* git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile: (27 commits)
  arch/tile: support newer binutils assembler shift semantics
  arch/tile: fix deadlock bugs in rwlock implementation
  drivers/edac: provide support for tile architecture
  tile on-chip network driver: sync up with latest fixes
  arch/tile: support 4KB page size as well as 64KB
  arch/tile: add some more VMSPLIT options and use consistent naming
  arch/tile: fix some comments and whitespace
  arch/tile: export some additional module symbols
  arch/tile: enhance existing finv_buffer_remote() routine
  arch/tile: fix two bugs in the backtracer code
  arch/tile: use extended assembly to inline __mb_incoherent()
  arch/tile: use a cleaner technique to enable interrupt for cpu_idle()
  arch/tile: sync up with <arch/sim.h> and <arch/sim_def.h> changes
  arch/tile: fix reversed test of strict_strtol() return value
  arch/tile: avoid a simulator warning during bootup
  arch/tile: export <asm/hardwall.h> to userspace
  arch/tile: warn and retry if an IPI is not accepted by the target cpu
  arch/tile: stop disabling INTCTRL_1 interrupts during hypervisor downcalls
  arch/tile: fix __ndelay etc to work better
  arch/tile: bug fix: exec'ed task thought it was still single-stepping
  ...

Fix up trivial conflict in arch/tile/kernel/vmlinux.lds.S (percpu
alignment vs section naming convention fix)

Merge branch 'omap-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6

* 'omap-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap-2.6: (258 commits)
  omap: zoom: host should not pull up wl1271's irq line
  arm: plat-omap: iommu: fix request_mem_region() error path
  OMAP2+: Common CPU DIE ID reading code reads wrong registers for OMAP4430
  omap4: mux: Remove duplicate mux modes
  omap: iovmm: don't check 'da' to set IOVMF_DA_FIXED flag
  omap: iovmm: disallow mapping NULL address when IOVMF_DA_ANON is set
  omap2+: mux: Fix compile when CONFIG_OMAP_MUX is not selected
  omap4: board-omap4panda: Initialise the serial pads
  omap3: board-3430sdp: Initialise the serial pads
  omap4: board-4430sdp: Initialise the serial pads
  omap2+: mux: Add macro for configuring static with omap_hwmod_mux_init
  omap2+: mux: Remove the use of IDLE flag
  omap2+: Add separate list for dynamic pads to mux
  perf: add OMAP support for the new power events
  OMAP4: Add IVA OPP enteries.
  OMAP4: Update Voltage Rail Values for MPU, IVA and CORE
  OMAP4: Enable 800 MHz and 1 GHz MPU-OPP
  OMAP3+: OPP: Replace voltage values with Macros
  OMAP3: wdtimer: Fix CORE idle transition
  Watchdog: omap_wdt: add fine grain runtime-pm
  ...

Fix up various conflicts in
 - arch/arm/mach-omap2/board-omap3evm.c
 - arch/arm/mach-omap2/clock3xxx_data.c
 - arch/arm/mach-omap2/usb-musb.c
 - arch/arm/plat-omap/include/plat/usb.h
 - drivers/usb/musb/musb_core.h

* 'for-linus' of git://codeaurora.org/quic/kernel/davidb/linux-msm: (46 commits)
  msm: scm: Check for interruption immediately
  msm: scm: Fix improper register assignment
  msm: scm: Mark inline asm as volatile
  msm: iommu: Enable HTW L2 redirection on MSM8960
  msm: iommu: Don't read from write-only registers
  msm: iommu: Remove dependency on IDR
  msm: iommu: Use ASID tagging instead of VMID tagging
  msm: iommu: Rework clock logic and add IOMMU bus clock control
  msm: iommu: Clock control for the IOMMU driver
  msm: mdp: Set the correct pack pattern for XRGB/ARGB
  msm_fb: Fix framebuffer console
  msm: mdp: Add support for RGBX 8888 image format.
  video: msmfb: Put the partial update magic value into the fix_screen struct.
  msm: clock: Migrate to clkdev
  msm: clock: Remove references to clk_ops_pcom
  msm: headsmp.S: Fix section mismatch
  msm: Use explicit GPLv2 licenses
  msm: iommu: Enable IOMMU support for MSM8960
  msm: iommu: Generalize platform data for multiple targets
  msm: iommu: Create a Kconfig item for the IOMMU driver
  ...

* 'devel-stable' of master.kernel.org:/home/rmk/linux-2.6-arm: (289 commits)
  davinci: DM644x EVM: register MUSB device earlier
  davinci: add spi devices on tnetv107x evm
  davinci: add ssp config for tnetv107x evm board
  davinci: add tnetv107x ssp platform device
  spi: add ti-ssp spi master driver
  mfd: add driver for sequencer serial port
  ARM: EXYNOS4: Implement Clock gating for System MMU
  ARM: EXYNOS4: Enhancement of System MMU driver
  ARM: EXYNOS4: Add support for gpio interrupts
  ARM: S5P: Add function to register gpio interrupt bank data
  ARM: S5P: Cleanup S5P gpio interrupt code
  ARM: EXYNOS4: Add missing GPYx banks
  ARM: S3C64XX: Fix section mismatch from cpufreq init
  ARM: EXYNOS4: Add keypad device to the SMDKV310
  ARM: EXYNOS4: Update clocks for keypad
  ARM: EXYNOS4: Update keypad base address
  ARM: EXYNOS4: Add keypad device helpers
  ARM: EXYNOS4: Add support for SATA on ARMLEX4210
  plat-nomadik: make GPIO interrupts work with cpuidle ApSleep
  mach-u300: define a dummy filter function for coh901318
  ...

Fix up various conflicts in
 - arch/arm/mach-exynos4/cpufreq.c
 - arch/arm/mach-mxs/gpio.c
 - drivers/net/Kconfig
 - drivers/tty/serial/Kconfig
 - drivers/tty/serial/Makefile
 - drivers/usb/gadget/fsl_mxc_udc.c
 - drivers/video/Kconfig

* 'defcfg' of master.kernel.org:/home/rmk/linux-2.6-arm:
  ARM: 6647/1: add Versatile Express defconfig
  ARM: 6644/1: mach-ux500: update the U8500 defconfig

* 'drivers' of master.kernel.org:/home/rmk/linux-2.6-arm:
  ARM: 6764/1: pl011: factor out FIFO to TTY code
  ARM: 6763/1: pl011: add optional RX DMA to PL011 v2
  ARM: 6758/1: amba: support pm ops
  ARM: amba: make amba_driver id_table const
  ARM: amba: make internal ID table handling const
  ARM: amba: make probe() functions take const id tables
  ARM: 6662/1: amba: make amba_bustype non-static
  ARM: mmci: add dmaengine-based DMA support
  ARM: mmci: no need for separate host->data_xfered
  ARM: mmci: avoid unnecessary switch to data available PIO interrupts
  ARM: mmci: no need to call flush_dcache_page() with sg_miter API
  ARM: mmci: avoid reporting too many completed bytes on fifo overrun
  ALSA: AACI: make fifo variables more explanitory
  ALSA: AACI: no need to call snd_pcm_period_elapsed() for each period
  ALSA: AACI: use snd_pcm_lib_period_bytes()
  ALSA: AACI: clean up AACI announcement printk
  ALSA: AACI: fix channel mask selection
  ALSA: AACI: fix number of channels for record
  ALSA: AACI: fix multiple IRQ claiming

* 'cyberpro-next' of master.kernel.org:/home/rmk/linux-2.6-arm:
  VIDEO: cyberpro: remove unused cyber2000fb_get_fb_var()
  VIDEO: cyberpro: remove useless function extreg pointers
  VIDEO: cyberpro: update handling of device structures
  VIDEO: cyberpro: add support for video capture I2C
  VIDEO: cyberpro: make 'reg_b0_lock' always present
  VIDEO: cyberpro: add I2C support
  VIDEO: cyberpro: select lowest multipler/divisor for PLL

* 'kvm-updates/2.6.39' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (55 commits)
  KVM: unbreak userspace that does not sets tss address
  KVM: MMU: cleanup pte write path
  KVM: MMU: introduce a common function to get no-dirty-logged slot
  KVM: fix rcu usage in init_rmode_* functions
  KVM: fix kvmclock regression due to missing clock update
  KVM: emulator: Fix permission checking in io permission bitmap
  KVM: emulator: Fix io permission checking for 64bit guest
  KVM: SVM: Load %gs earlier if CONFIG_X86_32_LAZY_GS=n
  KVM: x86: Remove useless regs_page pointer from kvm_lapic
  KVM: improve comment on rcu use in irqfd_deassign
  KVM: MMU: remove unused macros
  KVM: MMU: cleanup page alloc and free
  KVM: MMU: do not record gfn in kvm_mmu_pte_write
  KVM: MMU: move mmu pages calculated out of mmu lock
  KVM: MMU: set spte accessed bit properly
  KVM: MMU: fix kvm_mmu_slot_remove_write_access dropping intermediate W bits
  KVM: Start lock documentation
  KVM: better readability of efer_reserved_bits
  KVM: Clear async page fault hash after switching to real mode
  KVM: VMX: Initialize vm86 TSS only once.
  ...

* 'stable/xen.pm.bug-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen: use freeze/restore/thaw PM events for suspend/resume/chkpt
  xen: xenbus PM events support

Merge branches 'stable/irq.fairness' and 'stable/irq.ween_of_nr_irqs' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

* 'stable/irq.fairness' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen: events: Remove redundant clear of l2i at end of round-robin loop
  xen: events: Make round-robin scan fairer by snapshotting each l2 word once only
  xen: events: Clean up round-robin evtchn scan.
  xen: events: Make last processed event channel a per-cpu variable.
  xen: events: Process event channels notifications in round-robin order.

* 'stable/irq.ween_of_nr_irqs' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen: events: Fix compile error if CONFIG_SMP is not defined.
  xen: events: correct locking in xen_irq_from_pirq
  xen: events: propagate irq allocation failure instead of panicking
  xen: events: do not workaround too-small nr_irqs
  xen: events: remove use of nr_irqs as upper bound on number of pirqs
  xen: events: dynamically allocate irq info structures
  xen: events: maintain a list of Xen interrupts
  xen: events: push setup of irq<->{evtchn,ipi,virq,pirq} maps into irq_info init functions
  xen: events: turn irq_info constructors into initialiser functions
  xen: events: use per-cpu variable for cpu_evtchn_mask
  xen: events: refactor GSI pirq bindings functions
  xen: events: rename restore_cpu_pirqs -> restore_pirqs
  xen: events: remove unused public functions
  xen: events: fix xen_map_pirq_gsi error return
  xen: events: simplify comment
  xen: events: separate two unrelated halves of if condition

Fix up trivial conflicts in drivers/xen/events.c

Merge branches 'stable/hvc-console', 'stable/gntalloc.v6' and 'stable/balloon' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

* 'stable/hvc-console' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/hvc: Disable probe_irq_on/off from poking the hvc-console IRQ line.

* 'stable/gntalloc.v6' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen: gntdev: fix build warning
  xen/p2m/m2p/gnttab: do not add failed grant maps to m2p override
  xen-gntdev: Add cast to pointer
  xen-gntdev: Fix incorrect use of zero handle
  xen: change xen/[gntdev/gntalloc] to default m
  xen-gntdev: prevent using UNMAP_NOTIFY_CLEAR_BYTE on read-only mappings
  xen-gntdev: Avoid double-mapping memory
  xen-gntdev: Avoid unmapping ranges twice
  xen-gntdev: Use map->vma for checking map validity
  xen-gntdev: Fix unmap notify on PV domains
  xen-gntdev: Fix memory leak when mmap fails
  xen/gntalloc,gntdev: Add unmap notify ioctl
  xen-gntalloc: Userspace grant allocation driver
  xen-gntdev: Support mapping in HVM domains
  xen-gntdev: Add reference counting to maps
  xen-gntdev: Use find_vma rather than iterating our vma list manually
  xen-gntdev: Change page limit to be global instead of per-open

* 'stable/balloon' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: (24 commits)
  xen-gntdev: Use ballooned pages for grant mappings
  xen-balloon: Add interface to retrieve ballooned pages
  xen-balloon: Move core balloon functionality out of module
  xen/balloon: Remove pr_info's and don't alter retry_count
  xen/balloon: Protect against CPU exhaust by event/x process
  xen/balloon: Migration from mod_timer() to schedule_delayed_work()
  xen/balloon: Removal of driver_pages

* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (170 commits)
  [SCSI] scsi_dh_rdac: Add MD36xxf into device list
  [SCSI] scsi_debug: add consecutive medium errors
  [SCSI] libsas: fix ata list corruption issue
  [SCSI] hpsa: export resettable host attribute
  [SCSI] hpsa: move device attributes to avoid forward declarations
  [SCSI] scsi_debug: Logical Block Provisioning (SBC3r26)
  [SCSI] sd: Logical Block Provisioning update
  [SCSI] Include protection operation in SCSI command trace
  [SCSI] hpsa: fix incorrect PCI IDs and add two new ones (2nd try)
  [SCSI] target: Fix volume size misreporting for volumes > 2TB
  [SCSI] bnx2fc: Broadcom FCoE offload driver
  [SCSI] fcoe: fix broken fcoe interface reset
  [SCSI] fcoe: precedence bug in fcoe_filter_frames()
  [SCSI] libfcoe: Remove stale fcoe-netdev entries
  [SCSI] libfcoe: Move FCOE_MTU definition from fcoe.h to libfcoe.h
  [SCSI] libfc: introduce __fc_fill_fc_hdr that accepts fc_hdr as an argument
  [SCSI] fcoe, libfc: initialize EM anchors list and then update npiv EMs
  [SCSI] Revert "[SCSI] libfc: fix exchange being deleted when the abort itself is timed out"
  [SCSI] libfc: Fixing a memory leak when destroying an interface
  [SCSI] megaraid_sas: Version and Changelog update
  ...

Fix up trivial conflicts due to whitespace differences in
drivers/scsi/libsas/{sas_ata.c,sas_scsi_host.c}

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq:
  [CPUFREQ] pcc-cpufreq: remove duplicate statements
  [CPUFREQ] Remove the pm_message_t argument from driver suspend
  [CPUFREQ] Remove unneeded locks
  [CPUFREQ] Remove old, deprecated per cpu ondemand/conservative sysfs files
  [CPUFREQ] Remove deprecated sysfs file sampling_rate_max
  [CPUFREQ] powernow-k8: The table index is not worth displaying
  [CPUFREQ] calculate delay after dbs_check_cpu
  [CPUFREQ] Add documentation for sampling_down_factor
  [CPUFREQ] drivers/cpufreq: Remove unnecessary semicolons

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6:
  ext3: Always set dx_node's fake_dirent explicitly.
  ext3: Fix an overflow in ext3_trim_fs.
  jbd: Remove one to many n's in a word.
  ext3: skip orphan cleanup on rocompat fs
  ext2: Fix link count corruption under heavy link+rename load
  ext3: speed up group trim with the right free block count.
  ext3: Adjust trim start with first_data_block.
  quota: return -ENOMEM when memory allocation fails

* 'nfs-for-2.6.39' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6: (54 commits)
  RPC: killing RPC tasks races fixed
  xprt: remove redundant check
  SUNRPC: Convert struct rpc_xprt to use atomic_t counters
  SUNRPC: Ensure we always run the tk_callback before tk_action
  sunrpc: fix printk format warning
  xprt: remove redundant null check
  nfs: BKL is no longer needed, so remove the include
  NFS: Fix a warning in fs/nfs/idmap.c
  Cleanup: Factor out some cut-and-paste code.
  cleanup: save 60 lines/100 bytes by combining two mostly duplicate functions.
  NFS: account direct-io into task io accounting
  gss:krb5 only include enctype numbers in gm_upcall_enctypes
  RPCRDMA: Fix FRMR registration/invalidate handling.
  RPCRDMA: Fix to XDR page base interpretation in marshalling logic.
  NFSv4: Send unmapped uid/gids to the server when using auth_sys
  NFSv4: Propagate the error NFS4ERR_BADOWNER to nfs4_do_setattr
  NFSv4: cleanup idmapper functions to take an nfs_server argument
  NFSv4: Send unmapped uid/gids to the server if the idmapper fails
  NFSv4: If the server sends us a numeric uid/gid then accept it
  NFSv4.1: reject zero layout with zeroed stripe unit
  ...

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-udf-2.6:
  UDF: Fix compiler warning
  udf: Convert UDF to new truncate calling sequence

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: (38 commits)
  amd64_edac: Fix decode_syndrome types
  amd64_edac: Fix DCT argument type
  amd64_edac: Fix ranges signedness
  amd64_edac: Drop local variable
  amd64_edac: Fix PCI config addressing types
  amd64_edac: Fix DRAM base macros
  amd64_edac: Fix node id signedness
  amd64_edac: Drop redundant declarations
  amd64_edac: Enable driver on F15h
  amd64_edac: Adjust ECC symbol size to F15h
  amd64_edac: Simplify scrubrate setting
  PCI: Rename CPU PCI id define
  amd64_edac: Improve DRAM address mapping
  amd64_edac: Sanitize ->read_dram_ctl_register
  amd64_edac: Adjust sys_addr to chip select conversion routine to F15h
  amd64_edac: Beef up early exit reporting
  amd64_edac: Revamp online spare handling
  amd64_edac: Fix channel interleave removal
  amd64_edac: Correct node interleaving removal
  amd64_edac: Add support for interleaved region swapping
  ...

Fix up trivial conflict in include/linux/pci_ids.h due to
AMD_15H_NB_MISC being renamed as AMD_15H_NB_F3 next to the new
AMD_15H_NB_LINK entry.

* 'for-linus/2639/i2c-1' of git://git.fluff.org/bjdooks/linux:
  i2c-mpc: Add support for 64bit system
  i2c: add driver for Freescale i.MX28
  i2c: tegra: Add i2c support

* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
  watchdog: booke_wdt: clean up status messages
  watchdog: cleanup spaces before tabs
  watchdog: convert to DEFINE_PCI_DEVICE_TABLE
  watchdog: Xen watchdog driver
  watchdog: Intel SCU Watchdog Timer Driver for Moorestown and Medfield platforms.
  watchdog: jz4740_wdt - fix magic character checking
  watchdog: add JZ4740 watchdog driver
  watchdog: it87_wdt: Add support for IT8721F watchdog
  watchdog: hpwdt: build hpwdt as module by default with NMI_DECODING enabled
  watchdog: hpwdt: Fix a couple of typos

* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: (44 commits)
  hwmon: (lineage-pem): Fix in1 voltage alarm sysfs attributes
  hwmon/f71882fg: Add support for f71808e
  hwmon/f71882fg: Add support for f71869f and f71869e
  hwmon/f71882fg: Add support for f71889ed
  hwmon/f71882fg: Break out test for auto pwm's controlled by digital readings
  hwmon/f71882fg: Separate temp beep sysfs attr from the other temp sysfs attr
  hwmon/f71882fg: Remove bogus temp2_type for certain models
  hwmon/f71882fg: Make number of temps configurable
  hwmon/f71882fg: Make creation of in sysfs attributes more generic
  hwmon/f71882fg: Only allow negative auto point temps if fan_neg_temp is enabled
  hwmon/f71882fg: Fix temp1 sensor type reporting
  hwmon: (w83627ehf) Display correct temperature sensor labels for systems with NCT6775F
  hwmon: (w83627ehf) Add fan debounce support for NCT6775F and NCT6776F
  hwmon: (w83627ehf) Update Kconfig for W83677HG-B, NCT6775F and NCT6776F
  hwmon: (w83627ehf) Store rpm instead of raw fan speed data
  hwmon: (w83627ehf) Use 16 bit fan count registers if supported
  hwmon: (w83627ehf) Add support for Nuvoton NCT6775F and NCT6776F
  hwmon: (w83627ehf) Permit enabling SmartFan IV mode if configured at startup
  hwmon: (w83627ehf) Convert register arrays to 16 bit, and convert access to pointers
  hwmon: (w83627ehf) Remove references to datasheets which no longer exist
  ...

Use the newly added smp_call_func_t in smp_call_function_interrupt for
the func variable, and make the comment above the WARN more assertive
and explicit.  Also, func is a function pointer and does not need an
offset, so use %pf not %pS.
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Mike Galbraith reported finding a lockup ("perma-spin bug") where the
cpumask passed to smp_call_function_many was cleared by other cpu(s)
while a cpu was preparing its call_data block, resulting in no cpu to
clear the last ref and unlock the block.

Having cpus clear their bit asynchronously could be useful on a mask of
cpus that might have a translation context, or cpus that need a push to
complete an rcu window.

Instead of adding a BUG_ON and requiring yet another cpumask copy, just
detect the race and handle it.

Note: arch_send_call_function_ipi_mask must still handle an empty
cpumask because the data block is globally visible before the that arch
callback is made.  And (obviously) there are no guarantees to which cpus
are notified if the mask is changed during the call; only cpus that were
online and had their mask bit set during the whole call are guaranteed
to be called.
Reported-by: Mike Galbraith <efault@gmx.de>
Reported-by: Jan Beulich <JBeulich@novell.com>
Acked-by: Jan Beulich <jbeulich@novell.com>
Cc: stable@kernel.org
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Paul McKenney's review pointed out two problems with the barriers in the
2.6.38 update to the smp call function many code.

First, a barrier that would force the func and info members of data to
be visible before their consumption in the interrupt handler was
missing.  This can be solved by adding a smp_wmb between setting the
func and info members and setting setting the cpumask; this will pair
with the existing and required smp_rmb ordering the cpumask read before
the read of refs.  This placement avoids the need a second smp_rmb in
the interrupt handler which would be executed on each of the N cpus
executing the call request.  (I was thinking this barrier was present
but was not).

Second, the previous write to refs (establishing the zero that we the
interrupt handler was testing from all cpus) was performed by a third
party cpu.  This would invoke transitivity which, as a recient or
concurrent addition to memory-barriers.txt now explicitly states, would
require a full smp_mb().

However, we know the cpumask will only be set by one cpu (the data
owner) and any preivous iteration of the mask would have cleared by the
reading cpu.  By redundantly writing refs to 0 on the owning cpu before
the smp_wmb, the write to refs will follow the same path as the writes
that set the cpumask, which in turn allows us to keep the barrier in the
interrupt handler a smp_rmb instead of promoting it to a smp_mb (which
will be be executed by N cpus for each of the possible M elements on the
list).

I moved and expanded the comment about our (ab)use of the rcu list
primitives for the concurrent walk earlier into this function.  I
considered moving the first two paragraphs to the queue list head and
lock, but felt it would have been too disconected from the code.

Cc: Paul McKinney <paulmck@linux.vnet.ibm.com>
Cc: stable@kernel.org (2.6.32 and later)
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Peter pointed out there was nothing preventing the list_del_rcu in
smp_call_function_interrupt from running before the list_add_rcu in
smp_call_function_many.

Fix this by not setting refs until we have gotten the lock for the list.
Take advantage of the wmb in list_add_rcu to save an explicit additional
one.

I tried to force this race with a udelay before the lock & list_add and
by mixing all 64 online cpus with just 3 random cpus in the mask, but
was unsuccessful.  Still, inspection shows a valid race, and the fix is
a extension of the existing protection window in the current code.

Cc: stable@kernel.org (v2.6.32 and later)
Reported-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change the _mapcount value indicating PageBuddy from -2 to -128 for
more robusteness against page_mapcount() undeflows.

Use reset_page_mapcount instead of __ClearPageBuddy in bad_page to
ignore the previous retval of PageBuddy().
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Reported-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This change supports building the kernel with newer binutils where
a shift of greater than the word size is no longer interpreted
silently as modulo the word size, but instead generates a warning.
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>

Merge tag 'v2.6.38' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6 into for-linus

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/epip/linux-2.6-unicore32: (40 commits)
  unicore32: rewrite arch-specific tlb.h to use asm-generic version
  unicore32: modify io_p2v and io_v2p macros, and adjust PKUNITY_mmio_BASEs
  unicore32: replace unicore32-specific iomap functions with generic lib implementation
  unicore32 machine related: add frame buffer driver for pkunity-v3 soc
  unicore32 machine related files: add i2c bus drivers for pkunity-v3 soc
  unicore32 io: redefine __REG(x) and re-use readl/writel funcs
  unicore32 i8042 upgrade and bugfix: adjust resource request region type
  unicore32 upgrade to v2.6.38-rc5: add one more paramter for pte_alloc_map call
  unicore32 i8042: adjust io funcs of i8042-unicore32io.h
  unicore32: rename PKUNITY_IOSPACE_BASE to PKUNITY_MMIO_BASE
  unicore32: modify function names and parameters for irq_chips
  unicore32: remove unused lines in arch/unicore32/include/asm/irq.h
  unicore32 time.c: change calculate method for clock_event_device
  unicore32: ADD MAINTAINER for unicore32 architecture
  unicore32 machine related files: ps2 driver
  unicore32 machine related files: pci bus handling
  unicore32 machine related files: hardware registers
  unicore32 machine related files: core files
  unicore32 additional architecture files: boot process
  unicore32 additional architecture files: low-level lib: misc
  ...
Acked-by: Arnd Bergmann <arnd@arndb.de>

* 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6:
  [S390] kexec: Disable ftrace during kexec
  [S390] support XZ compressed kernel
  [S390] css_bus_type: make it static
  [S390] css_driver: remove duplicate members
  [S390] css: remove subchannel private
  [S390] css: move chsc_private to drv_data
  [S390] css: move io_private to drv_data
  [S390] cio: move cdev pointer to io_subchannel_private
  [S390] cio: move options to io_sch_private
  [S390] cio: move asms to generic header
  [S390] cio: move orb definitions to separate header
  [S390] Write protect module text and RO data
  [S390] dasd: get rid of compile warning
  [S390] remove superfluous check from do_IRQ
  [S390] remove redundant stack check option

* 'sh-latest' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: (34 commits)
  sh: Convert to generic show_interrupts.
  sh: Wire up new fhandle and clock_adjtime syscalls.
  sh: modify platform_device for sh_eth driver
  sh: add GETHER's platform_device in board-sh7757lcr
  sh: update sh7757lcr_defconfig
  sh: add platform_device of tmio_mmc and sh_mmcif to sh7757lcr
  sh: dmaengine support for SH7757
  sh: add mmc clock in clock-sh7757
  sh: add spi_board_info in sh7757lcr
  sh: add platform_device for SPI
  sh: add USB_ARCH_HAS_EHCI and OHCI for SH7757
  sh: Rename cpuidle states to fit general conventions
  serial: sh-sci: fix deadlock when resuming from S3 sleep
  sh: Enable CONFIG_GCOV_PROFILE_ALL for sh
  sh: Fix up async PCIe probing on SMP.
  serial: sh-sci: Kill off the special earlyprintk device.
  serial: sh-sci: Use dev_name() for region reservations.
  serial: sh-sci: Fix up earlyprintk port mapping.
  serial: sh-sci: Limit early console to one device.
  serial: sh-sci: Fix up break timer scheduling race.
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6:
  fbdev: sh_mobile_lcdc: Add YUV framebuffer support
  viafb: split pll configs up
  viafb: remove duplicated clock storage
  viafb: always return the best possible clock
  viafb: remove duplicated clock information
  fbdev: sh_mobile_lcdcfb: add backlight support
  viafb: factor lcd scaling parameters out
  viafb: strip some structures
  viafb: remove unused data_mode and device_type
  viafb: kill lcd_panel_id
  video via: make local variables static
  video via: fix iomem access
  video/via: drop deprecated (and unused) i2c_adapter.id

RPC task RPC_TASK_QUEUED bit is set must be checked before trying to wake up
task rpc_killall_tasks() because task->tk_waitqueue can not be set (equal to
NULL).
Also, as Trond Myklebust mentioned, such approach (instead of checking
tk_waitqueue to NULL) allows us to "optimise away the call to
rpc_wake_up_queued_task() altogether for those
tasks that aren't queued".

Here is an example of dereferencing of tk_waitqueue equal to NULL:

CPU 0               	CPU 1				CPU 2
--------------------	---------------------	--------------------------
nfs4_run_open_task
rpc_run_task
rpc_execute
rpc_set_active
rpc_make_runnable
(waiting)
			rpc_async_schedule
			nfs4_open_prepare
			nfs_wait_on_sequence
						nfs_umount_begin
						rpc_killall_tasks
						rpc_wake_up_task
						rpc_wake_up_queued_task
						spin_lock(tk_waitqueue == NULL)
						BUG()
			rpc_sleep_on
			spin_lock(&q->lock)
			__rpc_sleep_on
			task->tk_waitqueue = q
Signed-off-by: Stanislav Kinsbursky <skinsbursky@openvz.org>
Cc: stable@kernel.org
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

remove redundant check.
Signed-off-by: Jinqiu Yang <crindy646@gmail.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

This fixes a race in which the task->tk_callback() puts the rpc_task
to sleep, setting a new callback. Under certain circumstances, the current
code may end up executing the task->tk_action before it gets round to the
callback.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: stable@kernel.org

* 'drm-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (177 commits)
  drm/radeon: fixup refcounts in radeon dumb create ioctl.
  drm: radeon: *_cs_packet_parse_vline() cleanup
  radeon: merge list_del()/list_add_tail() to list_move_tail()
  drm: Retry i2c transfer of EDID block after failure
  drm/radeon/kms: fix typo in atom overscan setup
  drm: Hold the mode mutex whilst probing for sysfs status
  drm/nouveau: fix __nouveau_fence_wait performance
  drm/nv40: attempt to reserve just enough vram for all 32 channels
  drm/nv50: check for vm traps on every gr irq
  drm/nv50: decode vm faults some more
  drm/nouveau: add nouveau_enum_find() util function
  drm/nouveau: properly handle pushbuffer check failures
  drm/nvc0: remove vm hack forcing large/small pages to not share a PDE
  drm/i915: disable opregion lid detection for now.
  drm/i915: Only wait on a pending flip if we intend to write to the buffer
  drm/i915/dp: Sanity check eDP existence
  drm: add cap bit to denote if dumb ioctl is available or not.
  drm/core: add ioctl to query device/driver capabilities
  drm/radeon/kms: allow max clock of 340 Mhz on hdmi 1.3+
  drm/radeon/kms: add cayman pci ids
  ...

Commit 6440e5967bc broke old userspaces that do not set tss address
before entering vcpu. Unbreak it by setting tss address to a safe
value on the first vcpu entry. New userspaces should set tss address,
so print warning in case it doesn't.
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

This patch does:
- call vcpu->arch.mmu.update_pte directly
- use gfn_to_pfn_atomic in update_pte path

The suggestion is from Avi.
Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

Cleanup the code of pte_prefetch_gfn_to_memslot and mapping_level_dirty_bitmap
Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

fix:
[ 3494.671786] stack backtrace:
[ 3494.671789] Pid: 10527, comm: qemu-system-x86 Not tainted 2.6.38-rc6+ #23
[ 3494.671790] Call Trace:
[ 3494.671796]  [] ? lockdep_rcu_dereference+0x9d/0xa5
[ 3494.671826]  [] ? kvm_memslots+0x6b/0x73 [kvm]
[ 3494.671834]  [] ? gfn_to_memslot+0x16/0x4f [kvm]
[ 3494.671843]  [] ? gfn_to_hva+0x16/0x27 [kvm]
[ 3494.671851]  [] ? kvm_write_guest_page+0x31/0x83 [kvm]
[ 3494.671861]  [] ? kvm_clear_guest_page+0x1a/0x1c [kvm]
[ 3494.671867]  [] ? vmx_set_tss_addr+0x83/0x122 [kvm_intel]

and:
[ 8328.789599] stack backtrace:
[ 8328.789601] Pid: 18736, comm: qemu-system-x86 Not tainted 2.6.38-rc6+ #23
[ 8328.789603] Call Trace:
[ 8328.789609]  [] ? lockdep_rcu_dereference+0x9d/0xa5
[ 8328.789621]  [] ? kvm_memslots+0x6b/0x73 [kvm]
[ 8328.789628]  [] ? gfn_to_memslot+0x16/0x4f [kvm]
[ 8328.789635]  [] ? gfn_to_hva+0x16/0x27 [kvm]
[ 8328.789643]  [] ? kvm_write_guest_page+0x31/0x83 [kvm]
[ 8328.789699]  [] ? kvm_clear_guest_page+0x1a/0x1c [kvm]
[ 8328.789713]  [] ? vmx_create_vcpu+0x316/0x3c8 [kvm_intel]
Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

commit 387b9f97750444728962b236987fbe8ee8cc4f8c moved kvm_request_guest_time_update(vcpu),
breaking 32bit SMP guests using kvm-clock. Fix this by moving (new) clock update function
to proper place.
Signed-off-by: Nikola Ciprich <nikola.ciprich@linuxbox.cz>
Acked-by: Zachary Amsden <zamsden@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

Currently if io port + len crosses 8bit boundary in io permission bitmap the
check may allow IO that otherwise should not be allowed. The patch fixes that.
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>