Mike Galbraith reported finding a lockup ("perma-spin bug") where the
cpumask passed to smp_call_function_many was cleared by other cpu(s)
while a cpu was preparing its call_data block, resulting in no cpu to
clear the last ref and unlock the block.

Having cpus clear their bit asynchronously could be useful on a mask of
cpus that might have a translation context, or cpus that need a push to
complete an rcu window.

Instead of adding a BUG_ON and requiring yet another cpumask copy, just
detect the race and handle it.

Note: arch_send_call_function_ipi_mask must still handle an empty
cpumask because the data block is globally visible before the that arch
callback is made.  And (obviously) there are no guarantees to which cpus
are notified if the mask is changed during the call; only cpus that were
online and had their mask bit set during the whole call are guaranteed
to be called.
Reported-by: Mike Galbraith <efault@gmx.de>
Reported-by: Jan Beulich <JBeulich@novell.com>
Acked-by: Jan Beulich <jbeulich@novell.com>
Cc: stable@kernel.org
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Paul McKenney's review pointed out two problems with the barriers in the
2.6.38 update to the smp call function many code.

First, a barrier that would force the func and info members of data to
be visible before their consumption in the interrupt handler was
missing.  This can be solved by adding a smp_wmb between setting the
func and info members and setting setting the cpumask; this will pair
with the existing and required smp_rmb ordering the cpumask read before
the read of refs.  This placement avoids the need a second smp_rmb in
the interrupt handler which would be executed on each of the N cpus
executing the call request.  (I was thinking this barrier was present
but was not).

Second, the previous write to refs (establishing the zero that we the
interrupt handler was testing from all cpus) was performed by a third
party cpu.  This would invoke transitivity which, as a recient or
concurrent addition to memory-barriers.txt now explicitly states, would
require a full smp_mb().

However, we know the cpumask will only be set by one cpu (the data
owner) and any preivous iteration of the mask would have cleared by the
reading cpu.  By redundantly writing refs to 0 on the owning cpu before
the smp_wmb, the write to refs will follow the same path as the writes
that set the cpumask, which in turn allows us to keep the barrier in the
interrupt handler a smp_rmb instead of promoting it to a smp_mb (which
will be be executed by N cpus for each of the possible M elements on the
list).

I moved and expanded the comment about our (ab)use of the rcu list
primitives for the concurrent walk earlier into this function.  I
considered moving the first two paragraphs to the queue list head and
lock, but felt it would have been too disconected from the code.

Cc: Paul McKinney <paulmck@linux.vnet.ibm.com>
Cc: stable@kernel.org (2.6.32 and later)
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Peter pointed out there was nothing preventing the list_del_rcu in
smp_call_function_interrupt from running before the list_add_rcu in
smp_call_function_many.

Fix this by not setting refs until we have gotten the lock for the list.
Take advantage of the wmb in list_add_rcu to save an explicit additional
one.

I tried to force this race with a udelay before the lock & list_add and
by mixing all 64 online cpus with just 3 random cpus in the mask, but
was unsuccessful.  Still, inspection shows a valid race, and the fix is
a extension of the existing protection window in the current code.

Cc: stable@kernel.org (v2.6.32 and later)
Reported-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change the _mapcount value indicating PageBuddy from -2 to -128 for
more robusteness against page_mapcount() undeflows.

Use reset_page_mapcount instead of __ClearPageBuddy in bad_page to
ignore the previous retval of PageBuddy().
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Reported-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/epip/linux-2.6-unicore32: (40 commits)
  unicore32: rewrite arch-specific tlb.h to use asm-generic version
  unicore32: modify io_p2v and io_v2p macros, and adjust PKUNITY_mmio_BASEs
  unicore32: replace unicore32-specific iomap functions with generic lib implementation
  unicore32 machine related: add frame buffer driver for pkunity-v3 soc
  unicore32 machine related files: add i2c bus drivers for pkunity-v3 soc
  unicore32 io: redefine __REG(x) and re-use readl/writel funcs
  unicore32 i8042 upgrade and bugfix: adjust resource request region type
  unicore32 upgrade to v2.6.38-rc5: add one more paramter for pte_alloc_map call
  unicore32 i8042: adjust io funcs of i8042-unicore32io.h
  unicore32: rename PKUNITY_IOSPACE_BASE to PKUNITY_MMIO_BASE
  unicore32: modify function names and parameters for irq_chips
  unicore32: remove unused lines in arch/unicore32/include/asm/irq.h
  unicore32 time.c: change calculate method for clock_event_device
  unicore32: ADD MAINTAINER for unicore32 architecture
  unicore32 machine related files: ps2 driver
  unicore32 machine related files: pci bus handling
  unicore32 machine related files: hardware registers
  unicore32 machine related files: core files
  unicore32 additional architecture files: boot process
  unicore32 additional architecture files: low-level lib: misc
  ...
Acked-by: Arnd Bergmann <arnd@arndb.de>

* 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6:
  [S390] kexec: Disable ftrace during kexec
  [S390] support XZ compressed kernel
  [S390] css_bus_type: make it static
  [S390] css_driver: remove duplicate members
  [S390] css: remove subchannel private
  [S390] css: move chsc_private to drv_data
  [S390] css: move io_private to drv_data
  [S390] cio: move cdev pointer to io_subchannel_private
  [S390] cio: move options to io_sch_private
  [S390] cio: move asms to generic header
  [S390] cio: move orb definitions to separate header
  [S390] Write protect module text and RO data
  [S390] dasd: get rid of compile warning
  [S390] remove superfluous check from do_IRQ
  [S390] remove redundant stack check option

* 'sh-latest' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: (34 commits)
  sh: Convert to generic show_interrupts.
  sh: Wire up new fhandle and clock_adjtime syscalls.
  sh: modify platform_device for sh_eth driver
  sh: add GETHER's platform_device in board-sh7757lcr
  sh: update sh7757lcr_defconfig
  sh: add platform_device of tmio_mmc and sh_mmcif to sh7757lcr
  sh: dmaengine support for SH7757
  sh: add mmc clock in clock-sh7757
  sh: add spi_board_info in sh7757lcr
  sh: add platform_device for SPI
  sh: add USB_ARCH_HAS_EHCI and OHCI for SH7757
  sh: Rename cpuidle states to fit general conventions
  serial: sh-sci: fix deadlock when resuming from S3 sleep
  sh: Enable CONFIG_GCOV_PROFILE_ALL for sh
  sh: Fix up async PCIe probing on SMP.
  serial: sh-sci: Kill off the special earlyprintk device.
  serial: sh-sci: Use dev_name() for region reservations.
  serial: sh-sci: Fix up earlyprintk port mapping.
  serial: sh-sci: Limit early console to one device.
  serial: sh-sci: Fix up break timer scheduling race.
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6:
  fbdev: sh_mobile_lcdc: Add YUV framebuffer support
  viafb: split pll configs up
  viafb: remove duplicated clock storage
  viafb: always return the best possible clock
  viafb: remove duplicated clock information
  fbdev: sh_mobile_lcdcfb: add backlight support
  viafb: factor lcd scaling parameters out
  viafb: strip some structures
  viafb: remove unused data_mode and device_type
  viafb: kill lcd_panel_id
  video via: make local variables static
  video via: fix iomem access
  video/via: drop deprecated (and unused) i2c_adapter.id

* 'drm-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (177 commits)
  drm/radeon: fixup refcounts in radeon dumb create ioctl.
  drm: radeon: *_cs_packet_parse_vline() cleanup
  radeon: merge list_del()/list_add_tail() to list_move_tail()
  drm: Retry i2c transfer of EDID block after failure
  drm/radeon/kms: fix typo in atom overscan setup
  drm: Hold the mode mutex whilst probing for sysfs status
  drm/nouveau: fix __nouveau_fence_wait performance
  drm/nv40: attempt to reserve just enough vram for all 32 channels
  drm/nv50: check for vm traps on every gr irq
  drm/nv50: decode vm faults some more
  drm/nouveau: add nouveau_enum_find() util function
  drm/nouveau: properly handle pushbuffer check failures
  drm/nvc0: remove vm hack forcing large/small pages to not share a PDE
  drm/i915: disable opregion lid detection for now.
  drm/i915: Only wait on a pending flip if we intend to write to the buffer
  drm/i915/dp: Sanity check eDP existence
  drm: add cap bit to denote if dumb ioctl is available or not.
  drm/core: add ioctl to query device/driver capabilities
  drm/radeon/kms: allow max clock of 340 Mhz on hdmi 1.3+
  drm/radeon/kms: add cayman pci ids
  ...

Trivial conversion, simply encapsulate the NMI stats in the arch code.
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

Signed-off-by: Paul Mundt <lethal@linux-sh.org>

A new parameter is added to sh_eth_plat_data. And the sh_eth driver
needs additional memory resource if a module has TSU.
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

This patch also modifies for ETHER's platform_device.
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Signed-off-by: Paul Mundt <lethal@linux-sh.org>

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 into sh-latest

This was using old gem refcounting methods, fix it to be the same
as the normal create ioctl.
Signed-off-by: Dave Airlie <airlied@redhat.com>

Simplify the way the return value is set a number of times (mostly on
error).
Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Dave Airlie <airlied@redhat.com>

Merge list_del() + list_add_tail() to list_move_tail().
Signed-off-by: Nicolas Kaiser <nikai@nikai.net>
Signed-off-by: Dave Airlie <airlied@redhat.com>

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next-2.6: (33 commits)
  sparc32: Fix might-be-used-uninitialized warning in do_sparc_fault().
  sparc: Fix .size directive for do_int_load
  sparc64: Fix build errors with gcc-4.6.0
  sparc32,sun4m: percpu and global register definitions moved to irq.h
  sparc32: introduce build_device_irq
  sparc32: introduce sparc_irq_config
  sparc32: fix build with leon or floppy enabled
  sparc: convert to clocksource_register_hz/khz
  sparc64: Sharpen address space randomization calculations.
  sparc32: irq_32.c cleanup
  sparc32, sun4d: add comment in empty statement in sun4d_request_irq()
  sparc32,sun4d: drop unused code in sun4d_distribute_irqs()
  sparc32,sun4d: irq, smp files cleanup
  sparc32,sun4m: irq, smp files cleanup
  sparc32,sun4c: irq file cleanup
  sparc32: add irq + smp declarations to headers
  sparc32: remove tick14.c
  sparc32/leon: FPU-FSR only available when FPU present
  SPARC/LEON: power down instruction different of different LEONs
  sparc32: added U-Boot build target: uImage
  ...

* 'mnt_devname' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6:
  vfs: bury ->get_sb()
  nfs: switch NFS from ->get_sb() to ->mount()
  nfs: stop mangling ->mnt_devname on NFS
  vfs: new superblock methods to override /proc/*/mount{s,info}
  nfs: nfs_do_{ref,sub}mount() superblock argument is redundant
  nfs: make nfs_path() work without vfsmount
  nfs: store devname at disconnected NFS roots
  nfs: propagate devname to nfs{,4}_get_root()

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k:
  m68k/block: amiflop - Remove superfluous amiga_chip_alloc() cast
  m68k/atari: ARAnyM - Add support for network access
  m68k/atari: ARAnyM - Add support for console access
  m68k/atari: ARAnyM - Add support for block access
  m68k/atari: Initial ARAnyM support
  m68k: Kconfig - Remove unneeded "default n"
  m68k: Makefiles - Change to new flags variables
  m68k/amiga: Reclaim Chip RAM for PPC exception handlers
  m68k: Allow all kernel traps to be handled via exception fixups
  m68k: Use base_trap_init() to initialize vectors
  m68k: Add helper function handle_kernel_fault()

* 'remove' of master.kernel.org:/home/rmk/linux-2.6-arm:
  ARM: 6629/2: aaec2000: remove support for mach-aaec2000
  ARM: lh7a40x: remove unmaintained platform support

Fix up trivial conflicts in
 - arch/arm/mach-{aaec2000,lh7a40x}/include/mach/memory.h (removed)
 - drivers/usb/gadget/Kconfig (USB_[GADGET_]LH7A40X removed, others added)

* 'for-linus' of master.kernel.org:/home/rmk/linux-2.6-arm: (91 commits)
  ARM: 6806/1: irq: introduce entry and exit functions for chained handlers
  ARM: 6781/1: Thumb-2: Work around buggy Thumb-2 short branch relocations in gas
  ARM: 6747/1: P2V: Thumb2 support
  ARM: 6798/1: aout-core: zero thread debug registers in a.out core dump
  ARM: 6796/1: Footbridge: Fix I/O mappings for NOMMU mode
  ARM: 6784/1: errata: no automatic Store Buffer drain on Cortex-A9
  ARM: 6772/1: errata: possible fault MMU translations following an ASID switch
  ARM: 6776/1: mach-ux500: activate fix for errata 753970
  ARM: 6794/1: SPEAr: Append UL to device address macros.
  ARM: 6793/1: SPEAr: Remove unused *_SIZE macros from spear*.h files
  ARM: 6792/1: SPEAr: Replace SIZE macro's with SZ_4K macros
  ARM: 6791/1: SPEAr3xx: Declare device structures after shirq code
  ARM: 6790/1: SPEAr: Clock Framework: Rename usbd clock and align apb_clk entry
  ARM: 6789/1: SPEAr3xx: Rename sdio to sdhci
  ARM: 6788/1: SPEAr: Include mach/hardware.h instead of mach/spear.h
  ARM: 6787/1: SPEAr: Reorder #includes in .h & .c files.
  ARM: 6681/1: SPEAr: add debugfs support to clk API
  ARM: 6703/1: SPEAr: update clk API support
  ARM: 6679/1: SPEAr: make clk API functions more generic
  ARM: 6737/1: SPEAr: formalized timer support
  ...

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: (41 commits)
  m68knommu: external interrupt support to ColdFire intc-simr controller
  m68knommu: external interrupt support to ColdFire intc-2 controller
  m68knommu: remove ColdFire CLOCK_DIV config option
  m68knommu: fix gpio warnings for ColdFire 5407 targets
  m68knommu: fix gpio warnings for ColdFire 532x targets
  m68knommu: fix gpio warnings for ColdFire 5307 targets
  m68knommu: fix gpio warnings for ColdFire 527x targets
  m68knommu: fix gpio warnings for ColdFire 5272 targets
  m68knommu: fix gpio warnings for ColdFire 5249 targets
  m68knommu: fix gpio warnings for ColdFire 523x targets
  m68knommu: fix gpio warnings for ColdFire 520x targets
  m68knommu: fix gpio warnings for ColdFire 5206e targets
  m68knommu: fix gpio warnings for ColdFire 5206 targets
  m68knommu: fixing compiler warnings
  m68knommu: limit interrupts supported by ColdFire intc-simr driver
  m68knommu: move some init code out of unmask routine for ColdFire intc-2
  m68knommu: limit interrupts supported by ColdFire intc-2 driver
  m68knommu: add basic support for the ColdFire based FireBee board
  m68knommu: make ColdFire internal peripheral region configurable
  m68knommu: clean up definitions of ColdFire peripheral base registers
  ...

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  [IA64] tioca: Fix assignment from incompatible pointer warnings
  [IA64] mca.c: Fix cast from integer to pointer warning
  [IA64] setup.c Typo fix "Architechtuallly"
  [IA64] Add CONFIG_MISC_DEVICES=y to configs that need it.
  [IA64] disable interrupts at end of ia64_mca_cpe_int_handler()
  [IA64] Add DMA_ERROR_CODE define.
  pstore: fix build warning for unused return value from sysfs_create_file
  pstore: X86 platform interface using ACPI/APEI/ERST
  pstore: new filesystem interface to platform persistent storage

Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>

1. remove __REG macro
2. add (void __iomem *) to io_p2v macro
3. add (phys_addr_t) to io_v2p macro
4. add PKUNITY_AHB_BASE and PKUNITY_APB_BASE definitions
5. modify all PKUNITY_mmio_BASEs from physical addr to virtual addr
6. adjust prefix macro for all usage of PKUNITY_mmio_BASEs
  -- by advice with Arnd Bergmann
Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>

1. define and enable CONFIG_GENERIC_IOMAP
2. define unicore32-specific PCI_IOBASE for asm-generic/io.h
3. define HAVE_ARCH_PIO_SIZE and unicore32-specific PIO_* macros
4. remove all unicore32-specific iomap functions
Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
Reviewed-and-Acked-by: Arnd Bergmann <arnd@arndb.de>

change from original version -- by advice of Paul Mundt
1. remove videomemorysize definitions
2. remove unifb_enable and unifb_setup
3. use dev_warn instead of printk in fb driver
4. remove judgement for FB_ACCEL_PUV3_UNIGFX
5. adjust clk_get and clk_set_rate calls
6. add resources definitions
7. remove unifb_option
8. adjust register for platform_device
9. adjust unifb_ops position and unifb_regs assignment position
Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
Acked-by: Arnd Bergmann <arnd@arndb.de>

change from original version -- by advice of Jean Delvare
1. remove global variable i2c_reg, replaced by local variables
2. replace ENXIO with ENODEV when no platform resources
3. add adapter->nr assignment before i2c_add_numbered_adapter() call
4. add judgement for i2c_del_adapter() return value
5. release adapter when driver removed
6. add __devexit for puv3_i2c_remove() function
7. modify several names to more appropriated ones
Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
Acked-by: Arnd Bergmann <arnd@arndb.de>

  -- by advice of Arnd Bergmann
Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>

Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>

Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>

replace inb/outb with readb/writeb in i8042-unicore32io.h
and correct typecasting of register and region macros
  -- by advice with Arnd Bergmann
Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>

for the term IOSPACE normally refers to the PCI PIO space
  -- by advice with Arnd Bergmann
Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>

  -- by advice with Thomas Gleixner
Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>

Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>

When we try to handle vmalloc faults, we can take a code
path which uses "code" before we actually set it.

Amusingly gcc-3.3 notices this yet gcc-4.x does not.
Reported-by: Bob Breuer <breuerr@mc.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

apply clockevents_calc_mult_shift() to get rid of
shift assignment and mult calculation for osmr0
  -- by advice with Thomas Gleixner
Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>

Add MAINTAINER list for unicore32 architecture and pkunity soc drivers.
Signed-off-by: Guan Xuetao <gxt@mprc.pku.edu.cn>
Acked-by: Arnd Bergmann <arnd@arndb.de>

gas used to accept (and ignore?) .size directives which referred to
undefined symbols, as this does.  In binutils 2.21 these are treated
as errors.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>