sparc32: Kill off software 32-bit multiply/divide routines.

For the explicit calls to .udiv/.umul in assembler, I made a
mechanical (read as: safe) transformation.  I didn't attempt
to make any simplifications.

In particular, __ndelay and __udelay can be simplified significantly.
Some of the %y reads are unnecessary and these routines have no need
any longer for allocating a register window, they can be leaf
functions.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Build kernel with -mcpu=v8

With Cypress gone we can generate real hardware integer multiply
and divide instructions at will.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: cleanup mm/fault_32.c

- remove unused variables
- fix coding style issues that hurts my eyes

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Remove cypress cpu support.

It's the one aberration in v8, the only cpu that
didn't actually have hardware multiply and divide
instructions.

Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Sam Ravnborg <sam@ravnborg.org>

sparc64: Remove pointless assignment in floppy support.

Reported-by: Josip Rodin <joy@entuzijast.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Kill unused hard_smp{4m,4d,leon}_processor_id() inlined.

Reported-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop build time btfixup patching

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: remove runtime btfix support

- remove all uses of btfixup header
- remove the btfixup header
- remove the btfixup code

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: remove remaining users of btfixup

Use sparc_config to hold the last two function pointers.  There was no
point generating dedicated _ops structures only for these.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: move smp ipi to method ops

I ended up renaming set_cpu_int to send_ipi to
be consistent all way around.
send_ipi was moved to the *_smp.c files so
we could call the relevant method direct,
without any _ops indirection.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Implement hard_smp_processor_id() via instruction patching.

This is the last non-trivial user of btfixup.

Like sparc64, use a special patch section to resolve the various
implementations of how to read the current CPU's ID when we don't
have current_thread_info()->cpu necessarily available.

Signed-off-by: David S. Miller <davem@davemloft.net>
Tested-by: Sam Ravnborg <sam@ravnborg.org>

sparc32: Move cache and TLB flushes over to method ops.

This eliminated most of the remaining users of btfixup.

There are some complications because of the special cases we
have for sun4d, leon, and some flavors of viking.

It was found that there are no cases where a flush_page_for_dma
method was not hooked up to something, so the "noflush" iommu
methods were removed.

Add some documentation to the viking_sun4d_smp_ops to describe exactly
the hardware bug which causes us to need special TLB flushing on
sun4d.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Remove unused declarations in srmmu.c

Uses of these went away with the sun4c removal.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Convert mmu_* interfaces from btfixup to method ops.

This set of changes displays one major danger of btfixup, interface
signatures are not always type checked fully.  As seen here the iounit
variant of the map_dma_area routine had an incorrect type for one of
it's arguments.

It turns out to be harmless in this case, but just imagine trying to
debug something involving this kind of problem.  No thanks.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc: Kill mmu_{un,}lockarea().

These were used on sun4c during floppy data transfers since on that
chip we had to lock the cpu mappings into the TLB because we cannot
take a TLB miss during the assembler floppy interrupt handler that
does the data transfer.

That is no longer necessary since we've removed sun4c support, thus
this stuff can disappear completely.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Un-btfixup update_mmu_cache().

The magic Swift SRMMU code in question has not been enabled for
something on the order of a decade, and it as well as it's comment
is there in the history in case we ever need it again.

Therefore all implementations are NOPs and we can kill this stuff
off.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Kill btfixup for xchg()'s 'swap' instruction.

We always have this instruction available, so no need to use
btfixup for it any more.

This also eradicates the whole of atomic_32.S and thus the
__atomic_begin and __atomic_end symbols completely.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop unused clear_cpu_int

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop unused set_irq_udt

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop btfixup in page_32.h

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop unused prototype from timer_32.h

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop btfixup in mmu_context_32.h

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop btfixup in pgtable_32.h

Only one function left using btfixup.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop btfixup in pgalloc_32.h

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Pass -mcpu=v7 explicitly to gcc.

We should be agnostic to what gcc happens to be generating by default.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Un-btfixup more PTE constants and PTE ops.

pte_{filei,wrprotecti,mkcleani,mkoldi}
pte_{mkwrite,mkdirty,mkyoung}

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Un-btfixup pte_{write,dirty,young}i

And we can certainly get rid of the const function attributes, there
is no way that's needed any longer and no other arch uses this kind
of annotation here.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop unused code in process_32

It is commented out using #ifdef 0 / #endif,
and has been so for a long time.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Un-btfixup set_pte, pte_present, mk_pte{_phys,_io}().

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop loadmmu

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Un-btfixup pmd_{bad,present}().

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Un-btfixup pgd_{none,bad,present}.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Un-btfixup PAGE_{NONE,COPY,READONLY,SHARED,KERNEL}.

That lets us also get rid of the run-time initialization of
protection_map[] and all the ugly module workarounds for
PAGE_KERNEL and PAGE_SHARED to deal with the fact that we
can't do btfixups for modular code.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Un-btfixup pmd_page and pte_pfn.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Un-btfixup {pte,pmd,pgd}_clear().

Also we can remove BTFIXUPCALL_SWAPO0G0 as that is no longer
used.

This was rather amusing, we were setting the btfixup vectors
based upon cpu type but all to the same exact generic srmmu
routines.

Furthermore, we were inconsistently marking the fixup as
either BTFIXUPCALL_SWAPO0G0 or BTFIXUPCALL_NORM.

What a mess, glad we could untangle this stuff.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Un-btfixup PGDIR_{SHIFT,SIZE,MASK} {USER_,}PTRS_PER_{PGD,PMD}

Only one set of values exist, the SRMMU ones.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop unused type/extern

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop btfixup for check_pgt_cache

It is a noop for srmmu - so use a define as sparc64 does.
And drop all sparc callers - no need to confuse our-self
be calling a noop function.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop btfixup for switch_mm

This revealed that the implementation of switch_mm
had a bogus extra argument.
No harm as said argument was never used - but confusing.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: code cleanup in floppy glue

Small cleanup to improve readability.
Dropped one test for sparc_cpu_model -
we already know that only sun4m support floppy.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: fix warning in floopy glue

Fix following warning:
arch/sparc/include/asm/floppy_32.h:342:5: warning: 'op' may be used uninitialized in this function

The warning are legitimite and we can end up using op uninitialized.
This fixes build with my gcc on UP.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: simpler cputype check in head_32.S

We know this is not a sun4/sun4c - as we checked earlier.
So no need to repeat the check.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop extra getprop call during boot

It was present only to support the sun4, sun4c boxes which
do not have the "compatible" property in the root-node
of the device tree.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop prom version check in head_32.S

We already sorted out if we are a sun4/sun4c and halted.
So no need to check the prom version as we know this is
a v2 or v3 as sun4m, sun4d etc. does not use a v1 prom.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: remove sun4c specific variables from head_32.S

This gives us back 7 pages...

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Add back early sun4/sun4c detection so we can warn properly.

We need to do the check before we try to remap the kernel using
SRMMU operations.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Trivial removal of sun4c references in comments.

I left some around, like the ones in the openprom headers, since
we need to think about which pieces of those datastructures and
code we can completely toss now.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Remove sun4 and sun4c from enum sparc_cpu.

All the remaining references are trivially removed since we've
just eliminated the final reference to sparc_cpu_model from
assembler code in commit b7d96ce189564e661909fbf8df39d7358149885b
("sparc32: Remove sparc_cpu_model read from floppy interrupt handler.")

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Remove sparc_cpu_model read from floppy interrupt handler.

Since we no longer test the cpu model value, no need to load
it into a register any more.

It just gets overwritten in the next instruction anyways. :-)

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Kill unused defines from asm/head_32.h

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Remove some more sun4c code from floppy glue.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Remove sun4c tlb/vac insn patching from entry.S

No longer used.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Remove ldXa and stXa defines, unused.

These were for sharing some MMU code between sun4 and sun4c.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Remove sun4{,c} control reg definitions from contregs.h.

No longer used.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Remove sparc_lvl15_nmi().

No longer used.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Restore SMP build and rectify sun4m NMI when non-SMP.

The non-SMP sun4m NMI handler was still accessing SUN4C registers.

Fix that and share the sun4m NMI trap code between SMP and non-SMP
cases.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Kill asm/vac-ops.h

All sun4/sun4c stuff and unused.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Stop warning about sun4/sun4c in SMP Kconfig option.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Remove sun4c floppy assembler.

There were two blocks of code for the two ways to twiddle
the terminal count pin in the AUXIO register, one for
sun4c and one for sun4m.  Kill the former.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Put back SPARC_BRANCH.

It's needed for the floppy interrupt trap table patching.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Kill SUN4C_LOCK_{VADDR,END} and associated comment.

No longer used.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc: Clear out unused asm/machines.h values.

Remove sun4 and sun4c machine ID values from asm/machines.h

Also kill NUM_SUN_MACHINES, use ARRAY_SIZE instead.

Kill asm/machines.h include and sun4c checks from asm/floppy_32.h

Remove asm/machines.h include from setup_32.c and time_32.c, unused.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc: Convert some assembler over to linakge.h's ENTRY/ENDPROC

Use those, instead of doing it all by hand.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: Remove inline strncmp "optimization" for constant counts.

Let the compiler do stuff like this.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: use inline versions of pgprot_noncached, pte_to_pgoff and pgoff_to_pte

We no longer have different versions of these so use a few simple
static inline functions.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop btfixup for alloc_thread_info_node/free_thread_info

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop sun4c bits from head_32.S

As we no longer support sun4c we can remove all the code to
support remapping the kernel in head_32.S.
We also try to tell the user that the machine is not support,
in case someone try to boot the kernel on a sun4c one day

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop test for sun4c in signal_32

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop sun4c user stack checking routine

With this we no longer do any run-time patchings of traps.
So drop the function + macro to support this.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop sun4c stack checking routine

And drop run-time patching too.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop sun4c window overflow stack checking routine

Also drop run-time patching for srmmu

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop sun4c specific stack validation

This allows us to kill run-time patching for this function too

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: delete pgtsun4c.h

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: remove all uses of ARCH_SUN4C

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop sun4c specific ___xchg32 implementation

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: remove sun4c traps

We used to runtime patch the trap table for srmmu.
With the removal of sun4c support this is no longer required.

With the sun4c trap removed we can remove all the referenced
trap handling which is sun4c specific.
This also allows us to get rid of the nosun4c.c file that
contained only dummy functions/data.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: remove calls to sun4c dummy mm inits functions

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc32: drop sun4c support

Machines with sun4c support are very rare these days, and noone
is using them for any practical purposes.
The sun4c support has been know broken for quite some time too.

So rather than trying to keep it up-to-date, lets get rid of it.
This allows us to do some very welcome cleanup of sparc32 support.

Updated the former sun4c specifc nmi (which was also used
for sun4m UP) to be a generic UP NMI.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc: fix build fail in mm/init_64.c when NEED_MULTIPLE_NODES is off

Commit 625d693e9784f988371e69c2b41a2172c0be6c11 (linux-next)

    "sparc64: Convert over to NO_BOOTMEM."

causes the following compile failure for sparc64 allnoconfig:

  arch/sparc/mm/init_64.c:822:16: error: unused variable 'paddr'
  arch/sparc/mm/init_64.c:1759:7: error: unused variable 'node'
  arch/sparc/mm/init_64.c:809:12: error: 'memblock_nid_range' defined but not used

The paddr decl can easily be shuffled within the ifdef.  The
memblock_nid_range is just a stub function for when NEED_MULTIPLE_NODES
is off, but the only caller is within a NEED_MULTIPLE_NODES enabled
section, so we can simply delete it.

The unused "node" is slightly more interesting.  In the case of
"# CONFIG_NEED_MULTIPLE_NODES is not set" we no longer get the
definition of:

 #define NODE_DATA(nid)          (node_data[nid])

from arch/sparc/include/asm/mmzone.h - but instead we get:

 #define NODE_DATA(nid)          (&contig_page_data)

from include/linux/mmzone.h -- and since the arg is ignored,
the thing really is unused.  Rather than put in a confusing
looking __maybe_unused, simply splitting the declaration
from the assignment seemed to me to be the least offensive.

Cc: Sam Ravnborg <sam@ravnborg.org>
Cc: "David S. Miller" <davem@davemloft.net>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

sparc64: Do not set max_mapnr.

There is no need, since nothing relevant to sparc64 makes
use of this value.

Noticed by Sam Ravnborg.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc64: Use node local allocations for IRQ stacks.

Signed-off-by: David S. Miller <davem@davemloft.net>

sparc64: Convert over to NO_BOOTMEM.

With help from Sam Ravnborg.

Signed-off-by: David S. Miller <davem@davemloft.net>

Merge git://git./linux/kernel/git/torvalds/linux

Conflicts:
arch/sparc/kernel/leon_smp.c

Merge mainline to get the nobootmem.c bug fix, for the sake
of the sparc64 NO_BOOTMEM conversion.

Resolve a small include line conflict in leon_smp.c

Signed-off-by: David S. Miller <davem@davemloft.net>

Merge branch 'stable' of git://git./linux/kernel/git/cmetcalf/linux-tile

Pull arch/tile fixes from Chris Metcalf:
 "One change fixes a platform-independent bug about environment var
  handling in the boot command line.  The other is a trivial
  tile-specific bug fix to avoid a link-time warning."

* 'stable' of git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile:
  arch/tile: fix a couple of functions that should be __init
  init: fix bug where environment vars can't be passed via boot args

Merge tag 'ib-fixes' of git://git./linux/kernel/git/roland/infiniband

Pull infiniband fixes from Roland Dreier:
 "A few fixes for regressions introduced in 3.4-rc1:
   - fix memory leak in mlx4
   - fix two problems with new MAD response generation code"

* tag 'ib-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  IB/mlx4: Fix memory leaks in ib_link_query_port()
  IB/mad: Don't send response for failed MADs
  IB/mad: Set 'D' bit in response for unhandled MADs

Merge branch 'fixes' of git://git.infradead.org/users/vkoul/slave-dma

Pull [GIT PULL] slave-dmaengine fixes from Vinod Koul.

* 'fixes' of git://git.infradead.org/users/vkoul/slave-dma:
  dmaengine/amba-pl08x : reset phychan_hold on terminate all
  dma: pl330: fix a couple of compilation warnings
  dma/ste_dma40: fix erroneous comparison
  dma/ste_dma40: explicitly include regulator consumer header
  dma40: Improve the logic of stopping logical chan
  dmaengine: at_hdmac: remove clear-on-read in atc_dostart()
  dma: mxs-dma: enable channel in device_issue_pending call
  dmaengine: imx-dma: dont complete descriptor for cyclic dma

Merge tag 'sound-3.4' of git://git./linux/kernel/git/tiwai/sound

Pull sound fixes from Takashi Iwai:
 "A workaround for an ASUS laptop and a few ASoC changes; most of the
  commits are tagged for stable, too."

* tag 'sound-3.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ASoC: wm8994: Improve sequencing of AIF channel enables
  ALSA: HDA: Add external mic quirk for Asus Zenbook UX31E
  ASoC: fsi: update for dmaengine prep_slave_sg fallout.
  ASoC: core: Fix card RTD count for deferred probe.
  ASoC: cs42l73: don't use negative array index
  ASoC: dapm: Ensure power gets managed for line widgets

Merge git://www.linux-watchdog.org/linux-watchdog

Pull a watchdog fix from Wim Van Sebroeck:
 "It will fix the size when reading or writing to WD Timer port 0x72 in
  the hpwdt driver."

* git://www.linux-watchdog.org/linux-watchdog:
  hpwdt: Only BYTE reads/writes to WD Timer port 0x72

Merge branch 'timers-urgent-for-linus' of git://git./linux/kernel/git/tip/tip

Pull timer fixes from Thomas Gleixner.

* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  tick: Fix the spurious broadcast timer ticks after resume
  tick: Ensure that the broadcast device is initialized
  tick: Fix oneshot broadcast setup really

Merge branch 'akpm' (Andrew's patch-bomb)

Merge fixes from Andrew Morton:
 "13 fixes.  The acerhdf patches aren't (really) fixes.  But they've
  been stuck in my tree for up to two years, sent to Matthew multiple
  times and the developers are unhappy."

* emailed from Andrew Morton <akpm@linux-foundation.org>: (13 patches)
  mm: fix NULL ptr dereference in move_pages
  mm: fix NULL ptr dereference in migrate_pages
  revert "proc: clear_refs: do not clear reserved pages"
  drivers/rtc/rtc-ds1307.c: fix BUG shown with lock debugging enabled
  arch/arm/mach-ux500/mbox-db5500.c: world-writable sysfs fifo file
  hugetlbfs: lockdep annotate root inode properly
  acerhdf: lowered default temp fanon/fanoff values
  acerhdf: add support for new hardware
  acerhdf: add support for Aspire 1410 BIOS v1.3314
  fs/buffer.c: remove BUG() in possible but rare condition
  mm: fix up the vmscan stat in vmstat
  epoll: clear the tfile_check_list on -ELOOP
  mm/hugetlb: fix warning in alloc_huge_page/dequeue_huge_page_vma

hpwdt: Only BYTE reads/writes to WD Timer port 0x72

This patch is to correct the use of the iLO port 0x72 usage.
The port 0x72 is a byte size write/read and hpwdt is currently
writing a WORD.

Signed-off by: Thomas Mingarelli <thomas.mingarelli@hp.com>
Signed-off-by: Wim Van Sebroeck <wim@iguana.be>

Merge tag 'nfs-for-3.4-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs

Pull NFS client bugfixes from Trond Myklebust:
 - Fix NFSv4 infinite loops on open(O_TRUNC)
 - Fix an Oops and an infinite loop in the NFSv4 flock code
 - Don't register the PipeFS filesystem until it has been set up
 - Fix an Oops in nfs_try_to_update_request
 - Don't reuse NFSv4 open owners: fixes a bad sequence id storm.

* tag 'nfs-for-3.4-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  NFSv4: Keep dropped state owners on the LRU list for a while
  NFSv4: Ensure that we don't drop a state owner more than once
  NFSv4: Ensure we do not reuse open owner names
  nfs: Enclose hostname in brackets when needed in nfs_do_root_mount
  NFS: put open context on error in nfs_flush_multi
  NFS: put open context on error in nfs_pagein_multi
  NFSv4: Fix open(O_TRUNC) and ftruncate() error handling
  NFSv4: Ensure that we check lock exclusive/shared type against open modes
  NFSv4: Ensure that the LOCK code sets exception->inode
  NFS: check for req==NULL in nfs_try_to_update_request cleanup
  SUNRPC: register PipeFS file system after pernet sybsystem

Merge branch 'x86-urgent-for-linus' of git://git./linux/kernel/git/tip/tip

Pull x86 fixes from H. Peter Anvin.

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x32, siginfo: Provide proper overrides for x32 siginfo_t
  asm-generic: Allow overriding clock_t and add attributes to siginfo_t
  x32: Check __ILP32__ instead of __LP64__ for x32
  x86, acpi: Call acpi_enter_sleep_state via an asmlinkage C function from assembler
  ACPI: Convert wake_sleep_flags to a value instead of function
  x86, apic: APIC code touches invalid MSR on P5 class machines
  i387: ptrace breaks the lazy-fpu-restore logic
  x86/platform: Remove incorrect error message in x86_default_fixup_cpu_id()
  x86, efi: Add dedicated EFI stub entry point
  x86/amd: Remove broken links from comment and kernel message
  x86, microcode: Ensure that module is only loaded on supported AMD CPUs
  x86, microcode: Fix sysfs warning during module unload on unsupported CPUs

Merge branch 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86

Pull x86 platform driver fixes from Matthew Garrett:
 "One annoyance fix (make intel_ips stop complaining unnecessarily) and
  one oops fix (unterminated list in dell-laptop).  Both have been in
  -next for a while with no complaints."

* 'for_linus' of git://cavan.codon.org.uk/platform-drivers-x86:
  dell-laptop: Terminate quirks list properly
  intel_ips: Hush the i915 symbols message

mm: fix NULL ptr dereference in move_pages

Commit 3268c63 ("mm: fix move/migrate_pages() race on task struct") has
added an odd construct where 'mm' is checked for being NULL, and if it is,
it would get dereferenced anyways by mput()ing it.

Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Cc: Dave Hansen <dave@linux.vnet.ibm.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Hugh Dickins <hughd@google.com>
Acked-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

mm: fix NULL ptr dereference in migrate_pages

Commit 3268c63 ("mm: fix move/migrate_pages() race on task struct") has
added an odd construct where 'mm' is checked for being NULL, and if it is,
it would get dereferenced anyways by mput()ing it.

This would lead to the following NULL ptr deref and BUG() when calling
migrate_pages() with a pid that has no mm struct:

[25904.193704] BUG: unable to handle kernel NULL pointer dereference at 0000000000000050
[25904.194235] IP: [<ffffffff810b0de7>] mmput+0x27/0xf0
[25904.194235] PGD 773e6067 PUD 77da0067 PMD 0
[25904.194235] Oops: 0002 [#1] PREEMPT SMP
[25904.194235] CPU 2
[25904.194235] Pid: 31608, comm: trinity Tainted: G        W    3.4.0-rc2-next-20120412-sasha #69
[25904.194235] RIP: 0010:[<ffffffff810b0de7>]  [<ffffffff810b0de7>] mmput+0x27/0xf0
[25904.194235] RSP: 0018:ffff880077d49e08  EFLAGS: 00010202
[25904.194235] RAX: 0000000000000286 RBX: 0000000000000000 RCX: 0000000000000000
[25904.194235] RDX: ffff880075ef8000 RSI: 000000000000023d RDI: 0000000000000286
[25904.194235] RBP: ffff880077d49e18 R08: 0000000000000001 R09: 0000000000000001
[25904.194235] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[25904.194235] R13: 00000000ffffffea R14: ffff880034287740 R15: ffff8800218d3010
[25904.194235] FS:  00007fc8b244c700(0000) GS:ffff880029800000(0000) knlGS:0000000000000000
[25904.194235] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[25904.194235] CR2: 0000000000000050 CR3: 00000000767c6000 CR4: 00000000000406e0
[25904.194235] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[25904.194235] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[25904.194235] Process trinity (pid: 31608, threadinfo ffff880077d48000, task ffff880075ef8000)
[25904.194235] Stack:
[25904.194235]  ffff8800342876c0 0000000000000000 ffff880077d49f78 ffffffff811b8020
[25904.194235]  ffffffff811b7d91 ffff880075ef8000 ffff88002256d200 0000000000000000
[25904.194235]  00000000000003ff 0000000000000000 0000000000000000 0000000000000000
[25904.194235] Call Trace:
[25904.194235]  [<ffffffff811b8020>] sys_migrate_pages+0x340/0x3a0
[25904.194235]  [<ffffffff811b7d91>] ? sys_migrate_pages+0xb1/0x3a0
[25904.194235]  [<ffffffff8266cbb9>] system_call_fastpath+0x16/0x1b
[25904.194235] Code: c9 c3 66 90 55 31 d2 48 89 e5 be 3d 02 00 00 48 83 ec 10 48 89 1c 24 4c 89 64 24 08 48 89 fb 48 c7 c7 cf 0e e1 82 e8 69 18 03 00 <f0> ff 4b 50 0f 94 c0 84 c0 0f 84 aa 00 00 00 48 89 df e8 72 f1
[25904.194235] RIP  [<ffffffff810b0de7>] mmput+0x27/0xf0
[25904.194235]  RSP <ffff880077d49e08>
[25904.194235] CR2: 0000000000000050
[25904.348999] ---[ end trace a307b3ed40206b4b ]---

Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
Cc: Dave Hansen <dave@linux.vnet.ibm.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Christoph Lameter <cl@linux.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

revert "proc: clear_refs: do not clear reserved pages"

Revert commit 85e72aa5384 ("proc: clear_refs: do not clear reserved
pages"), which was a quick fix suitable for -stable until ARM had been
moved over to the gate_vma mechanism:

https://lkml.org/lkml/2012/1/14/55

With commit f9d4861f ("ARM: 7294/1: vectors: use gate_vma for vectors user
mapping"), ARM does now use the gate_vma, so the PageReserved check can be
removed from the proc code.

Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: Nicolas Pitre <nico@linaro.org>
Acked-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

drivers/rtc/rtc-ds1307.c: fix BUG shown with lock debugging enabled

Add struct bin_attribute initialization to fix the following bug:

rtc-ds1307 3-0068: rtc core: registered ds1307 as rtc0
BUG: key cfb14fcc not in .data!
------------[ cut here ]------------
WARNING: at kernel/lockdep.c:2986 sysfs_add_file_mode+0x84/0xdc()
Modules linked in:
[<c0018d94>] (unwind_backtrace+0x0/0xf8) from [<c0031f7c>] (warn_slowpath_common+0x4c/0x64)
[<c0031f7c>] (warn_slowpath_common+0x4c/0x64) from [<c0031fb0>] (warn_slowpath_null+0x1c/0x24)
[<c0031fb0>] (warn_slowpath_null+0x1c/0x24) from [<c012f7ac>] (sysfs_add_file_mode+0x84/0xdc)
[<c012f7ac>] (sysfs_add_file_mode+0x84/0xdc) from [<c04b11e4>] (ds1307_probe+0x5e4/0x6ac)
[<c04b11e4>] (ds1307_probe+0x5e4/0x6ac) from [<c036e600>] (i2c_device_probe+0xdc/0x108)
[<c036e600>] (i2c_device_probe+0xdc/0x108) from [<c02cdf84>] (driver_probe_device+0x90/0x210)
[<c02cdf84>] (driver_probe_device+0x90/0x210) from [<c02ce198>] (__driver_attach+0x94/0x98)
[<c02ce198>] (__driver_attach+0x94/0x98) from [<c02cc824>] (bus_for_each_dev+0x50/0x7c)
[<c02cc824>] (bus_for_each_dev+0x50/0x7c) from [<c02cd780>] (bus_add_driver+0x184/0x244)
[<c02cd780>] (bus_add_driver+0x184/0x244) from [<c02ce43c>] (driver_register+0x78/0x12c)
[<c02ce43c>] (driver_register+0x78/0x12c) from [<c03701ac>] (i2c_register_driver+0x2c/0xb4)
[<c03701ac>] (i2c_register_driver+0x2c/0xb4) from [<c0008798>] (do_one_initcall+0x34/0x178)
[<c0008798>] (do_one_initcall+0x34/0x178) from [<c0691860>] (kernel_init+0xdc/0x194)
[<c0691860>] (kernel_init+0xdc/0x194) from [<c0013cf0>] (kernel_thread_exit+0x0/0x8)

Since commit 6992f5334995af4 ("sysfs: Use one lockdep class per sysfs
attribute") this initialization is required.

Reported-by: Stefano Babic <sbabic@denx.de>
Tested-by: Stefano Babic <sbabic@denx.de>
Signed-off-by: Anatolij Gustschin <agust@denx.de>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Stefano Babic <sbabic@denx.de>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Greg Kroah-Hartman <gregkh@suse.de>
Acked-by: Wolfram Sang <w.sang@pengutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

arch/arm/mach-ux500/mbox-db5500.c: world-writable sysfs fifo file

Don't allow everybody to use a modem.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Cc: Srinidhi Kasagar <srinidhi.kasagar@stericsson.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Cc: Russell King <linux@arm.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

hugetlbfs: lockdep annotate root inode properly

This fixes the below reported false lockdep warning.  e096d0c7e2e4
("lockdep: Add helper function for dir vs file i_mutex annotation") added
a similar annotation for every other inode in hugetlbfs but missed the
root inode because it was allocated by a separate function.

For HugeTLB fs we allow taking i_mutex in mmap.  HugeTLB fs doesn't
support file write and its file read callback is modified in a05b0855fd
("hugetlbfs: avoid taking i_mutex from hugetlbfs_read()") to not take
i_mutex.  Hence for HugeTLB fs with regular files we really don't take
i_mutex with mmap_sem held.

 ======================================================
 [ INFO: possible circular locking dependency detected ]
 3.4.0-rc1+ #322 Not tainted
 -------------------------------------------------------
 bash/1572 is trying to acquire lock:
  (&mm->mmap_sem){++++++}, at: [<ffffffff810f1618>] might_fault+0x40/0x90

 but task is already holding lock:
  (&sb->s_type->i_mutex_key#12){+.+.+.}, at: [<ffffffff81125f88>] vfs_readdir+0x56/0xa8

 which lock already depends on the new lock.

 the existing dependency chain (in reverse order) is:

 -> #1 (&sb->s_type->i_mutex_key#12){+.+.+.}:
        [<ffffffff810a09e5>] lock_acquire+0xd5/0xfa
        [<ffffffff816a2f5e>] __mutex_lock_common+0x48/0x350
        [<ffffffff816a3325>] mutex_lock_nested+0x2a/0x31
        [<ffffffff811fb8e1>] hugetlbfs_file_mmap+0x7d/0x104
        [<ffffffff810f859a>] mmap_region+0x272/0x47d
        [<ffffffff810f8a39>] do_mmap_pgoff+0x294/0x2ee
        [<ffffffff810f8b65>] sys_mmap_pgoff+0xd2/0x10e
        [<ffffffff8103d19e>] sys_mmap+0x1d/0x1f
        [<ffffffff816a5922>] system_call_fastpath+0x16/0x1b

 -> #0 (&mm->mmap_sem){++++++}:
        [<ffffffff810a0256>] __lock_acquire+0xa81/0xd75
        [<ffffffff810a09e5>] lock_acquire+0xd5/0xfa
        [<ffffffff810f1645>] might_fault+0x6d/0x90
        [<ffffffff81125d62>] filldir+0x6a/0xc2
        [<ffffffff81133a83>] dcache_readdir+0x5c/0x222
        [<ffffffff81125fa8>] vfs_readdir+0x76/0xa8
        [<ffffffff811260b6>] sys_getdents+0x79/0xc9
        [<ffffffff816a5922>] system_call_fastpath+0x16/0x1b

 other info that might help us debug this:

  Possible unsafe locking scenario:

        CPU0                    CPU1
        ----                    ----
   lock(&sb->s_type->i_mutex_key#12);
                                lock(&mm->mmap_sem);
                                lock(&sb->s_type->i_mutex_key#12);
   lock(&mm->mmap_sem);

  *** DEADLOCK ***

 1 lock held by bash/1572:
  #0:  (&sb->s_type->i_mutex_key#12){+.+.+.}, at: [<ffffffff81125f88>] vfs_readdir+0x56/0xa8

 stack backtrace:
 Pid: 1572, comm: bash Not tainted 3.4.0-rc1+ #322
 Call Trace:
  [<ffffffff81699a3c>] print_circular_bug+0x1f8/0x209
  [<ffffffff810a0256>] __lock_acquire+0xa81/0xd75
  [<ffffffff810f38aa>] ? handle_pte_fault+0x5ff/0x614
  [<ffffffff8109e622>] ? mark_lock+0x2d/0x258
  [<ffffffff810f1618>] ? might_fault+0x40/0x90
  [<ffffffff810a09e5>] lock_acquire+0xd5/0xfa
  [<ffffffff810f1618>] ? might_fault+0x40/0x90
  [<ffffffff816a3249>] ? __mutex_lock_common+0x333/0x350
  [<ffffffff810f1645>] might_fault+0x6d/0x90
  [<ffffffff810f1618>] ? might_fault+0x40/0x90
  [<ffffffff81125d62>] filldir+0x6a/0xc2
  [<ffffffff81133a83>] dcache_readdir+0x5c/0x222
  [<ffffffff81125cf8>] ? sys_ioctl+0x74/0x74
  [<ffffffff81125cf8>] ? sys_ioctl+0x74/0x74
  [<ffffffff81125cf8>] ? sys_ioctl+0x74/0x74
  [<ffffffff81125fa8>] vfs_readdir+0x76/0xa8
  [<ffffffff811260b6>] sys_getdents+0x79/0xc9
  [<ffffffff816a5922>] system_call_fastpath+0x16/0x1b

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: Dave Jones <davej@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Josh Boyer <jwboyer@redhat.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>