Matt Mackall <mpm@selenic.com>

Rafael sayeth:
  "It only fixed the theoretical issue that a quick-handed user could
   switch to X after processes have been frozen and before the devices
   are suspended.

   With the current userland suspend tools it shouldn't be necessary."

Cc: Pavel Machek <pavel@ucw.cz>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Corey Minyard <minyard@acm.org>

This patch is pretty important to get in for IPMI, new systems have been
changing the way ACPI and IPMI interact, and this works around the problems
for now.  This is a temporary fix until we get proper ACPI handling in
IPMI.

Fixed releasing already-allocated regions when a later request fails, and
forward-ported it to HEAD.

Some BIOSes reserve disjoint I/O regions in their ACPI tables for the IPMI
controller.  This causes problems when trying to register the entire I/O
region.  Therefore we must register each I/O port separately.
Signed-off-by: Jordan Hargrave <Jordan_Hargrave@dell.com>
Signed-off-by: Matt Domsch <Matt_Domsch@dell.com>
Signed-off-by: Corey Minyard <minyard@acm.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Seiji Munetoh <seiji.munetoh@gmail.com>

Change the binary output format to actual ACPI TCPA log structure since the
current format does not contain all event-data information that need to
verify the PCRs in TPM.  tpm_binary_bios_measurements_show() uses
get_event_name() to convert the binary event-data to ascii format, and puts
them as binary.  However, to verify the PCRs, the event-data must be a
actual binary event-data used by SHA1 calc.  in BIOS.

So, I think actual ACPI TCPA log is good for this binary output format.
That way, any userland tools easily parse this data with reference to TCG
PC specification.
Signed-off-by: Seiji Munetoh <seiji.munetoh@gmail.com>
Acked-by: Kylene Hall <kjhall@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Seiji Munetoh <seiji.munetoh@gmail.com>

Fix "tcpa_pc_event" misalignment between enum, strings and TCG PC spec and
output of the event which contains a hash data.
Signed-off-by: Seiji Munetoh <seiji.munetoh@gmail.com>
Acked-by: Kylene Hall <kjhall@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Yasunori Goto <y-goto@jp.fujitsu.com>

If hot-added memory's address is smaller than old area, spanned_pages will
not be updated.  It must be fixed.

example) Old zone_start_pfn = 0x60000, and spanned_pages = 0x10000
         Added new memory's start_pfn = 0x50000, and end_pfn = 0x60000

  new spanned_pages will be still 0x10000 by old code.
  (It should be updated to 0x20000.) Because old_zone_end_pfn will be
  0x70000, and end_pfn smaller than it. So, spanned_pages will not be
  updated.

In current code, spanned_pages is updated only when end_pfn is updated.
But, it should be updated by subtraction between bigger end_pfn and new
zone_start_pfn.
Signed-off-by: Yasunori Goto <y-goto@jp.fujitsu.com>
Signed-off-by: Dave Hansen <haveblue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: David Hollister <david.hollister@amd.com>

After the system boots with the logo, if the first action is a scrollback, the
screen may become garbled.  This patch ensures that the softback_curr value is
updated along with softback_in following the scrollback.
Signed-off-by: David Hollister <david.hollister@amd.com>
Signed-off-by: Jordan Crouse <jordan.crouse@amd.com>
Cc: "Antonino A. Daplas" <adaplas@gmail.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

From: Andrew Morton <akpm@osdl.org>

Spotted by Jan Capek <jca@sysgo.com>

Cc: "Stephen C. Tweedie" <sct@redhat.com>
Cc: Andreas Dilger <adilger@clusterfs.com>
Cc: Jan Capek <jca@sysgo.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

We don't enable the BTB on the ixp2350 as that can cause weird
crashes (erratum #42.)  However, some bootloaders enable the BTB,
which means that we have to disable the BTB explicitly.

Found thanks to Tom Rini.
Signed-off-by: Lennert Buytenhek <buytenh@wantstofly.org>
Signed-off-by: Deepak Saxena <dsaxena@plexity.net>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>