Get the definition of struct subchannel_id.
Reviewed-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>

Running under a kvm host does not necessarily imply the presence of
a page mapped above the main memory with the virtio information;
however, the code includes a hard coded access to that page.

Instead, check for the presence of the page and exit gracefully
before we hit an addressing exception if it does not exist.
Reviewed-by: Marcelo Tosatti <mtosatti@redhat.com>
Reviewed-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
cc: stable@vger.kernel.org
Signed-off-by: Gleb Natapov <gleb@redhat.com>

The kvm i8254 emulation for counter 0 (but not for counters 1 and 2)
has at least two bugs in mode 0:

1. The OUT bit, computed by pit_get_out(), is never set high.

2. The counter value, computed by pit_get_count(), wraps back around to
   the initial counter value, rather than wrapping back to 0xFFFF
   (which is the behavior described in the comment in __kpit_elapsed,
   the behavior implemented by qemu, and the behavior observed on AMD
   hardware).

The bug stems from __kpit_elapsed computing the elapsed time mod the
initial counter value (stored as nanoseconds in ps->period).  This is both
unnecessary (none of the callers of kpit_elapsed expect the value to be
at most the initial counter value) and incorrect (it causes pit_get_count
to appear to wrap around to the initial counter value rather than 0xFFFF).
Removing this mod from __kpit_elapsed fixes both of the above bugs.
Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
Reviewed-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Gleb Natapov <gleb@redhat.com>

Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

With the 3 private slots, this gives us a nice round 128 slots total.
The primary motivation for this is to support more assigned devices.
Each assigned device can theoretically use up to 8 slots (6 MMIO BARs,
1 ROM BAR, 1 spare for a split MSI-X table mapping) though it's far
more typical for a device to use 3-4 slots.  If we assume a typical VM
uses a dozen slots for non-assigned devices purposes, we should always
be able to support 14 worst case assigned devices or 28 to 37 typical
devices.
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

We're currently offering a whopping 32 memory slots to user space, an
int is a bit excessive for storing this.  We would like to increase
our memslots, but SHRT_MAX should be more than enough.
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

struct kvm_userspace_memory_region.flags is a u32 with a comment that
bits 0 ~ 15 are visible to userspace and the other bits are reserved
for kvm internal use.  KVM_MEMSLOT_INVALID is the only internal use
flag and it has a comment that bits 16 ~ 31 are internally used and
the other bits are visible to userspace.

Therefore, let's define this as a u32 so we don't waste bytes on LP64
systems.  Move to the end of the struct for alignment.
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

There's no need for this to be an int, it holds a boolean.
Move to the end of the struct for alignment.
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

Seems like everyone copied x86 and defined 4 private memory slots
that never actually get used.  Even x86 only uses 3 of the 4.  These
aren't exposed so there's no need to add padding.
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

It's easy to confuse KVM_MEMORY_SLOTS and KVM_MEM_SLOTS_NUM.  One is
the user accessible slots and the other is user + private.  Make this
more obvious.
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

If a slot is removed or moved in the guest physical address space, we
first allocate and install a new slot array with the invalidated
entry.  The old array is then freed.  We then proceed to allocate yet
another slot array to install the permanent replacement.  Re-use the
original array when this occurs and avoid the extra kfree/kmalloc.
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

The iommu integration into memory slots expects memory slots to be
added or removed and doesn't handle the move case.  We can unmap
slots from the iommu after we mark them invalid and map them before
installing the final memslot array.  Also re-order the kmemdup vs
map so we don't leave iommu mappings if we get ENOMEM.
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

The API documents that only flags and guest physical memory space can
be modified on an existing slot, but we don't enforce that the
userspace address cannot be modified.  Instead we just ignore it.
This means that a user may think they've successfully moved both the
guest and user addresses, when in fact only the guest address changed.
Check and error instead.
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

The API documentation states:

	When changing an existing slot, it may be moved in the guest
	physical memory space, or its flags may be modified.

An "existing slot" requires a non-zero npages (memory_size).  The only
transition we should therefore allow for a non-existing slot should be
to create the slot, which includes setting a non-zero memory_size.  We
currently allow calls to modify non-existing slots, which is pointless,
confusing, and possibly wrong.

With this we know that the invalidation path of __kvm_set_memory_region
is always for a delete or move and never for adding a zero size slot.
Reviewed-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

According to Intel SDM Volume 3 Section 10.8.1 "Interrupt Handling with
the Pentium 4 and Intel Xeon Processors" and Section 10.8.2 "Interrupt
Handling with the P6 Family and Pentium Processors" ExtINT interrupts are
sent directly to the processor core for handling. Currently KVM checks
APIC before it considers ExtINT interrupts for injection which is
backwards from the spec. Make code behave according to the SDM.
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Acked-by: "Zhang, Yang Z" <yang.z.zhang@intel.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

MOV immediate instruction (opcodes 0xB8-0xBF) may take 64-bit operand.
The previous emulation implementation assumes the operand is no longer than 32.
Adding OpImm64 for this matter.

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=881579Signed-off-by: Nadav Amit <nadav.amit@gmail.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

Windows2000 uses it during boot. This fixes
https://bugzilla.kernel.org/show_bug.cgi?id=50921Signed-off-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

Pull KVM updates from Marcelo Tosatti:
 "Considerable KVM/PPC work, x86 kvmclock vsyscall support,
  IA32_TSC_ADJUST MSR emulation, amongst others."

Fix up trivial conflict in kernel/sched/core.c due to cross-cpu
migration notifier added next to rq migration call-back.

* tag 'kvm-3.8-1' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (156 commits)
  KVM: emulator: fix real mode segment checks in address linearization
  VMX: remove unneeded enable_unrestricted_guest check
  KVM: VMX: fix DPL during entry to protected mode
  x86/kexec: crash_vmclear_local_vmcss needs __rcu
  kvm: Fix irqfd resampler list walk
  KVM: VMX: provide the vmclear function and a bitmap to support VMCLEAR in kdump
  x86/kexec: VMCLEAR VMCSs loaded on all cpus if necessary
  KVM: MMU: optimize for set_spte
  KVM: PPC: booke: Get/set guest EPCR register using ONE_REG interface
  KVM: PPC: bookehv: Add EPCR support in mtspr/mfspr emulation
  KVM: PPC: bookehv: Add guest computation mode for irq delivery
  KVM: PPC: Make EPCR a valid field for booke64 and bookehv
  KVM: PPC: booke: Extend MAS2 EPN mask for 64-bit
  KVM: PPC: e500: Mask MAS2 EPN high 32-bits in 32/64 tlbwe emulation
  KVM: PPC: Mask ea's high 32-bits in 32/64 instr emulation
  KVM: PPC: e500: Add emulation helper for getting instruction ea
  KVM: PPC: bookehv64: Add support for interrupt handling
  KVM: PPC: bookehv: Remove GET_VCPU macro from exception handler
  KVM: PPC: booke: Fix get_tb() compile error on 64-bit
  KVM: PPC: e500: Silence bogus GCC warning in tlb code
  ...

Merge tag 'stable/for-linus-3.8-rc0-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

Pull Xen updates from Konrad Rzeszutek Wilk:
 - Add necessary infrastructure to make balloon driver work under ARM.
 - Add /dev/xen/privcmd interfaces to work with ARM and PVH.
 - Improve Xen PCIBack wild-card parsing.
 - Add Xen ACPI PAD (Processor Aggregator) support - so can offline/
   online sockets depending on the power consumption.
 - PVHVM + kexec = use an E820_RESV region for the shared region so we
   don't overwrite said region during kexec reboot.
 - Cleanups, compile fixes.

Fix up some trivial conflicts due to the balloon driver now working on
ARM, and there were changes next to the previous work-arounds that are
now gone.

* tag 'stable/for-linus-3.8-rc0-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/PVonHVM: fix compile warning in init_hvm_pv_info
  xen: arm: implement remap interfaces needed for privcmd mappings.
  xen: correctly use xen_pfn_t in remap_domain_mfn_range.
  xen: arm: enable balloon driver
  xen: balloon: allow PVMMU interfaces to be compiled out
  xen: privcmd: support autotranslated physmap guests.
  xen: add pages parameter to xen_remap_domain_mfn_range
  xen/acpi: Move the xen_running_on_version_or_later function.
  xen/xenbus: Remove duplicate inclusion of asm/xen/hypervisor.h
  xen/acpi: Fix compile error by missing decleration for xen_domain.
  xen/acpi: revert pad config check in xen_check_mwait
  xen/acpi: ACPI PAD driver
  xen-pciback: reject out of range inputs
  xen-pciback: simplify and tighten parsing of device IDs
  xen PVonHVM: use E820_Reserved area for shared_info

Pull s390 update from Martin Schwidefsky:
 "Add support to generate code for the latest machine zEC12, MOD and XOR
  instruction support for the BPF jit compiler, the dasd safe offline
  feature and the big one: the s390 architecture gets PCI support!!
  Right before the world ends on the 21st ;-)"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (41 commits)
  s390/qdio: rename the misleading PCI flag of qdio devices
  s390/pci: remove obsolete email addresses
  s390/pci: speed up __iowrite64_copy by using pci store block insn
  s390/pci: enable NEED_DMA_MAP_STATE
  s390/pci: no msleep in potential IRQ context
  s390/pci: fix potential NULL pointer dereference in dma_free_seg_table()
  s390/pci: use kmem_cache_zalloc instead of kmem_cache_alloc/memset
  s390/bpf,jit: add support for XOR instruction
  s390/bpf,jit: add support MOD instruction
  s390/cio: fix pgid reserved check
  vga: compile fix, disable vga for s390
  s390/pci: add PCI Kconfig options
  s390/pci: s390 specific PCI sysfs attributes
  s390/pci: PCI hotplug support via SCLP
  s390/pci: CHSC PCI support for error and availability events
  s390/pci: DMA support
  s390/pci: PCI adapter interrupts for MSI/MSI-X
  s390/bitops: find leftmost bit instruction support
  s390/pci: CLP interface
  s390/pci: base support
  ...

Pull m68k updates from Geert Uytterhoeven.

Fix up trivial conflict (m68k switched to generic version of
uapi/asm/socket.h, net tree updated the old one) as per Geert.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k:
  m68k/sun3: Fix instruction faults
  m68k/sun3: Get interrupts working again
  m68k: move to a single instance of free_initmem()
  m68k: merge MMU and non-MMU versions of mm/init.c
  m68k: switch to using the asm-generic termios.h
  m68k: switch to using the asm-generic termbits.h
  m68k: switch to using the asm-generic sockios.h
  m68k: switch to using the asm-generic socket.h
  m68k: switch to using the asm-generic shmbuf.h
  m68k: switch to using the asm-generic sembuf.h
  m68k: switch to using the asm-generic msgbuf.h
  m68k: switch to using the asm-generic auxvec.h
  m68k: switch to using the asm-generic shmparam.h
  m68k: switch to using the asm-generic spinlock.h
  m68k: switch to using the asm-generic hw_irq.h
  arch/m68k: remove CONFIG_EXPERIMENTAL

Pull tiny sparc update from David Miller:
 "Not much going on this release cycle in sparc land, just a Kconfig
  tweak."

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next:
  of_i2c: sparc: Allow OF_I2C for sparc

Pull networking fixes from David Miller:
 "A pile of fixes in response to yesterday's big merge.  The SCTP HMAC
  thing hasn't been addressed yet, I'll take care of that myself if Neil
  and Vlad don't show signs of life by tomorrow.

   1) Use after free of SKB in tuntap code.  Fix by Eric Dumazet,
      reported by Dave Jones.

   2) NFC LLCP code emits annoying kernel log message, triggerable by
      the user.  From Dave Jones.

   3) Fix several endianness bugs noticed by sparse in the bridging
      code, from Stephen Hemminger.

   4) Ipv6 NDISC code doesn't take padding into account properly, fix
      from YOSHIFUJI Hideaki.

   5) Add missing docs to ethtool_flow_ext struct, from Yan Burman."

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  bridge: fix icmpv6 endian bug and other sparse warnings
  net: ethool: Document struct ethtool_flow_ext
  ndisc: Fix padding error in link-layer address option.
  tuntap: dont use skb after netif_rx_ni(skb)
  nfc: remove noisy message from llcp_sock_sendmsg

Merge misc VM changes from Andrew Morton:
 "The rest of most-of-MM.  The other MM bits await a slab merge.

  This patch includes the addition of a huge zero_page.  Not a
  performance boost but it an save large amounts of physical memory in
  some situations.

  Also a bunch of Fujitsu engineers are working on memory hotplug.
  Which, as it turns out, was badly broken.  About half of their patches
  are included here; the remainder are 3.8 material."

However, this merge disables CONFIG_MOVABLE_NODE, which was totally
broken.  We don't add new features with "default y", nor do we add
Kconfig questions that are incomprehensible to most people without any
help text.  Does the feature even make sense without compaction or
memory hotplug?

* akpm: (54 commits)
  mm/bootmem.c: remove unused wrapper function reserve_bootmem_generic()
  mm/memory.c: remove unused code from do_wp_page()
  asm-generic, mm: pgtable: consolidate zero page helpers
  mm/hugetlb.c: fix warning on freeing hwpoisoned hugepage
  hwpoison, hugetlbfs: fix RSS-counter warning
  hwpoison, hugetlbfs: fix "bad pmd" warning in unmapping hwpoisoned hugepage
  mm: protect against concurrent vma expansion
  memcg: do not check for mm in __mem_cgroup_count_vm_event
  tmpfs: support SEEK_DATA and SEEK_HOLE (reprise)
  mm: provide more accurate estimation of pages occupied by memmap
  fs/buffer.c: remove redundant initialization in alloc_page_buffers()
  fs/buffer.c: do not inline exported function
  writeback: fix a typo in comment
  mm: introduce new field "managed_pages" to struct zone
  mm, oom: remove statically defined arch functions of same name
  mm, oom: remove redundant sleep in pagefault oom handler
  mm, oom: cleanup pagefault oom handler
  memory_hotplug: allow online/offline memory to result movable node
  numa: add CONFIG_MOVABLE_NODE for movable-dedicated node
  mm, memcg: avoid unnecessary function call when memcg is disabled
  ...

Pull PCI update from Bjorn Helgaas:
 "Host bridge hotplug:
   - Untangle _PRT from struct pci_bus (Bjorn Helgaas)
   - Request _OSC control before scanning root bus (Taku Izumi)
   - Assign resources when adding host bridge (Yinghai Lu)
   - Remove root bus when removing host bridge (Yinghai Lu)
   - Remove _PRT during hot remove (Yinghai Lu)

  SRIOV
    - Add sysfs knobs to control numVFs (Don Dutile)

  Power management
   - Notify devices when power resource turned on (Huang Ying)

  Bug fixes
   - Work around broken _SEG on HP xw9300 (Bjorn Helgaas)
   - Keep runtime PM enabled for unbound PCI devices (Huang Ying)
   - Fix Optimus dual-GPU runtime D3 suspend issue (Dave Airlie)
   - Fix xen frontend shutdown issue (David Vrabel)
   - Work around PLX PCI 9050 BAR alignment erratum (Ian Abbott)

  Miscellaneous
   - Add GPL license for drivers/pci/ioapic (Andrew Cooks)
   - Add standard PCI-X, PCIe ASPM register #defines (Bjorn Helgaas)
   - NumaChip remote PCI support (Daniel Blueman)
   - Fix PCIe Link Capabilities Supported Link Speed definition (Jingoo
     Han)
   - Convert dev_printk() to dev_info(), etc (Joe Perches)
   - Add support for non PCI BAR ROM data (Matthew Garrett)
   - Add x86 support for host bridge translation offset (Mike Yoknis)
   - Report success only when every driver supports AER (Vijay
     Pandarathil)"

Fix up trivial conflicts.

* tag 'for-3.8' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (48 commits)
  PCI: Use phys_addr_t for physical ROM address
  x86/PCI: Add NumaChip remote PCI support
  ath9k: Use standard #defines for PCIe Capability ASPM fields
  iwlwifi: Use standard #defines for PCIe Capability ASPM fields
  iwlwifi: collapse wrapper for pcie_capability_read_word()
  iwlegacy: Use standard #defines for PCIe Capability ASPM fields
  iwlegacy: collapse wrapper for pcie_capability_read_word()
  cxgb3: Use standard #defines for PCIe Capability ASPM fields
  PCI: Add standard PCIe Capability Link ASPM field names
  PCI/portdrv: Use PCI Express Capability accessors
  PCI: Use standard PCIe Capability Link register field names
  x86: Use PCI setup data
  PCI: Add support for non-BAR ROMs
  PCI: Add pcibios_add_device
  EFI: Stash ROMs if they're not in the PCI BAR
  PCI: Add and use standard PCI-X Capability register names
  PCI/PM: Keep runtime PM enabled for unbound PCI devices
  xen-pcifront: Handle backend CLOSED without CLOSING
  PCI: SRIOV control and status via sysfs (documentation)
  PCI/AER: Report success only when every device has AER-aware driver
  ...

Pull regulator updates from Mark Brown:
 "A fairly quiet release again, a couple of relatively small new
  features and a bunch of driver specific work including yet more code
  elimination and fixes from Axel Lin.

   - Addidion of linear_min_sel for offsetting linear selectors in the
     helpers.
   - Support for continuous voltage ranges for regulators with extremely
     high resolution.
   - Drivers for AS3711, DA9055, MAX9873, TPS51632, TPS80031 and ARM
     vexpress."

Fix up trivial conflict (due to typo fix) in palmas-regulator.c

* tag 'regulator-3.8' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (80 commits)
  regulator: core: Fix logic to determinate if regulator can change voltage
  regulator: s5m8767: Fix to work even if no DVS gpio present
  regulator: s5m8767: Fix to read the first DVS register.
  regulator: s5m8767: Fix to work when platform registers less regulators
  regulator: gpio-regulator: gpio_set_value should use cansleep
  regulator: gpio-regulator: Fix logical error in for() loop
  regulator: anatop: Use regulator_[get|set]_voltage_sel_regmap
  regulator: anatop: Use linear_min_sel with linear mapping
  regulator: max1586: Implement get_voltage_sel callback
  regulator: lp8788-buck: Kill _gpio_request function
  regulator: tps80031: Convert tps80031_ldo_ops to linear_min_sel and list_voltage_linear
  regulator: lp8788-ldo: Remove val array in lp8788_config_ldo_enable_mode
  regulator: gpio-regulator: Add ifdef CONFIG_OF guard for regulator_gpio_of_match
  regulator: palmas: Convert palmas_ops_smps to regulator_[get|set]_voltage_sel_regmap
  regulator: palmas: Return raw register values as the selectors in [get|set]_voltage_sel
  regulators: add regulator_can_change_voltage() function
  regulator: tps51632: Ensure [base|max]_voltage_uV pdata settings are valid
  regulator: wm831x-dcdc: Add MODULE_ALIAS for wm831x-boostp
  regulator: wm831x-dcdc: Ensure selected voltage falls within requested range
  regulator: tps51632: Use linear_min_sel and regulator_[map|list]_voltage_linear
  ...

Pull HID subsystem updates from Jiri Kosina:

 1) Support for HID over I2C bus has been added by Benjamin Tissoires.
    ACPI device discovery is still in the works.

 2) Support for Win8 Multitiouch protocol is being added, most work done
    by Benjamin Tissoires as well

 3) EIO/ERESTARTSYS is fixed in hiddev/hidraw, fixes by Andrew Duggan
    and Jiri Kosina

 4) ION iCade driver added by Bastien Nocera

 5) Support for a couple new Roccat devices has been added by Stefan
    Achatz

 6) HID sensor hubs are now auto-detected instead of having to list all
    the VID/PID combinations in the blacklist array

 7) other random fixes and support for new device IDs

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (65 commits)
  HID: i2c-hid: add mutex protecting open/close race
  Revert "HID: sensors: add to special driver list"
  HID: sensors: autodetect USB HID sensor hubs
  HID: hidp: fallback to input session properly if hid is blacklisted
  HID: i2c-hid: fix ret_count check
  HID: i2c-hid: fix i2c_hid_get_raw_report count mismatches
  HID: i2c-hid: remove extra .irq field in struct i2c_hid
  HID: i2c-hid: reorder allocation/free of buffers
  HID: i2c-hid: fix memory corruption due to missing hid declaration
  HID: i2c-hid: remove superfluous include
  HID: i2c-hid: remove unneeded test in i2c_hid_remove
  HID: i2c-hid: i2c_hid_get_report may fail
  HID: i2c-hid: also call i2c_hid_free_buffers in i2c_hid_remove
  HID: i2c-hid: fix error messages
  HID: i2c-hid: fix return paths
  HID: i2c-hid: remove unused static declarations
  HID: i2c-hid: fix i2c_hid_dbg macro
  HID: i2c-hid: fix checkpatch.pl warning
  HID: i2c-hid: enhance Kconfig
  HID: i2c-hid: change I2C name
  ...

Pull trivial branch from Jiri Kosina:
 "Usual stuff -- comment/printk typo fixes, documentation updates, dead
  code elimination."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (39 commits)
  HOWTO: fix double words typo
  x86 mtrr: fix comment typo in mtrr_bp_init
  propagate name change to comments in kernel source
  doc: Update the name of profiling based on sysfs
  treewide: Fix typos in various drivers
  treewide: Fix typos in various Kconfig
  wireless: mwifiex: Fix typo in wireless/mwifiex driver
  messages: i2o: Fix typo in messages/i2o
  scripts/kernel-doc: check that non-void fcts describe their return value
  Kernel-doc: Convention: Use a "Return" section to describe return values
  radeon: Fix typo and copy/paste error in comments
  doc: Remove unnecessary declarations from Documentation/accounting/getdelays.c
  various: Fix spelling of "asynchronous" in comments.
  Fix misspellings of "whether" in comments.
  eisa: Fix spelling of "asynchronous".
  various: Fix spelling of "registered" in comments.
  doc: fix quite a few typos within Documentation
  target: iscsi: fix comment typos in target/iscsi drivers
  treewide: fix typo of "suport" in various comments and Kconfig
  treewide: fix typo of "suppport" in various comments
  ...

Pull IEEE 1394 (FireWire) subsystem updates from Stefan Richter:
  - IPv4-over-1394: fixes for broadcast and multicast
  - SBP-2: allow thin-provisioning related commands
  - trivia

* tag 'firewire-updates' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: net: remove unused variable in fwnet_receive_broadcast()
  firewire: net: Fix handling of fragmented multicast/broadcast packets.
  firewire: sbp2: allow WRITE SAME and REPORT SUPPORTED OPERATION CODES
  tools/firewire: nosy-dump: check for allocation failure

Pull sound updates from Takashi Iwai:
 "This update contains a fairly wide range of changes all over in sound
  subdirectory, mainly because of UAPI header moves by David and __dev*
  annotation removals by Bill.  Other highlights are:

   - Introduced the support for wallclock timestamps in ALSA PCM core

   - Add the poll loop implementation for HD-audio jack detection

   - Yet more VGA-switcheroo fixes for HD-audio

   - New VIA HD-audio codec support

   - More fixes on resource management in USB audio and MIDI drivers

   - More quirks for USB-audio ASUS Xonar U3, Reloop Play, Focusrite,
     Roland VG-99, etc

   - Add support for FastTrack C400 usb-audio

   - Clean ups in many drivers regarding firmware loading

   - Add PSC724 Ultiimate Edge support to ice1712

   - A few hdspm driver updates

   - New Stanton SCS.1d/1m FireWire driver

   - Standardisation of the logging in ASoC codes

   - DT and dmaengine support for ASoC Atmel

   - Support for Wolfson ADSP cores

   - New drivers for Freescale/iVeia P1022 and Maxim MAX98090

   - Lots of other ASoC driver fixes and developments"

Fix up trivial conflicts.  And go out on a limb and assume the dts file
'status' field of one of the conflicting things was supposed to be
"disabled", not "disable" like in pretty much all other cases.

* tag 'sound-3.8' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (341 commits)
  ALSA: hda - Move runtime PM check to runtime_idle callback
  ALSA: hda - Add stereo-dmic fixup for Acer Aspire One 522
  ALSA: hda - Avoid doubly suspend after vga switcheroo
  ALSA: usb-audio: Enable S/PDIF on the ASUS Xonar U3
  ALSA: hda - Check validity of CORB/RIRB WP reads
  ALSA: hda - use usleep_range in link reset and change timeout check
  ALSA: HDA: VIA: Add support for codec VT1808.
  ALSA: HDA: VIA Add support for codec VT1705CF.
  ASoC: codecs: remove __dev* attributes
  ASoC: utils: remove __dev* attributes
  ASoC: ux500: remove __dev* attributes
  ASoC: txx9: remove __dev* attributes
  ASoC: tegra: remove __dev* attributes
  ASoC: spear: remove __dev* attributes
  ASoC: sh: remove __dev* attributes
  ASoC: s6000: remove __dev* attributes
  ASoC: OMAP: remove __dev* attributes
  ASoC: nuc900: remove __dev* attributes
  ASoC: mxs: remove __dev* attributes
  ASoC: kirkwood: remove __dev* attributes
  ...

Pull ARM SoC board updates, take 2 from Olof Johansson:
 "This branch contains board updates for shmobile that had dependencies
  on earlier branches past the first driver branch, and thus are merged
  separately.

  Most of these are to enable audio and USB on shmobile.  They contain a
  dependent ASoC branch that has been coordinated with Mark Brown."

* tag 'boards2' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: shmobile: mackerel: Add FLCTL IRQ resource
  ARM: shmobile: use FSI driver's audio clock on ap4evb
  ARM: shmobile: use FSI driver's audio clock on mackerel
  ARM: shmobile: use FSI driver's audio clock on armadillo800eva
  ARM: shmobile: mackerel: enable DMAEngine on USB Host
  ARM: shmobile: marzen: add USB OHCI driver support
  ARM: shmobile: marzen: add USB EHCI driver support
  ARM: shmobile: marzen: add USB phy support
  ASoC: fsi: add master clock control functions
  ASoC: fsi: care fsi_hw_start/stop() return value
  ASoC: fsi: fsi_set_master_clk() was called from fsi_hw_xxx() only
  ASoC: fsi: use devm_request_irq()
  ASoC: fsi: fixup channels_min/max

Pull ARM SoC driver specific changes from Olof Johansson:
 "A collection of mostly SoC-specific driver updates:
   - a handful of pincontrol and setup changes
   - new drivers for hwmon and reset controller for vexpress
   - timing support updates for OMAP (gpmc and other interfaces)
   - plus a collection of smaller cleanups"

* tag 'drivers' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (21 commits)
  ARM: ux500: fix pin warning
  ARM: OMAP2+: tusb6010: generic timing calculation
  ARM: OMAP2+: smc91x: generic timing calculation
  ARM: OMAP2+: onenand: generic timing calculation
  ARM: OMAP2+: gpmc: generic timing calculation
  ARM: OMAP2+: gpmc: handle additional timings
  ARM: OMAP2+: nand: remove redundant rounding
  gpio: samsung: use pr_* instead of printk
  ARM: ux500: fixup magnetometer pins
  ARM: ux500: add STM pin configuration
  ARM: ux500: 8500: add pinctrl support for uart1 and uart2
  ARM: ux500: cosmetic fixups for uart0
  gpio: samsung: Fix input mode setting function for GPIO int
  ARM: SAMSUNG: Insert bitmap_gpio_int member in samsung_gpio_chip
  ARM: ux500: 8500: define SDI sleep states
  ARM: vexpress: Reset driver
  ARM: ux500: 8500: update SKE keypad pinctrl table
  hwmon: Versatile Express hwmon driver
  ARM: ux500: delete duplicate macro
  ARM: ux500: 8500: add IDLE pin configuration for SPI
  ...

Pull ARM SoC power management and clock changes from Olof Johansson:
 "This branch contains a largeish set of updates of power management and
  clock setup.  The bulk of it is for OMAP/AM33xx platforms, but also a
  few around hotplug/suspend/resume on Exynos.

  It includes a split-up of some of the OMAP clock data into separate
  files which adds to the diffstat, but gross delta is fairly reasonable."

* tag 'pm-merge' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (60 commits)
  ARM: OMAP: Move plat-omap/dma-omap.h to include/linux/omap-dma.h
  ASoC: OMAP: mcbsp fixes for enabling ARM multiplatform support
  watchdog: OMAP: fixup for ARM multiplatform support
  ARM: EXYNOS: Add flush_cache_all in suspend finisher
  ARM: EXYNOS: Remove scu_enable from cpuidle
  ARM: EXYNOS: Fix soft reboot hang after suspend/resume
  ARM: EXYNOS: Add support for rtc wakeup
  ARM: EXYNOS: fix the hotplug for Cortex-A15
  ARM: OMAP2+: omap_device: Correct resource handling for DT boot
  ARM: OMAP2+: hwmod: Add possibility to count hwmod resources based on type
  ARM: OMAP2+: hwmod: Add support for per hwmod/module context lost count
  ARM: OMAP2+: PRM: initialize some PRM functions early
  ARM: OMAP2+: voltage: fixup oscillator handling when CONFIG_PM=n
  ARM: OMAP4: USB: power down MUSB PHY during boot
  ARM: OMAP2+: clock: Cleanup !CONFIG_COMMON_CLK parts
  ARM: OMAP2xxx: clock: drop obsolete clock data
  ARM: OMAP2: clock: Cleanup !CONFIG_COMMON_CLK parts
  ARM: OMAP3+: DPLL: drop !CONFIG_COMMON_CLK sections
  ARM: AM33xx: clock: drop obsolete clock data
  ARM: OMAP3xxx: clk: drop obsolete clock data
  ...

Pull ARM SoC multiplatform conversion patches from Olof Johansson:
 "Here are more patches in the progression towards multiplatform, sparse
  irq conversions in particular.

  Tegra has a handful of cleanups and general groundwork, but is not
  quite there yet on full enablement.

  Platforms that are enabled through this branch are VT8500 and Zynq.
  Note that i.MX was converted in one of the earlier cleanup branches as
  well (before we started a separate topic for multiplatform).  And both
  new platforms for this merge window, sunxi and bcm, were merged with
  multiplatform support enabled."

Fix up conflicts mostly as per Olof.

* tag 'multiplatform' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (29 commits)
  ARM: zynq: Remove all unused mach headers
  ARM: zynq: add support for ARCH_MULTIPLATFORM
  ARM: zynq: make use of debug_ll_io_init()
  ARM: zynq: remove TTC early mapping
  ARM: tegra: move debug-macro.S to include/debug
  ARM: tegra: don't include iomap.h from debug-macro.S
  ARM: tegra: decouple uncompress.h and debug-macro.S
  ARM: tegra: simplify DEBUG_LL UART selection options
  ARM: tegra: select SPARSE_IRQ
  ARM: tegra: enhance timer.c to get IO address from device tree
  ARM: tegra: enhance timer.c to get IRQ info from device tree
  ARM: timer: fix checkpatch warnings
  ARM: tegra: add TWD to device tree
  ARM: tegra: define DT bindings for and instantiate RTC
  ARM: tegra: define DT bindings for and instantiate timer
  clocksource/mtu-nomadik: use apb_pclk
  clk: ux500: Register mtu apb_pclocks
  ARM: plat-nomadik: convert platforms to SPARSE_IRQ
  mfd/db8500-prcmu: use the irq_domain_add_simple()
  mfd/ab8500-core: use irq_domain_add_simple()
  ...

Pull ARM SoC device tree conversions and enablement from Olof Johansson:
 "Continued device tree conversion and enablement across a number of
  platforms; Kirkwood, tegra, i.MX, Exynos, zynq and a couple of other
  smaller series as well.

  ux500 has seen continued conversion for platforms.  Several platforms
  have seen pinctrl-via-devicetree conversions for simpler
  multiplatform.  Tegra is adding data for new devices/drivers, and
  Exynos has a bunch of new bindings and devices added as well.

  So, pretty much the same progression in the right direction as the
  last few releases."

Fix up conflicts as per Olof.

* tag 'dt' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (185 commits)
  ARM: ux500: Rename dbx500 cpufreq code to be more generic
  ARM: dts: add missing ux500 device trees
  ARM: ux500: Stop registering the PCM driver from platform code
  ARM: ux500: Move board specific GPIO info out to subordinate DTS files
  ARM: ux500: Disable the MMCI gpio-regulator by default
  ARM: Kirkwood: remove kirkwood_ehci_init() from new boards
  ARM: Kirkwood: Add support LED of OpenBlocks A6
  ARM: Kirkwood: Convert to EHCI via DT for OpenBlocks A6
  ARM: kirkwood: Add NAND partiton map for OpenBlocks A6
  ARM: kirkwood: Add support second I2C bus and RTC on OpenBlocks A6
  ARM: kirkwood: Add support DT of second I2C bus
  ARM: kirkwood: Convert mplcec4 board to pinctrl
  ARM: Kirkwood: Convert km_kirkwood to pinctrl
  ARM: Kirkwood: support 98DX412x kirkwoods with pinctrl
  ARM: Kirkwood: Convert IX2-200 to pinctrl.
  ARM: Kirkwood: Convert lsxl boards to pinctrl.
  ARM: Kirkwood: Convert ib62x0 to pinctrl.
  ARM: Kirkwood: Convert GoFlex Net to pinctrl.
  ARM: Kirkwood: Convert dreamplug to pinctrl.
  ARM: Kirkwood: Convert dockstar to pinctrl.
  ...

Fix the warnings reported by sparse on recent bridge multicast
changes. Mostly just rcu annotation issues but in this case
sparse found a real bug! The ICMPv6 mld2 query mrc
values is in network byte order.
Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Add documentation for struct ethtool_flow_ext especially in regard
to what flags are needed for which fields.
Signed-off-by: Yan Burman <yanb@mellanox.com>
Reviewed-by: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

If a natural number n exists where 2 + data_len <= 8n < 2 + data_len + pad,
post padding is not initialized correctly.

(Un)fortunately, the only type that requires pad is Infiniband,
whose pad is 2 and data_len is 20, and this logical error has not
become obvious, but it is better to fix.

Note that ndisc_opt_addr_space() handles the situation described
above correctly.
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

On Wed, 2012-12-12 at 23:16 -0500, Dave Jones wrote:
> Since todays net merge, I see this when I start openvpn..
>
> general protection fault: 0000 [#1] PREEMPT SMP
> Modules linked in: ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_conntrack nf_conntrack ip6table_filter ip6_tables xfs iTCO_wdt iTCO_vendor_support snd_emu10k1 snd_util_mem snd_ac97_codec coretemp ac97_bus microcode snd_hwdep snd_seq pcspkr snd_pcm snd_page_alloc snd_timer lpc_ich i2c_i801 snd_rawmidi mfd_core snd_seq_device snd e1000e soundcore emu10k1_gp gameport i82975x_edac edac_core vhost_net tun macvtap macvlan kvm_intel kvm binfmt_misc nfsd auth_rpcgss nfs_acl lockd sunrpc btrfs libcrc32c zlib_deflate firewire_ohci sata_sil firewire_core crc_itu_t radeon i2c_algo_bit drm_kms_helper ttm drm i2c_core floppy
> CPU 0
> Pid: 1381, comm: openvpn Not tainted 3.7.0+ #14                  /D975XBX
> RIP: 0010:[<ffffffff815b54a4>]  [<ffffffff815b54a4>] skb_flow_dissect+0x314/0x3e0
> RSP: 0018:ffff88007d0d9c48  EFLAGS: 00010206
> RAX: 000000000000055d RBX: 6b6b6b6b6b6b6b4b RCX: 1471030a0180040a
> RDX: 0000000000000005 RSI: 00000000ffffffe0 RDI: ffff8800ba83fa80
> RBP: ffff88007d0d9cb8 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000101 R12: ffff8800ba83fa80
> R13: 0000000000000008 R14: ffff88007d0d9cc8 R15: ffff8800ba83fa80
> FS:  00007f6637104800(0000) GS:ffff8800bf600000(0000) knlGS:0000000000000000
> CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f563f5b01c4 CR3: 000000007d140000 CR4: 00000000000007f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
> Process openvpn (pid: 1381, threadinfo ffff88007d0d8000, task ffff8800a540cd60)
> Stack:
>  ffff8800ba83fa80 0000000000000296 0000000000000000 0000000000000000
>  ffff88007d0d9cc8 ffffffff815bcff4 ffff88007d0d9ce8 ffffffff815b1831
>  ffff88007d0d9ca8 00000000703f6364 ffff8800ba83fa80 0000000000000000
> Call Trace:
>  [<ffffffff815bcff4>] ? netif_rx+0x114/0x4c0
>  [<ffffffff815b1831>] ? skb_copy_datagram_from_iovec+0x61/0x290
>  [<ffffffff815b672a>] __skb_get_rxhash+0x1a/0xd0
>  [<ffffffffa03b9538>] tun_get_user+0x418/0x810 [tun]
>  [<ffffffff8135f468>] ? delay_tsc+0x98/0xf0
>  [<ffffffff8109605c>] ? __rcu_read_unlock+0x5c/0xa0
>  [<ffffffffa03b9a41>] tun_chr_aio_write+0x81/0xb0 [tun]
>  [<ffffffff81145011>] ? __buffer_unlock_commit+0x41/0x50
>  [<ffffffff811db917>] do_sync_write+0xa7/0xe0
>  [<ffffffff811dc01f>] vfs_write+0xaf/0x190
>  [<ffffffff811dc375>] sys_write+0x55/0xa0
>  [<ffffffff81705540>] tracesys+0xdd/0xe2
> Code: 41 8b 44 24 68 41 2b 44 24 6c 01 de 29 f0 83 f8 03 0f 8e a0 00 00 00 48 63 de 49 03 9c 24 e0 00 00 00 48 85 db 0f 84 72 fe ff ff <8b> 03 41 89 46 08 b8 01 00 00 00 e9 43 fd ff ff 0f 1f 40 00 48
> RIP  [<ffffffff815b54a4>] skb_flow_dissect+0x314/0x3e0
>  RSP <ffff88007d0d9c48>
> ---[ end trace 6d42c834c72c002e ]---
>
>
> Faulting instruction is
>
>    0:	8b 03                	mov    (%rbx),%eax
>
> rbx is slab poison (-20) so this looks like a use-after-free here...
>
>                         flow->ports = *ports;
>  314:   8b 03                   mov    (%rbx),%eax
>  316:   41 89 46 08             mov    %eax,0x8(%r14)
>
> in the inlined skb_header_pointer in skb_flow_dissect
>
> 	Dave
>

commit 96442e42 (tuntap: choose the txq based on rxq) added
a use after free.

Cache rxhash in a temp variable before calling netif_rx_ni()
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jason Wang <jasowang@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This is easily triggerable when fuzz-testing as an unprivileged user.
We could rate-limit it, but given we don't print similar messages
for other protocols, I just removed it.
Signed-off-by: Dave Jones <davej@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>