* 'kvm-updates/2.6.39' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (55 commits)
  KVM: unbreak userspace that does not sets tss address
  KVM: MMU: cleanup pte write path
  KVM: MMU: introduce a common function to get no-dirty-logged slot
  KVM: fix rcu usage in init_rmode_* functions
  KVM: fix kvmclock regression due to missing clock update
  KVM: emulator: Fix permission checking in io permission bitmap
  KVM: emulator: Fix io permission checking for 64bit guest
  KVM: SVM: Load %gs earlier if CONFIG_X86_32_LAZY_GS=n
  KVM: x86: Remove useless regs_page pointer from kvm_lapic
  KVM: improve comment on rcu use in irqfd_deassign
  KVM: MMU: remove unused macros
  KVM: MMU: cleanup page alloc and free
  KVM: MMU: do not record gfn in kvm_mmu_pte_write
  KVM: MMU: move mmu pages calculated out of mmu lock
  KVM: MMU: set spte accessed bit properly
  KVM: MMU: fix kvm_mmu_slot_remove_write_access dropping intermediate W bits
  KVM: Start lock documentation
  KVM: better readability of efer_reserved_bits
  KVM: Clear async page fault hash after switching to real mode
  KVM: VMX: Initialize vm86 TSS only once.
  ...

* 'stable/xen.pm.bug-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen: use freeze/restore/thaw PM events for suspend/resume/chkpt
  xen: xenbus PM events support

Merge branches 'stable/irq.fairness' and 'stable/irq.ween_of_nr_irqs' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

* 'stable/irq.fairness' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen: events: Remove redundant clear of l2i at end of round-robin loop
  xen: events: Make round-robin scan fairer by snapshotting each l2 word once only
  xen: events: Clean up round-robin evtchn scan.
  xen: events: Make last processed event channel a per-cpu variable.
  xen: events: Process event channels notifications in round-robin order.

* 'stable/irq.ween_of_nr_irqs' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen: events: Fix compile error if CONFIG_SMP is not defined.
  xen: events: correct locking in xen_irq_from_pirq
  xen: events: propagate irq allocation failure instead of panicking
  xen: events: do not workaround too-small nr_irqs
  xen: events: remove use of nr_irqs as upper bound on number of pirqs
  xen: events: dynamically allocate irq info structures
  xen: events: maintain a list of Xen interrupts
  xen: events: push setup of irq<->{evtchn,ipi,virq,pirq} maps into irq_info init functions
  xen: events: turn irq_info constructors into initialiser functions
  xen: events: use per-cpu variable for cpu_evtchn_mask
  xen: events: refactor GSI pirq bindings functions
  xen: events: rename restore_cpu_pirqs -> restore_pirqs
  xen: events: remove unused public functions
  xen: events: fix xen_map_pirq_gsi error return
  xen: events: simplify comment
  xen: events: separate two unrelated halves of if condition

Fix up trivial conflicts in drivers/xen/events.c

Merge branches 'stable/hvc-console', 'stable/gntalloc.v6' and 'stable/balloon' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

* 'stable/hvc-console' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/hvc: Disable probe_irq_on/off from poking the hvc-console IRQ line.

* 'stable/gntalloc.v6' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen: gntdev: fix build warning
  xen/p2m/m2p/gnttab: do not add failed grant maps to m2p override
  xen-gntdev: Add cast to pointer
  xen-gntdev: Fix incorrect use of zero handle
  xen: change xen/[gntdev/gntalloc] to default m
  xen-gntdev: prevent using UNMAP_NOTIFY_CLEAR_BYTE on read-only mappings
  xen-gntdev: Avoid double-mapping memory
  xen-gntdev: Avoid unmapping ranges twice
  xen-gntdev: Use map->vma for checking map validity
  xen-gntdev: Fix unmap notify on PV domains
  xen-gntdev: Fix memory leak when mmap fails
  xen/gntalloc,gntdev: Add unmap notify ioctl
  xen-gntalloc: Userspace grant allocation driver
  xen-gntdev: Support mapping in HVM domains
  xen-gntdev: Add reference counting to maps
  xen-gntdev: Use find_vma rather than iterating our vma list manually
  xen-gntdev: Change page limit to be global instead of per-open

* 'stable/balloon' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen: (24 commits)
  xen-gntdev: Use ballooned pages for grant mappings
  xen-balloon: Add interface to retrieve ballooned pages
  xen-balloon: Move core balloon functionality out of module
  xen/balloon: Remove pr_info's and don't alter retry_count
  xen/balloon: Protect against CPU exhaust by event/x process
  xen/balloon: Migration from mod_timer() to schedule_delayed_work()
  xen/balloon: Removal of driver_pages

* git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6: (170 commits)
  [SCSI] scsi_dh_rdac: Add MD36xxf into device list
  [SCSI] scsi_debug: add consecutive medium errors
  [SCSI] libsas: fix ata list corruption issue
  [SCSI] hpsa: export resettable host attribute
  [SCSI] hpsa: move device attributes to avoid forward declarations
  [SCSI] scsi_debug: Logical Block Provisioning (SBC3r26)
  [SCSI] sd: Logical Block Provisioning update
  [SCSI] Include protection operation in SCSI command trace
  [SCSI] hpsa: fix incorrect PCI IDs and add two new ones (2nd try)
  [SCSI] target: Fix volume size misreporting for volumes > 2TB
  [SCSI] bnx2fc: Broadcom FCoE offload driver
  [SCSI] fcoe: fix broken fcoe interface reset
  [SCSI] fcoe: precedence bug in fcoe_filter_frames()
  [SCSI] libfcoe: Remove stale fcoe-netdev entries
  [SCSI] libfcoe: Move FCOE_MTU definition from fcoe.h to libfcoe.h
  [SCSI] libfc: introduce __fc_fill_fc_hdr that accepts fc_hdr as an argument
  [SCSI] fcoe, libfc: initialize EM anchors list and then update npiv EMs
  [SCSI] Revert "[SCSI] libfc: fix exchange being deleted when the abort itself is timed out"
  [SCSI] libfc: Fixing a memory leak when destroying an interface
  [SCSI] megaraid_sas: Version and Changelog update
  ...

Fix up trivial conflicts due to whitespace differences in
drivers/scsi/libsas/{sas_ata.c,sas_scsi_host.c}

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/davej/cpufreq:
  [CPUFREQ] pcc-cpufreq: remove duplicate statements
  [CPUFREQ] Remove the pm_message_t argument from driver suspend
  [CPUFREQ] Remove unneeded locks
  [CPUFREQ] Remove old, deprecated per cpu ondemand/conservative sysfs files
  [CPUFREQ] Remove deprecated sysfs file sampling_rate_max
  [CPUFREQ] powernow-k8: The table index is not worth displaying
  [CPUFREQ] calculate delay after dbs_check_cpu
  [CPUFREQ] Add documentation for sampling_down_factor
  [CPUFREQ] drivers/cpufreq: Remove unnecessary semicolons

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs-2.6:
  ext3: Always set dx_node's fake_dirent explicitly.
  ext3: Fix an overflow in ext3_trim_fs.
  jbd: Remove one to many n's in a word.
  ext3: skip orphan cleanup on rocompat fs
  ext2: Fix link count corruption under heavy link+rename load
  ext3: speed up group trim with the right free block count.
  ext3: Adjust trim start with first_data_block.
  quota: return -ENOMEM when memory allocation fails

* 'nfs-for-2.6.39' of git://git.linux-nfs.org/projects/trondmy/nfs-2.6: (54 commits)
  RPC: killing RPC tasks races fixed
  xprt: remove redundant check
  SUNRPC: Convert struct rpc_xprt to use atomic_t counters
  SUNRPC: Ensure we always run the tk_callback before tk_action
  sunrpc: fix printk format warning
  xprt: remove redundant null check
  nfs: BKL is no longer needed, so remove the include
  NFS: Fix a warning in fs/nfs/idmap.c
  Cleanup: Factor out some cut-and-paste code.
  cleanup: save 60 lines/100 bytes by combining two mostly duplicate functions.
  NFS: account direct-io into task io accounting
  gss:krb5 only include enctype numbers in gm_upcall_enctypes
  RPCRDMA: Fix FRMR registration/invalidate handling.
  RPCRDMA: Fix to XDR page base interpretation in marshalling logic.
  NFSv4: Send unmapped uid/gids to the server when using auth_sys
  NFSv4: Propagate the error NFS4ERR_BADOWNER to nfs4_do_setattr
  NFSv4: cleanup idmapper functions to take an nfs_server argument
  NFSv4: Send unmapped uid/gids to the server if the idmapper fails
  NFSv4: If the server sends us a numeric uid/gid then accept it
  NFSv4.1: reject zero layout with zeroed stripe unit
  ...

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-udf-2.6:
  UDF: Fix compiler warning
  udf: Convert UDF to new truncate calling sequence

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: (38 commits)
  amd64_edac: Fix decode_syndrome types
  amd64_edac: Fix DCT argument type
  amd64_edac: Fix ranges signedness
  amd64_edac: Drop local variable
  amd64_edac: Fix PCI config addressing types
  amd64_edac: Fix DRAM base macros
  amd64_edac: Fix node id signedness
  amd64_edac: Drop redundant declarations
  amd64_edac: Enable driver on F15h
  amd64_edac: Adjust ECC symbol size to F15h
  amd64_edac: Simplify scrubrate setting
  PCI: Rename CPU PCI id define
  amd64_edac: Improve DRAM address mapping
  amd64_edac: Sanitize ->read_dram_ctl_register
  amd64_edac: Adjust sys_addr to chip select conversion routine to F15h
  amd64_edac: Beef up early exit reporting
  amd64_edac: Revamp online spare handling
  amd64_edac: Fix channel interleave removal
  amd64_edac: Correct node interleaving removal
  amd64_edac: Add support for interleaved region swapping
  ...

Fix up trivial conflict in include/linux/pci_ids.h due to
AMD_15H_NB_MISC being renamed as AMD_15H_NB_F3 next to the new
AMD_15H_NB_LINK entry.

* 'for-linus/2639/i2c-1' of git://git.fluff.org/bjdooks/linux:
  i2c-mpc: Add support for 64bit system
  i2c: add driver for Freescale i.MX28
  i2c: tegra: Add i2c support

* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
  watchdog: booke_wdt: clean up status messages
  watchdog: cleanup spaces before tabs
  watchdog: convert to DEFINE_PCI_DEVICE_TABLE
  watchdog: Xen watchdog driver
  watchdog: Intel SCU Watchdog Timer Driver for Moorestown and Medfield platforms.
  watchdog: jz4740_wdt - fix magic character checking
  watchdog: add JZ4740 watchdog driver
  watchdog: it87_wdt: Add support for IT8721F watchdog
  watchdog: hpwdt: build hpwdt as module by default with NMI_DECODING enabled
  watchdog: hpwdt: Fix a couple of typos

* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/staging: (44 commits)
  hwmon: (lineage-pem): Fix in1 voltage alarm sysfs attributes
  hwmon/f71882fg: Add support for f71808e
  hwmon/f71882fg: Add support for f71869f and f71869e
  hwmon/f71882fg: Add support for f71889ed
  hwmon/f71882fg: Break out test for auto pwm's controlled by digital readings
  hwmon/f71882fg: Separate temp beep sysfs attr from the other temp sysfs attr
  hwmon/f71882fg: Remove bogus temp2_type for certain models
  hwmon/f71882fg: Make number of temps configurable
  hwmon/f71882fg: Make creation of in sysfs attributes more generic
  hwmon/f71882fg: Only allow negative auto point temps if fan_neg_temp is enabled
  hwmon/f71882fg: Fix temp1 sensor type reporting
  hwmon: (w83627ehf) Display correct temperature sensor labels for systems with NCT6775F
  hwmon: (w83627ehf) Add fan debounce support for NCT6775F and NCT6776F
  hwmon: (w83627ehf) Update Kconfig for W83677HG-B, NCT6775F and NCT6776F
  hwmon: (w83627ehf) Store rpm instead of raw fan speed data
  hwmon: (w83627ehf) Use 16 bit fan count registers if supported
  hwmon: (w83627ehf) Add support for Nuvoton NCT6775F and NCT6776F
  hwmon: (w83627ehf) Permit enabling SmartFan IV mode if configured at startup
  hwmon: (w83627ehf) Convert register arrays to 16 bit, and convert access to pointers
  hwmon: (w83627ehf) Remove references to datasheets which no longer exist
  ...

Use the newly added smp_call_func_t in smp_call_function_interrupt for
the func variable, and make the comment above the WARN more assertive
and explicit.  Also, func is a function pointer and does not need an
offset, so use %pf not %pS.
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Mike Galbraith reported finding a lockup ("perma-spin bug") where the
cpumask passed to smp_call_function_many was cleared by other cpu(s)
while a cpu was preparing its call_data block, resulting in no cpu to
clear the last ref and unlock the block.

Having cpus clear their bit asynchronously could be useful on a mask of
cpus that might have a translation context, or cpus that need a push to
complete an rcu window.

Instead of adding a BUG_ON and requiring yet another cpumask copy, just
detect the race and handle it.

Note: arch_send_call_function_ipi_mask must still handle an empty
cpumask because the data block is globally visible before the that arch
callback is made.  And (obviously) there are no guarantees to which cpus
are notified if the mask is changed during the call; only cpus that were
online and had their mask bit set during the whole call are guaranteed
to be called.
Reported-by: Mike Galbraith <efault@gmx.de>
Reported-by: Jan Beulich <JBeulich@novell.com>
Acked-by: Jan Beulich <jbeulich@novell.com>
Cc: stable@kernel.org
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Paul McKenney's review pointed out two problems with the barriers in the
2.6.38 update to the smp call function many code.

First, a barrier that would force the func and info members of data to
be visible before their consumption in the interrupt handler was
missing.  This can be solved by adding a smp_wmb between setting the
func and info members and setting setting the cpumask; this will pair
with the existing and required smp_rmb ordering the cpumask read before
the read of refs.  This placement avoids the need a second smp_rmb in
the interrupt handler which would be executed on each of the N cpus
executing the call request.  (I was thinking this barrier was present
but was not).

Second, the previous write to refs (establishing the zero that we the
interrupt handler was testing from all cpus) was performed by a third
party cpu.  This would invoke transitivity which, as a recient or
concurrent addition to memory-barriers.txt now explicitly states, would
require a full smp_mb().

However, we know the cpumask will only be set by one cpu (the data
owner) and any preivous iteration of the mask would have cleared by the
reading cpu.  By redundantly writing refs to 0 on the owning cpu before
the smp_wmb, the write to refs will follow the same path as the writes
that set the cpumask, which in turn allows us to keep the barrier in the
interrupt handler a smp_rmb instead of promoting it to a smp_mb (which
will be be executed by N cpus for each of the possible M elements on the
list).

I moved and expanded the comment about our (ab)use of the rcu list
primitives for the concurrent walk earlier into this function.  I
considered moving the first two paragraphs to the queue list head and
lock, but felt it would have been too disconected from the code.

Cc: Paul McKinney <paulmck@linux.vnet.ibm.com>
Cc: stable@kernel.org (2.6.32 and later)
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Peter pointed out there was nothing preventing the list_del_rcu in
smp_call_function_interrupt from running before the list_add_rcu in
smp_call_function_many.

Fix this by not setting refs until we have gotten the lock for the list.
Take advantage of the wmb in list_add_rcu to save an explicit additional
one.

I tried to force this race with a udelay before the lock & list_add and
by mixing all 64 online cpus with just 3 random cpus in the mask, but
was unsuccessful.  Still, inspection shows a valid race, and the fix is
a extension of the existing protection window in the current code.

Cc: stable@kernel.org (v2.6.32 and later)
Reported-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Milton Miller <miltonm@bga.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Change the _mapcount value indicating PageBuddy from -2 to -128 for
more robusteness against page_mapcount() undeflows.

Use reset_page_mapcount instead of __ClearPageBuddy in bad_page to
ignore the previous retval of PageBuddy().
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
Reported-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/epip/linux-2.6-unicore32: (40 commits)
  unicore32: rewrite arch-specific tlb.h to use asm-generic version
  unicore32: modify io_p2v and io_v2p macros, and adjust PKUNITY_mmio_BASEs
  unicore32: replace unicore32-specific iomap functions with generic lib implementation
  unicore32 machine related: add frame buffer driver for pkunity-v3 soc
  unicore32 machine related files: add i2c bus drivers for pkunity-v3 soc
  unicore32 io: redefine __REG(x) and re-use readl/writel funcs
  unicore32 i8042 upgrade and bugfix: adjust resource request region type
  unicore32 upgrade to v2.6.38-rc5: add one more paramter for pte_alloc_map call
  unicore32 i8042: adjust io funcs of i8042-unicore32io.h
  unicore32: rename PKUNITY_IOSPACE_BASE to PKUNITY_MMIO_BASE
  unicore32: modify function names and parameters for irq_chips
  unicore32: remove unused lines in arch/unicore32/include/asm/irq.h
  unicore32 time.c: change calculate method for clock_event_device
  unicore32: ADD MAINTAINER for unicore32 architecture
  unicore32 machine related files: ps2 driver
  unicore32 machine related files: pci bus handling
  unicore32 machine related files: hardware registers
  unicore32 machine related files: core files
  unicore32 additional architecture files: boot process
  unicore32 additional architecture files: low-level lib: misc
  ...
Acked-by: Arnd Bergmann <arnd@arndb.de>

* 'for-linus' of git://git390.marist.edu/pub/scm/linux-2.6:
  [S390] kexec: Disable ftrace during kexec
  [S390] support XZ compressed kernel
  [S390] css_bus_type: make it static
  [S390] css_driver: remove duplicate members
  [S390] css: remove subchannel private
  [S390] css: move chsc_private to drv_data
  [S390] css: move io_private to drv_data
  [S390] cio: move cdev pointer to io_subchannel_private
  [S390] cio: move options to io_sch_private
  [S390] cio: move asms to generic header
  [S390] cio: move orb definitions to separate header
  [S390] Write protect module text and RO data
  [S390] dasd: get rid of compile warning
  [S390] remove superfluous check from do_IRQ
  [S390] remove redundant stack check option

* 'sh-latest' of git://git.kernel.org/pub/scm/linux/kernel/git/lethal/sh-2.6: (34 commits)
  sh: Convert to generic show_interrupts.
  sh: Wire up new fhandle and clock_adjtime syscalls.
  sh: modify platform_device for sh_eth driver
  sh: add GETHER's platform_device in board-sh7757lcr
  sh: update sh7757lcr_defconfig
  sh: add platform_device of tmio_mmc and sh_mmcif to sh7757lcr
  sh: dmaengine support for SH7757
  sh: add mmc clock in clock-sh7757
  sh: add spi_board_info in sh7757lcr
  sh: add platform_device for SPI
  sh: add USB_ARCH_HAS_EHCI and OHCI for SH7757
  sh: Rename cpuidle states to fit general conventions
  serial: sh-sci: fix deadlock when resuming from S3 sleep
  sh: Enable CONFIG_GCOV_PROFILE_ALL for sh
  sh: Fix up async PCIe probing on SMP.
  serial: sh-sci: Kill off the special earlyprintk device.
  serial: sh-sci: Use dev_name() for region reservations.
  serial: sh-sci: Fix up earlyprintk port mapping.
  serial: sh-sci: Limit early console to one device.
  serial: sh-sci: Fix up break timer scheduling race.
  ...

* git://git.kernel.org/pub/scm/linux/kernel/git/lethal/fbdev-2.6:
  fbdev: sh_mobile_lcdc: Add YUV framebuffer support
  viafb: split pll configs up
  viafb: remove duplicated clock storage
  viafb: always return the best possible clock
  viafb: remove duplicated clock information
  fbdev: sh_mobile_lcdcfb: add backlight support
  viafb: factor lcd scaling parameters out
  viafb: strip some structures
  viafb: remove unused data_mode and device_type
  viafb: kill lcd_panel_id
  video via: make local variables static
  video via: fix iomem access
  video/via: drop deprecated (and unused) i2c_adapter.id

RPC task RPC_TASK_QUEUED bit is set must be checked before trying to wake up
task rpc_killall_tasks() because task->tk_waitqueue can not be set (equal to
NULL).
Also, as Trond Myklebust mentioned, such approach (instead of checking
tk_waitqueue to NULL) allows us to "optimise away the call to
rpc_wake_up_queued_task() altogether for those
tasks that aren't queued".

Here is an example of dereferencing of tk_waitqueue equal to NULL:

CPU 0               	CPU 1				CPU 2
--------------------	---------------------	--------------------------
nfs4_run_open_task
rpc_run_task
rpc_execute
rpc_set_active
rpc_make_runnable
(waiting)
			rpc_async_schedule
			nfs4_open_prepare
			nfs_wait_on_sequence
						nfs_umount_begin
						rpc_killall_tasks
						rpc_wake_up_task
						rpc_wake_up_queued_task
						spin_lock(tk_waitqueue == NULL)
						BUG()
			rpc_sleep_on
			spin_lock(&q->lock)
			__rpc_sleep_on
			task->tk_waitqueue = q
Signed-off-by: Stanislav Kinsbursky <skinsbursky@openvz.org>
Cc: stable@kernel.org
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

remove redundant check.
Signed-off-by: Jinqiu Yang <crindy646@gmail.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

This fixes a race in which the task->tk_callback() puts the rpc_task
to sleep, setting a new callback. Under certain circumstances, the current
code may end up executing the task->tk_action before it gets round to the
callback.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Cc: stable@kernel.org

* 'drm-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (177 commits)
  drm/radeon: fixup refcounts in radeon dumb create ioctl.
  drm: radeon: *_cs_packet_parse_vline() cleanup
  radeon: merge list_del()/list_add_tail() to list_move_tail()
  drm: Retry i2c transfer of EDID block after failure
  drm/radeon/kms: fix typo in atom overscan setup
  drm: Hold the mode mutex whilst probing for sysfs status
  drm/nouveau: fix __nouveau_fence_wait performance
  drm/nv40: attempt to reserve just enough vram for all 32 channels
  drm/nv50: check for vm traps on every gr irq
  drm/nv50: decode vm faults some more
  drm/nouveau: add nouveau_enum_find() util function
  drm/nouveau: properly handle pushbuffer check failures
  drm/nvc0: remove vm hack forcing large/small pages to not share a PDE
  drm/i915: disable opregion lid detection for now.
  drm/i915: Only wait on a pending flip if we intend to write to the buffer
  drm/i915/dp: Sanity check eDP existence
  drm: add cap bit to denote if dumb ioctl is available or not.
  drm/core: add ioctl to query device/driver capabilities
  drm/radeon/kms: allow max clock of 340 Mhz on hdmi 1.3+
  drm/radeon/kms: add cayman pci ids
  ...

Commit 6440e5967bc broke old userspaces that do not set tss address
before entering vcpu. Unbreak it by setting tss address to a safe
value on the first vcpu entry. New userspaces should set tss address,
so print warning in case it doesn't.
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

This patch does:
- call vcpu->arch.mmu.update_pte directly
- use gfn_to_pfn_atomic in update_pte path

The suggestion is from Avi.
Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

Cleanup the code of pte_prefetch_gfn_to_memslot and mapping_level_dirty_bitmap
Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

fix:
[ 3494.671786] stack backtrace:
[ 3494.671789] Pid: 10527, comm: qemu-system-x86 Not tainted 2.6.38-rc6+ #23
[ 3494.671790] Call Trace:
[ 3494.671796]  [] ? lockdep_rcu_dereference+0x9d/0xa5
[ 3494.671826]  [] ? kvm_memslots+0x6b/0x73 [kvm]
[ 3494.671834]  [] ? gfn_to_memslot+0x16/0x4f [kvm]
[ 3494.671843]  [] ? gfn_to_hva+0x16/0x27 [kvm]
[ 3494.671851]  [] ? kvm_write_guest_page+0x31/0x83 [kvm]
[ 3494.671861]  [] ? kvm_clear_guest_page+0x1a/0x1c [kvm]
[ 3494.671867]  [] ? vmx_set_tss_addr+0x83/0x122 [kvm_intel]

and:
[ 8328.789599] stack backtrace:
[ 8328.789601] Pid: 18736, comm: qemu-system-x86 Not tainted 2.6.38-rc6+ #23
[ 8328.789603] Call Trace:
[ 8328.789609]  [] ? lockdep_rcu_dereference+0x9d/0xa5
[ 8328.789621]  [] ? kvm_memslots+0x6b/0x73 [kvm]
[ 8328.789628]  [] ? gfn_to_memslot+0x16/0x4f [kvm]
[ 8328.789635]  [] ? gfn_to_hva+0x16/0x27 [kvm]
[ 8328.789643]  [] ? kvm_write_guest_page+0x31/0x83 [kvm]
[ 8328.789699]  [] ? kvm_clear_guest_page+0x1a/0x1c [kvm]
[ 8328.789713]  [] ? vmx_create_vcpu+0x316/0x3c8 [kvm_intel]
Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

commit 387b9f97750444728962b236987fbe8ee8cc4f8c moved kvm_request_guest_time_update(vcpu),
breaking 32bit SMP guests using kvm-clock. Fix this by moving (new) clock update function
to proper place.
Signed-off-by: Nikola Ciprich <nikola.ciprich@linuxbox.cz>
Acked-by: Zachary Amsden <zamsden@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

Currently if io port + len crosses 8bit boundary in io permission bitmap the
check may allow IO that otherwise should not be allowed. The patch fixes that.
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

Current implementation truncates upper 32bit of TR base address during IO
permission bitmap check. The patch fixes this.
Reported-and-tested-by: Francis Moreau <francis.moro@gmail.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

With CONFIG_CC_STACKPROTECTOR, we need a valid %gs at all times, so disable
lazy reload and do an eager reload immediately after the vmexit.
Reported-by: IVAN ANGELOV <ivangotoy@gmail.com>
Acked-By: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

Access to this page is mostly done through the regs member which holds
the address to this page.  The exceptions are in vmx_vcpu_reset() and
kvm_free_lapic() and these both can easily be converted to using regs.
Signed-off-by: Takuya Yoshikawa <yoshikawa.takuya@oss.ntt.co.jp>
Signed-off-by: Avi Kivity <avi@redhat.com>

The RCU use in kvm_irqfd_deassign is tricky: we have rcu_assign_pointer
but no synchronize_rcu: synchronize_rcu is done by kvm_irq_routing_update
which we share a spinlock with.

Fix up a comment in an attempt to make this clearer.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

These macros are not used, so removed
Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

Using __get_free_page instead of alloc_page and page_address,
using free_page instead of __free_page and virt_to_page
Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Signed-off-by: Avi Kivity <avi@redhat.com>

No need to record the gfn to verifier the pte has the same mode as
current vcpu, it's because we only speculatively update the pte only
if the pte and vcpu have the same mode
Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Signed-off-by: Avi Kivity <avi@redhat.com>