ACPI idle, CPU hotplug: Fix NULL pointer dereference during hotplug

On a KVM guest, when a CPU is taken offline and brought back online, we hit
the following NULL pointer dereference:

[   45.400843] Unregister pv shared memory for cpu 1
[   45.412331] smpboot: CPU 1 is now offline
[   45.529894] SMP alternatives: lockdep: fixing up alternatives
[   45.533472] smpboot: Booting Node 0 Processor 1 APIC 0x1
[   45.411526] kvm-clock: cpu 1, msr 0:7d14601, secondary cpu clock
[   45.571370] KVM setup async PF for cpu 1
[   45.572331] kvm-stealtime: cpu 1, msr 7d0e040
[   45.575031] BUG: unable to handle kernel NULL pointer dereference at           (null)
[   45.576017] IP: [<ffffffff81519f98>] cpuidle_disable_device+0x18/0x80
[   45.576017] PGD 5dfb067 PUD 5da8067 PMD 0
[   45.576017] Oops: 0000 [#1] SMP
[   45.576017] Modules linked in:
[   45.576017] CPU 0
[   45.576017] Pid: 607, comm: stress_cpu_hotp Not tainted 3.6.0-padata-tp-debug #3 Bochs Bochs
[   45.576017] RIP: 0010:[<ffffffff81519f98>]  [<ffffffff81519f98>] cpuidle_disable_device+0x18/0x80
[   45.576017] RSP: 0018:ffff880005d93ce8  EFLAGS: 00010286
[   45.576017] RAX: ffff880005d93fd8 RBX: 0000000000000000 RCX: 0000000000000006
[   45.576017] RDX: 0000000000000006 RSI: 2222222222222222 RDI: 0000000000000000
[   45.576017] RBP: ffff880005d93cf8 R08: 2222222222222222 R09: 2222222222222222
[   45.576017] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
[   45.576017] R13: 0000000000000000 R14: ffffffff81c8cca0 R15: 0000000000000001
[   45.576017] FS:  00007f91936ae700(0000) GS:ffff880007c00000(0000) knlGS:0000000000000000
[   45.576017] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   45.576017] CR2: 0000000000000000 CR3: 0000000005db3000 CR4: 00000000000006f0
[   45.576017] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[   45.576017] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[   45.576017] Process stress_cpu_hotp (pid: 607, threadinfo ffff880005d92000, task ffff8800066bbf40)
[   45.576017] Stack:
[   45.576017]  ffff880007a96400 0000000000000000 ffff880005d93d28 ffffffff813ac689
[   45.576017]  ffff880007a96400 ffff880007a96400 0000000000000002 ffffffff81cd8d01
[   45.576017]  ffff880005d93d58 ffffffff813aa498 0000000000000001 00000000ffffffdd
[   45.576017] Call Trace:
[   45.576017]  [<ffffffff813ac689>] acpi_processor_hotplug+0x55/0x97
[   45.576017]  [<ffffffff813aa498>] acpi_cpu_soft_notify+0x93/0xce
[   45.576017]  [<ffffffff816ae47d>] notifier_call_chain+0x5d/0x110
[   45.576017]  [<ffffffff8109730e>] __raw_notifier_call_chain+0xe/0x10
[   45.576017]  [<ffffffff81069050>] __cpu_notify+0x20/0x40
[   45.576017]  [<ffffffff81069085>] cpu_notify+0x15/0x20
[   45.576017]  [<ffffffff816978f1>] _cpu_up+0xee/0x137
[   45.576017]  [<ffffffff81697983>] cpu_up+0x49/0x59
[   45.576017]  [<ffffffff8168758d>] store_online+0x9d/0xe0
[   45.576017]  [<ffffffff8140a9f8>] dev_attr_store+0x18/0x30
[   45.576017]  [<ffffffff812322c0>] sysfs_write_file+0xe0/0x150
[   45.576017]  [<ffffffff811b389c>] vfs_write+0xac/0x180
[   45.576017]  [<ffffffff811b3be2>] sys_write+0x52/0xa0
[   45.576017]  [<ffffffff816b31e9>] system_call_fastpath+0x16/0x1b
[   45.576017] Code: 48 c7 c7 40 e5 ca 81 e8 07 d0 18 00 5d c3 0f 1f 44 00 00 0f 1f 44 00 00 55 48 89 e5 48 83 ec 10 48 89 5d f0 4c 89 65 f8 48 89 fb <f6> 07 02 75 13 48 8b 5d f0 4c 8b 65 f8 c9 c3 66 0f 1f 84 00 00
[   45.576017] RIP  [<ffffffff81519f98>] cpuidle_disable_device+0x18/0x80
[   45.576017]  RSP <ffff880005d93ce8>
[   45.576017] CR2: 0000000000000000
[   45.656079] ---[ end trace 433d6c9ac0b02cef ]---

Analysis:
Commit 3d339dc (cpuidle / ACPI : move cpuidle_device field out of the
acpi_processor_power structure()) made the allocation of the dev structure
(struct cpuidle) of a CPU dynamic, whereas previously it was statically
allocated. And this dynamic allocation occurs in acpi_processor_power_init()
if pr->flags.power evaluates to non-zero.

On KVM guests, pr->flags.power evaluates to zero, hence dev is never
allocated. This causes the NULL pointer (dev) dereference in
cpuidle_disable_device() during a subsequent CPU online operation. Fix this
by ensuring that dev is non-NULL before dereferencing.

Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Signed-off-by: Len Brown <len.brown@intel.com>
drm/nouveau: remove unused _nouveau_parent_ctor

Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
drm/nv50/clk: wire up pll_calc hook

Fixes crash during reclocking.
Call Trace:
 pll_calc == NULL
 calc_pll
 calc_mclk
 nv50_pm_clocks_pre
 nouveau_pm_perflvl_set
 nouveau_pm_trigger
 nouveau_pm_profile_set
 nouveau_pm_set_perflvl
 dev_attr_store
 sysfs_write_file
 vfs_write
 sys_write
 system_call_fastpath

Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/fan: fix a typo in PWM's input clock calculation

Reported-by: Jukka Hopeavuori <jukka.hopea@gmail.com>
Signed-off-by: Martin Peres <martin.peres@labri.fr>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
drm/nouveau/timer: bump ptimer's alarm delay from u32 to u64

This is needed for automatic fan management where some delays
can be over 0xffffffff ns.

Signed-off-by: Martin Peres <martin.peres@labri.fr>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
net: fix typo in freescale/ucc_geth.c

The following patch:
  acb600d net: remove skb recycling
added dev_free_skb() to drivers/net/ethernet/freescale/ucc_geth.c

This is a typo and should be dev_kfree_skb().  This fixes this.

Signed-off-by: Michael Neuling <mikey@neuling.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
ARM: OMAP3: fix workaround for EMU clockdomain

Commit b71c721 (ARM: OMAP2+: clockdomain/hwmod: add workaround for EMU
clockdomain idle problems) added a workaround for the EMU clock domain on
OMAP3/4 devices to prevent the clock domain for transitioning while it is
in use.

In the proposed patch [1] code was added to the omap3xxx_clkdm_clk_enable()
and omap3xxx_clkdm_clk_disable() functions to check for the flag
CLKDM_MISSING_IDLE_REPORTING and perform the appropriate action. However, in the
merged patch it appears that this code was added to the omap2_clkdm_clk_enable()
and omap2_clkdm_clk_disable() functions by mistake.

[1] http://marc.info/?l=linux-arm-kernel&m=134383567112518&w=2

Signed-off-by: Jon Hunter <jon-hunter@ti.com>
Signed-off-by: Paul Walmsley <paul@pwsan.com>
Merge branch 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-next

Just misc nouveau fixes all over the place.

* 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
  drm/nouveau/timer: bump ptimer's alarm delay from u32 to u64
  drm/nouveau/fan: fix a typo in PWM's input clock calculation
  drm/nv50/clk: wire up pll_calc hook
  drm/nouveau: remove unused _nouveau_parent_ctor
  drm/nouveau/bios: fix shadowing of ACPI ROMs larger than 64KiB
tools/power/acpi/acpidump: remove duplicated include from acpidump.c

Remove duplicated include.

dpatch engine is used to auto generate this patch.
(https://github.com/weiyj/dpatch)

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Len Brown <len.brown@intel.com>
ARM: OMAP4/AM335x: hwmod: fix disable_module regression in hardreset handling

Commit eb05f691290e99ee0bd1672317d6add789523c1e ("ARM: OMAP: hwmod:
partially un-reset hwmods might not be properly enabled") added code
to skip the IP block disable sequence if all of the block's hardreset
lines weren't asserted.  But this did not handle the case when no
hardreset lines were associated with a module, which is the general
case.  In that situation, the IP block disable would be skipped.  This
is likely to cause PM regressions.

So, modify _omap4_disable_module() and _am33xx_disable_module() to
only bail out early if there are any hardreset lines asserted.  And
move the AM33xx test above the actual module disable code to ensure
that the behavior is consistent.

Reported-by: Archit Taneja <a0393947@ti.com>
Tested-by: Archit Taneja <a0393947@ti.com> # DSS
Cc: Omar Ramirez Luna <omar.luna@linaro.org>
Cc: Vaibhav Hiremath <hvaibhav@ti.com>
Acked-by: Vaibhav Hiremath <hvaibhav@ti.com>
Tested-by: Vaibhav Hiremath <hvaibhav@ti.com> # AM335x
Signed-off-by: Paul Walmsley <paul@pwsan.com>
Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux into thermal

Conflicts:
	drivers/staging/omap-thermal/omap-thermal-common.
		OMAP supplied dummy TC1 and TC2,
		at the same time that the thermal tree removed them
		from thermal_zone_device_register()

	drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c
		propogate the upstream MAX_IDR_LEVEL re-name
			to prevent a build failure

	Previously-fixed-by: Stephen Rothwell <sfr@canb.auug.org.au>

Signed-off-by: Len Brown <len.brown@intel.com>
Merge branches 'fixes-for-37', 'ec' and 'thermal' into release
ARM: pxa: Fix build error caused by sram.h rename

Commit 293b2da1b61 ("ARM: pxa: move platform_data definitions")
renamed arch/arm/mach-mmp/include/mach/sram.h to
include/linux/platform_data/dma-mmp_tdma.h, but didn't update
mmp-pcm.c which uses the header.  Fix the build error.

Signed-off-by: Chris Ball <cjb@laptop.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
ASoC: fix documentation in soc-jack

Signed-off-by: Peter Meerwald <pmeerw@pmeerw.net>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
ASoC: fsi: don't reschedule DMA from an atomic context

shdma doesn't support transfer re-scheduling or triggering from callbacks
or from atomic context. The fsi driver issues DMA transfers from a tasklet
context, which is a bug. To fix it convert tasklet to a work.

Reported-by: Do Q.Thang <dq-thang@jinso.co.jp>
Tested-by: Do Q.Thang <dq-thang@jinso.co.jp>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Cc: stable@vger.kernel.org
Fix F_DUPFD_CLOEXEC breakage

Fix a braino in F_DUPFD_CLOEXEC; f_dupfd() expects flags for alloc_fd(),
get_unused_fd() etc and there clone-on-exec if O_CLOEXEC, not
FD_CLOEXEC.

Reported-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Merge branch 'linux-next' of git://git.open-osd.org/linux-open-osd

Pull exofs update from Boaz Harrosh:
 "Just three one liners"

* 'linux-next' of git://git.open-osd.org/linux-open-osd:
  pnfs_osd_xdr: Remove unused #include from pnfs_osd_xdr.h
  ore: signedness bug in _sp2d_min_pg()
  exofs: check for allocation failure in uri_store()
ASoC: dmaengine: Correct Makefile when sound is built as module

soc-dmaengine-pcm library need to be part of the snd-soc-core in order to
be able to compile ASoC as modules when dmaengine is enabled on the platform.

Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Merge tag 'asm-generic' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic

Pull asm-generic updates from Arnd Bergmann:
 "This has three changes for asm-generic that did not really fit into
  any other branch as normal asm-generic changes do.  One is a fix for a
  build warning, the other two are more interesting:

   * A patch from Mark Brown to allow using the common clock
     infrastructure on all architectures, so we can use the clock API in
     architecture independent device drivers.

   * The UAPI split patches from David Howells for the asm-generic
     files.  There are other architecture specific series that are going
     through the arch maintainer tree and that depend on this one.

  There may be a few small merge conflicts between Mark's patch and the
  following arch header file split patches.  In each case the solution
  will be to keep the new "generic-y += clkdev.h" line, even if it ends
  up being the only line in the Kbuild file."

* tag 'asm-generic' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic:
  UAPI: (Scripted) Disintegrate include/asm-generic
  asm-generic: Add default clkdev.h
  asm-generic: xor: mark static functions as __maybe_unused
Merge branch 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus

Pull MIPS update from Ralf Baechle:
 "This is the MIPS update for 3.7.

  A fair chunk of them are platform updates to the Cavium Octeon SOC
  (which involves machine generated header files of considerable size),
  Atheros ATH79xx, RMI aka Netlogic aka Broadcom XLP, Broadcom BCM63xx
  platforms.

  Support for the commercial MIPS simulator MIPSsim has been removed as
  MIPS Technologies is shifting away from this product and Qemu is
  offering various more powerful platforms.  The generic MIPS code can
  now also probe for no-execute / write-only TLB features implemented
  without the full SmartMIPS extension as permitted by the latest MIPS
  processor architecture.  Lots of small changes to generic code."

* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (78 commits)
  MIPS: ath79: Fix CPU/DDR frequency calculation for SRIF PLLs
  MIPS: ath79: use correct fractional dividers for {CPU,DDR}_PLL on AR934x
  MIPS: BCM63XX: Properly handle mac address octet overflow
  MIPS: Kconfig: Avoid build errors by hiding USE_OF from the user.
  MIPS: Replace `-' in defconfig filename wth `_' for consistency.
  MIPS: Wire kcmp syscall.
  MIPS: MIPSsim: Remove the MIPSsim platform.
  MIPS: NOTIFY_RESUME is not needed in TIF masks
  MIPS: Merge the identical "return from syscall" per-ABI code
  MIPS: Unobfuscate _TIF..._MASK
  MIPS: Prevent hitting do_notify_resume() with !user_mode(regs).
  MIPS: Replace 'kernel_uses_smartmips_rixi' with 'cpu_has_rixi'.
  MIPS: Add base architecture support for RI and XI.
  MIPS: Optimise TLB handlers for MIPS32/64 R2 cores.
  MIPS: uasm: Add INS and EXT instructions.
  MIPS: Avoid pipeline stalls on some MIPS32R2 cores.
  MIPS: Make VPE count to be one-based.
  MIPS: Add new end of interrupt functionality for GIC.
  MIPS: Add EIC support for GIC.
  MIPS: Code clean-ups for the GIC.
  ...