pte_present might return true on PAGE_TYPE_NONE, even if
the invalid bit is on. Modify the existing check of the
pgste functions to avoid crashes.

[ Martin Schwidefsky: added ptep_modify_prot_[start|commit] bits ]
Reported-by: NMartin Schwidefky <schwidefsky@de.ibm.com>
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
CC: stable@vger.kernel.org
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

'buf[2]' is 2 bytes length, and sprintf() will append '\0' at the end
of string "?\n", so original implementation is memory overflow.

Need use strncpy() and strnlen() instead of sprintf().
Signed-off-by: NChen Gang <gang.chen@asianux.com>
Signed-off-by: NGerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

IPIs might be lost when a cpu gets brought offline:

When stop_machine executes its state machine there is a race window
for the state STOPMACHINE_DISABLE_IRQ where the to be brought offline
cpu might already have irqs disabled but a different cpu still may
have irqs enabled.
If the enabled cpu receives an interrupt and as a result sends an IPI
to the to be offlined cpu in its bottom halve context, the IPI won't
be noticed before the cpu is offline.

In fact the race window is much larger since there is no guarantee
when an IPI will be received.

To fix this check for enqueued but not yet received IPIs in the
cpu_disable() path and call the respective handlers before the cpu
is marked offline.
Reported-by: NJuergen Doelle <juergen.doelle@de.ibm.com>
Signed-off-by: NHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

On s390 the prefix page and absolute zero pages are not correctly
returned when reading /dev/mem. The reason is that the s390 asm/io.h
file includes the asm-generic/io.h file which then defines
xlate_dev_mem_ptr() and therefore overwrites the s390 specific
version that does the correct swap operation for prefix and absolute
zero pages. The problem is a regression that was introduced with git
commit cd248341 (s390/pci: base support).

To fix the problem add "#ifndef xlate_dev_mem_ptr" in asm-generic/io.h
and "#define xlate_dev_mem_ptr" in asm/io.h. This ensures that the
s390 version is used. For completeness also add the "#ifndef"
construct for xlate_dev_kmem_ptr().
Signed-off-by: NMichael Holzheu <holzheu@linux.vnet.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

In dma_free_coherent call debug_dma_free_coherent before deallocating
the memory to avoid a possible use after free.
Reviewed-by: NGerald Schaefer <gerald.schaefer@de.ibm.com>
Signed-off-by: NSebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: NMartin Schwidefsky <schwidefsky@de.ibm.com>

Pull LED subsystem fix from Bryan Wu.

* 'leds-fixes-3.10' of git://git.kernel.org/pub/scm/linux/kernel/git/cooloney/linux-leds:
  leds: leds-gpio: reserve gpio before using it

This reverts commit a99d76f9 (leds: leds-gpio: use gpio_request_one)
and commit 2d7c22f6 (leds: leds-gpio: set devm_gpio_request_one()
flags param correctly) which was a fix of the first one.

The conversion to devm_gpio_request in commit e3b1d44c (leds:
leds-gpio: use devm_gpio_request_one) is not reverted.

The problem is that gpio_cansleep() and gpio_get_value_cansleep()
calls can crash if the gpio is not first reserved. Incidentally this
same bug existed earlier and was fixed similarly in commit d95cbe61
(leds: Fix potential leds-gpio oops). But the OOPS is real. It happens
when GPIOs are provided by module which is not yet loaded.

So this fixes the following BUG during my ALIX boot (3.9.2-vanilla):

BUG: unable to handle kernel NULL pointer dereference at 0000004c
IP: [<c11287d6>] __gpio_cansleep+0xe/0x1a
*pde = 00000000
Oops: 0000 [#1] SMP
Modules linked in: leds_gpio(+) via_rhine mii cs5535_mfd mfd_core
geode_rng rng_core geode_aes isofs nls_utf8 nls_cp437 vfat fat
ata_generic pata_amd pata_cs5536 pata_acpi libata ehci_pci ehci_hcd
ohci_hcd usb_storage usbcore usb_common sd_mod scsi_mod squashfs loop
Pid: 881, comm: modprobe Not tainted 3.9.2 #1-Alpine
EIP: 0060:[<c11287d6>] EFLAGS: 00010282 CPU: 0
EIP is at __gpio_cansleep+0xe/0x1a
EAX: 00000000 EBX: cf364018 ECX: c132b8b9 EDX: 00000000
ESI: c13993a4 EDI: c1399370 EBP: cded9dbc ESP: cded9dbc
 DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
CR0: 8005003b CR2: 0000004c CR3: 0f0c4000 CR4: 00000090
DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
DR6: ffff0ff0 DR7: 00000400
Process modprobe (pid: 881, ti=cded8000 task=cf094aa0 task.ti=cded8000)
Stack:
 cded9de0 d09471cb 00000000 c1399260 cf364014 00000000 c1399260 c1399254
 d0949014 cded9df4 c118cd59 c1399260 d0949014 d0949014 cded9e08 c118ba47
 c1399260 d0949014 c1399294 cded9e1c c118bb75 cded9e24 d0949014 00000000
Call Trace:
 [<d09471cb>] gpio_led_probe+0xba/0x203 [leds_gpio]
 [<c118cd59>] platform_drv_probe+0x26/0x48
 [<c118ba47>] driver_probe_device+0x75/0x15c
 [<c118bb75>] __driver_attach+0x47/0x63
 [<c118a727>] bus_for_each_dev+0x3c/0x66
 [<c118b6f9>] driver_attach+0x14/0x16
 [<c118bb2e>] ? driver_probe_device+0x15c/0x15c
 [<c118b3d5>] bus_add_driver+0xbd/0x1bc
 [<d08b4000>] ? 0xd08b3fff
 [<d08b4000>] ? 0xd08b3fff
 [<c118bffc>] driver_register+0x74/0xec
 [<d08b4000>] ? 0xd08b3fff
 [<c118c8e8>] platform_driver_register+0x38/0x3a
 [<d08b400d>] gpio_led_driver_init+0xd/0x1000 [leds_gpio]
 [<c100116c>] do_one_initcall+0x6b/0x10f
 [<d08b4000>] ? 0xd08b3fff
 [<c105e918>] load_module+0x1631/0x1907
 [<c10975d6>] ? insert_vmalloc_vmlist+0x14/0x43
 [<c1098d5b>] ? __vmalloc_node_range+0x13e/0x15f
 [<c105ec50>] sys_init_module+0x62/0x77
 [<c1257888>] syscall_call+0x7/0xb
EIP: [<c11287d6>] __gpio_cansleep+0xe/0x1a SS:ESP 0068:cded9dbc
CR2: 000000000000004c
 ---[ end trace 5308fb20d2514822 ]---
Signed-off-by: NTimo Teräs <timo.teras@iki.f>
Cc: Sachin Kamat <sachin.kamat@linaro.org>
Cc: Raphael Assenat <raph@8d.com>
Cc: Trent Piepho <tpiepho@freescale.com>
Cc: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
Cc: Arnaud Patard <arnaud.patard@rtp-net.org>
Cc: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Acked-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NBryan Wu <cooloney@gmail.com>

Pull i2c bugfixes from Wolfram Sang:
 "These should have been in rc2 but I missed it due to working on devm
  longer than expected.

  There is one ID addition, since we are touching the driver anyhow.
  And the feature bit documentation is one outcome of a debug session
  and will make it easier for users to work around problems.  The rest
  is typical driver bugfixes."

* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: suppress lockdep warning on delete_device
  i2c: mv64xxx: work around signals causing I2C transactions to be aborted
  i2c: i801: Document feature bits in modinfo
  i2c: designware: add Intel BayTrail ACPI ID
  i2c: designware: always clear interrupts before enabling them
  i2c: designware: fix RX FIFO overrun

Pull s390 update from Martin Schwidefsky:
 "An additional sysfs attribute for channel paths and a couple of bux
  fixes"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/pgtable: fix ipte notify bit
  s390/xpram: mark xpram as non-rotational
  s390/smp: fix cpu re-scan vs. cpu state
  s390/cio: add channel ID sysfs attribute
  s390/ftrace: fix mcount adjustment
  s390: fix gmap_ipte_notifier vs. software dirty pages
  s390: disable pfmf for clear page instruction
  s390/disassembler: prevent endless loop in print_fn_code()
  s390: remove non existent reference to GENERIC_KERNEL_THREAD

Before f7b861b7 ("arm: Use generic idle loop") ARM would kill the
CPU within the rcu idle section.  Now that the rcu_idle_enter()/exit()
pair have been pushed lower down in the idle loop this is no longer true
and so using RCU_NONIDLE here is no longer necessary and also harmful
because RCU is not actually idle at this point.

Cc: Russell King <linux@arm.linux.org.uk>
Acked-by: NPaul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: NStephen Boyd <sboyd@codeaurora.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Pull radeon sun/hainan support from  Dave Airlie:
 "Since I know its outside the merge window, but since this is new hw I
  thought I'd try and provoke the new hw exception, it just fills in the
  blanks in the driver for the new AMD sun and hainan chipsets."

* 'drm-radeon-sun-hainan' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon: add Hainan pci ids
  drm/radeon: add golden register settings for Hainan (v2)
  drm/radeon: sun/hainan chips do not have UVD (v2)
  drm/radeon: track which asics have UVD
  drm/radeon: radeon-asic updates for Hainan
  drm/radeon: fill in ucode loading support for Hainan
  drm/radeon: don't touch DCE or VGA regs on Hainan (v3)
  drm/radeon: fill in GPU init for Hainan (v2)
  drm/radeon: add chip family for Hainan

Pull DRM fixes from Dave Airlie:
 "This is just a set of nouveau and radeon fixes, the nouveau ones fix
  some suspend/resume regressions since use of copy engines and some
  fixes for Z compression on some newer chipsets."

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon/dce2: use 10khz units for audio dto calculation
  drm/radeon: Fix VRAM size calculation for VRAM >= 4GB
  drm/radeon: Remove superfluous variable
  drm/nouveau: ensure channels are stopped before saving fences for suspend
  drm/nv50/fifo: prevent races between clients updating playlists
  drm/nvc0/fifo: prevent CHAN_TABLE_ERROR:CHANNEL_PENDING on fifo fini
  drm/nvc0/fifo: prevent races between clients updating playlists
  drm/nve0/fifo: prevent races between clients updating playlists
  drm/nve0/ltcg: poke the partition count into yet another register
  drm/nvc0/ltcg: fix handling of disabled partitions
  drm/nvc0/ce: disable ce1 on a number of chipsets
  drm/nouveau/bios: fix thinko in ZM_MASK_ADD opcode
  drm/nouveau: fix build with nv50->nvc0

This is the pull request for AMD Sun/Hainan support.  I've
split it out separately from my regular fixes stream.  Hainan
is a new SI asic with no UVD or DCE hardware.  The patches are
minimally invasive; basically just pci ids and skipping UVD and
DCE init for this family.  Most of the changes to si.c are just
the golden register tables for the family.

* 'drm-fixes-3.10-sun' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: add Hainan pci ids
  drm/radeon: add golden register settings for Hainan (v2)
  drm/radeon: sun/hainan chips do not have UVD (v2)
  drm/radeon: track which asics have UVD
  drm/radeon: radeon-asic updates for Hainan
  drm/radeon: fill in ucode loading support for Hainan
  drm/radeon: don't touch DCE or VGA regs on Hainan (v3)
  drm/radeon: fill in GPU init for Hainan (v2)
  drm/radeon: add chip family for Hainan

Minor bug fixes.

* 'drm-fixes-3.10' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon/dce2: use 10khz units for audio dto calculation
  drm/radeon: Fix VRAM size calculation for VRAM >= 4GB
  drm/radeon: Remove superfluous variable

Merge tag 'stable/for-linus-3.10-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

Pull Xen fixes from Konrad Rzeszutek Wilk:
 - Regression fix in xen privcmd fixing a memory leak.
 - Add Documentation for tmem driver.
 - Simplify and remove code in the tmem driver.
 - Cleanups.

* tag 'stable/for-linus-3.10-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen: Fixed assignment error in if statement
  xen/xenbus: Fixed over 80 character limit issue
  xen/xenbus: Fixed indentation error in switch case
  xen/tmem: Don't use self[ballooning|shrinking] if frontswap is off.
  xen/tmem: Remove the usage of '[no|]selfballoon' and use 'tmem.selfballooning' bool instead.
  xen/tmem: Remove the usage of 'noselfshrink' and use 'tmem.selfshrink' bool instead.
  xen/tmem: Remove the boot options and fold them in the tmem.X parameters.
  xen/tmem: s/disable_// and change the logic.
  xen/tmem: Fix compile warning.
  xen/tmem: Split out the different module/boot options.
  xen/tmem: Move all of the boot and module parameters to the top of the file.
  xen/tmem: Cleanup. Remove the parts that say temporary.
  xen/privcmd: fix condition in privcmd_close()

Pull hwmon fixes from Guenter Roeck:

 - Error path fixes for abituguru and iio_hwmon drivers.

 - Drop erroneously created attributes from nct6775 driver.

 - Drop redundant safety on cache lifetime for tmp401 driver.

 - Add explicit maintainer for LM95234 and TMP401 drivers.

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  MAINTAINERS: Add myself as maintainer for LM95234 and TMP401 drivers
  hwmon: (tmp401) Drop redundant safety on cache lifetime
  hwmon: fix error return code in abituguru_probe()
  hwmon: (iio_hwmon) Fix null pointer dereference
  hwmon: (nct6775) Do not create non-existing attributes
  hwmon: (iio_hwmon) Fix missing iio_channel_release_all call if devm_kzalloc fail

In commit 78d77df7 ("x86-64, init: Do not set NX bits on non-NX
capable hardware") we added the early_pmd_flags that gets the NX bit set
when a CPU supports NX. However, the new variable was marked __initdata,
because the main _use_ of this is in an __init routine.

However, the bit setting happens from secondary_startup_64(), which is
called not only at bootup, but on every secondary CPU start.  Including
resuming from STR and at CPU hotplug time.  So the value cannot be
__initdata.
Reported-bisected-and-tested-by: NMichal Hocko <mhocko@suse.cz>
Cc: stable@vger.kernel.org # v3.9
Acked-by: NPeter Anvin <hpa@linux.intel.com>
Cc: Fernando Luis Vázquez Cao <fernando@oss.ntt.co.jp>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Fixed assignment error in if statement in balloon.c
Signed-off-by: NLisa Nguyen <lisa@xenapiadmin.com>
Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Fixed the format length of the xenbus_backend_ioctl()
function to meet the 80 character limit in
xenbus_dev_backend.c
Signed-off-by: NLisa Nguyen <lisa@xenapiadmin.com>
Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Fixed the indentation error in the switch case in
xenbus_dev_backend.c
Signed-off-by: NLisa Nguyen <lisa@xenapiadmin.com>
Signed-off-by: NKonrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Reviewed-by: NChristian König <christian.koenig@amd.com>

v2: fix typo
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Reviewed-by: NChristian König <christian.koenig@amd.com>

Skip UVD handling on them.

v2: split has_uvd tracking into separate patch
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Reviewed-by: NChristian König <christian.koenig@amd.com>

Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Reviewed-by: NChristian König <christian.koenig@amd.com>

Hainan has no display hardware:
- no DCE (crtc, uniphy, dac, etc.)
- no VGA

v2: fix bios fetch
v3: fix interrupts
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Reviewed-by: NChristian König <christian.koenig@amd.com>

v2: fix gb_addr_config value
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Reviewed-by: NChristian König <christian.koenig@amd.com>

Merge tag 'pinctrl-fixes-v3.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pinctrl fixes from Linus Walleij:

 - Three fixes to make the boot path for device tree work properly on
   the Nomadik pin controller.

 - Compile warning fix for the vt8500 driver.

 - Fix error path in pinctrl-single.

 - Free mappings in error path of the Lantiq controller.

 - Documentation fixes.

* tag 'pinctrl-fixes-v3.10-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl/lantiq: Free mapping configs for both pin and groups
  pinctrl: single: fix error return code in pcs_parse_one_pinctrl_entry()
  pinctrl: generic: Fix typos and clarify comments
  pinctrl: vt8500: Fix incorrect data in WM8750 pinctrl table
  pinctrl: abx500: Rejiggle platform data and DT initialisation
  pinctrl: abx500: Specify failed sub-driver by ID instead of driver_data

Pull kbuild fix from Michal Marek:
 "In an attempt to improve make rpm-pkg, I broke make binrpm-pkg"

* 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  package: Makefile: unbreak binrpm-pkg target

Avoids overflows on DCE2.x devices. Also clarify the calculation
on other asics.
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

Add ULL prefix to avoid overflow.
Signed-off-by: NNiels Ole Salscheider <niels_ole@salscheider-online.de>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

bool in_mode_set from struct radeon_crtc is not used anymore.
Signed-off-by: NNiels Ole Salscheider <niels_ole@salscheider-online.de>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

I wrote the LM95234 driver and extended the TMP401 driver substantially,
and I have hardware to test both, so it makes sense to explicitly
maintain them.
Signed-off-by: NGuenter Roeck <linux@roeck-us.net>
Acked-by: NJean Delvare <khali@linux-fr.org>

Merge branch 'drm-nouveau-fixes-3.10' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-next

Fixes some s/r problem with copy engines and ZCULL issues and playlist issues
* 'drm-nouveau-fixes-3.10' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
  drm/nouveau: ensure channels are stopped before saving fences for suspend
  drm/nv50/fifo: prevent races between clients updating playlists
  drm/nvc0/fifo: prevent CHAN_TABLE_ERROR:CHANNEL_PENDING on fifo fini
  drm/nvc0/fifo: prevent races between clients updating playlists
  drm/nve0/fifo: prevent races between clients updating playlists
  drm/nve0/ltcg: poke the partition count into yet another register
  drm/nvc0/ltcg: fix handling of disabled partitions
  drm/nvc0/ce: disable ce1 on a number of chipsets
  drm/nouveau/bios: fix thinko in ZM_MASK_ADD opcode
  drm/nouveau: fix build with nv50->nvc0

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>