Access to arbitrary hypercalls is currently provided via xenfs. This
adds a standard character device to handle this. The support in xenfs
remains for backward compatibility and uses the device driver code.
Signed-off-by: Bastian Blank <waldi@debian.org>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

When a multi-page mapping of gntalloc is created, the reference counts
of all pages in the vma are incremented. However, the vma open/close
operations only adjusted the reference count of the first page in the
mapping, leaking the other pages. Store a struct in the vm_private_data
to track the original page count to properly free the pages when the
last reference to the vma is closed.
Reported-by: Anil Madhavapeddy <anil@recoil.org>
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

gnttab_end_foreign_access_ref does not return the grant reference it is
passed to the free list; gnttab_free_grant_reference needs to be
explicitly called. While gnttab_end_foreign_access provides a wrapper
for this, it is unsuitable because it does not return errors.
Reported-by: Anil Madhavapeddy <anil@recoil.org>
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

The event channel number provided to evtchn_get can be provided by
userspace, so needs to be checked against the maximum number of event
channels prior to using it to index into evtchn_to_irq.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

These allow a domain A which has been granted access on a page of domain B's
memory to issue domain C with a copy-grant on the same page.  This is useful
e.g. for forwarding packets between domains.
Signed-off-by: Annie Li <annie.li@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

- They can't be used to map the page (so can only be used in a GNTTABOP_copy
  hypercall).
- It's possible to grant access with a finer granularity than whole pages.
- Xen guarantees that they can be revoked quickly (a normal map grant can
  only be revoked with the cooperation of the domain which has been granted
  access).
Signed-off-by: Annie Li <annie.li@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Signed-off-by: Annie Li <annie.li@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

include/xen/interface/xen.h:526: error: conflicting types for ‘__guest_handle_u64’
arch/ia64/include/asm/xen/interface.h:74: error: previous declaration of ‘__guest_handle_u64’ was here

Problem introduced by "xen/granttable: Introducing grant table V2 stucture"

which added a new definition to include/xen/interface/xen.h for "u64".

Fix: delete the ia64 arch specific definition.
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Acked-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Annie Li <annie.li@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Receiver-side copying of packets is based on this implementation, it gives
better performance and better CPU accounting. It totally supports three types:
full-page, sub-page and transitive grants.

However this patch does not cover sub-page and transitive grants, it mainly
focus on Full-page part and implements grant table V2 interfaces corresponding
to what already exists in grant table V1, such as: grant table V2
initialization, mapping, releasing and exported interfaces.

Each guest can only supports one type of grant table type, every entry in grant
table should be the same version. It is necessary to set V1 or V2 version before
initializing the grant table.

Grant table exported interfaces of V2 are same with those of V1, Xen is
responsible to judge what grant table version guests are using in every grant
operation.

V2 fulfills the same role of V1, and it is totally backwards compitable with V1.
If dom0 support grant table V2, the guests runing on it can run with either V1
or V2.
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Annie Li <annie.li@oracle.com>
[v1: Modified alloc_vm_area call (new parameters), indentation, and cleanpatch
     warnings]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Acked-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Annie Li <annie.li@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

This patch introduces new structures of grant table V2, grant table V2 is an
extension from V1. Grant table is shared between guest and Xen, and Xen is
responsible to do corresponding work for grant operations, such as: figure
out guest's grant table version, perform different actions based on
different grant table version, etc. Although full-page structure of V2
is different from V1, it play the same role as V1.
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: Annie Li <annie.li@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

No longer at Citrix, still interested in Xen.
Signed-off-by: Jeremy Fitzhardinge <jeremy.fitzhardinge@citrix.com>
Cc: Jeremy Fitzhardinge <jeremy@goop.org>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Event channels exposed to userspace by the evtchn module may be used by
other modules in an asynchronous manner, which requires that reference
counting be used to prevent the event channel from being closed before
the signals are delivered.

The reference count on new event channels defaults to -1 which indicates
the event channel is not referenced outside the kernel; evtchn_get fails
if called on such an event channel. The event channels made visible to
userspace by evtchn have a normal reference count.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

When using the unmap notify ioctl, the event channel used for
notification needs to be reserved to avoid it being deallocated prior to
sending the notification.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

The event channel release function cannot be called under a spinlock
because it can attempt to acquire a mutex due to the event channel
reference acquired when setting up unmap notifications.
Signed-off-by: Daniel De Graaf <dgdegra@tycho.nsa.gov>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Which is that 128GB is not going to happen with 32-bit PV DomU.
Lets use something more realistic. Also update the 64-bit to 500GB
which is the max a PV guest can do.
Signed-off-by: Maxim Uvarov <maxim.uvarov@oracle.com>
[v1: Updated 128GB->500GB for 64-bit]
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

* stable/docs-for-3.3:
  xen: document backend sysfs files
  xen: document balloon driver sysfs files

* 'iommu/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  iommu: omap: Fix compile failure

* 'fixes' of git://git.linaro.org/people/triad/linux-pinctrl:
  pinctrl: hide subsystem from the populace
  pinctrl: fix "warning: 'struct pinctrl_dev' declared inside parameter list"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux:
  fsl-rio: fix compile error

* 'gpio/merge' of git://git.secretlab.ca/git/linux-2.6:
  gpio: pca953x: propagate the errno from the chip_init functions
  gpio: pca953x: remove unneeded check for chip type
  gpio/omap: check return value from irq_alloc_generic_chip
  gpio/omap: replace MOD_REG_BIT macro with static inline

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lliubbo/blackfin:
  blackfin: Fixup export.h includes
  Blackfin: add serial TX IRQ in individual platform resource

On a corrupted file system the ->len field could be wrong leading to
a buffer overflow.
Reported-and-acked-by: Clement LECIGNE <clement.lecigne@netasq.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The "#include <linux/module.h>" was replaced by "#include <linux/export.h>"
in the patch "powerpc: various straight conversions from module.h --> export.h".
This will cause the following compile problem:
arch/powerpc/sysdev/fsl_rio.c: In function 'fsl_rio_mcheck_exception':
arch/powerpc/sysdev/fsl_rio.c:296: error: implicit declaration of function 'search_exception_tables'.

The file fsl_rio.c needs the declaration of function "search_exception_tables"
in the header file "linux/module.h".
Signed-off-by: Liu Gang <Gang.Liu@freescale.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>

Commit 8dc7a9c8 ("blackfin: Add export.h to files using
EXPORT_SYMBOL/THIS_MODULE") inserted some of the include statements into
sections protected by an unrelated #if CONFIG_... statement. This can cause,
depending on the configuration used, warnings like this one:

	arch/blackfin/mach-bf537/boards/stamp.c:2940: warning: data definition has no type or storage class
	arch/blackfin/mach-bf537/boards/stamp.c:2940: warning: type defaults to ‘int’ in declaration of ‘EXPORT_SYMBOL’
	arch/blackfin/mach-bf537/boards/stamp.c:2940: warning: parameter names (without types) in function declaration

This patch fixes it by moving the includes out of the #if protected sections.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Bob Liu <lliubbo@gmail.com>

The serial TX IRQ is not simply (RX IRQ + 1) on some Blackfin chips,
so move the values to the platform resources.
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Bob Liu <lliubbo@gmail.com>

* 'rmobile-fixes-for-linus' of git://github.com/pmundt/linux-sh:
  ARM: mach-shmobile: cpuidle single/global and last_state fixes
  ARM: mach-shmobile: move helper macro PORTCR to sh_pfc.h
  ARM: mach-shmobile: move helper macro PORT_xx to sh_pfc.h
  ARM: mach-shmobile: move helper macro PORT_DATA_xx to sh_pfc.h
  ARM: mach-shmobile: ap4evb: remove white space from end of line
  ARM: mach-shmobile: clock-sh7372: remove un-necessary index
  ARM: mach-shmobile: kota2: add comment out separator
  ARM: mach-shmobile: sh73a0: add MMC data pin pull-up

* 'sh-fixes-for-linus' of git://github.com/pmundt/linux-sh:
  mailmap: Fix up some renesas attributions
  sh: clkfwk: Kill off remaining debugfs cruft.
  drivers: sh: Kill off dead pathname for runtime PM stub.
  drivers: sh: Generalize runtime PM platform stub.
  sh: Wire up process_vm syscalls.
  sh: clkfwk: add clk_rate_mult_range_round()
  serial: sh-sci: Fix up SH-2A SCIF support.
  sh: Fix cached/uncaced address calculation in 29bit mode

* git://github.com/rustyrussell/linux:
  virtio-pci: fix use after free

Commit 31a3ddda introduced
a use after free in virtio-pci. The main issue is
that the release method signals removal of the virtio device,
while remove signals removal of the pci device.

For example, on driver removal or hot-unplug,
virtio_pci_release_dev is called before virtio_pci_remove.
We then might get a crash as virtio_pci_remove tries to use the
device freed by virtio_pci_release_dev.

We allocate/free all resources together with the
pci device, so we can leave the release method empty.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Cc: stable@kernel.org

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon/kms/combios: fix dynamic allocation of PM clock modes

After commit e978aa7d ("cpuidle: Move dev->last_residency update to
driver enter routine; remove dev->last_state") setting acpi_idle_suspend
to 1 by acpi_processor_suspend() causes the ACPI cpuidle routines to
return error codes continuously, which in turn causes cpuidle to lock up
(hard).

However, acpi_idle_suspend doesn't appear to be useful for any
particular purpose (it's racy and doesn't really provide any real
protection), so it can be removed, which makes the problem go away.
Reported-and-tested-by: Tomas M. <tmezzadra@gmail.com>
Reported-and-tested-by: Ferenc Wagner <wferi@niif.hu>
Tested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

I missed the combios path when I updated the atombios pm code.

Reported by amarsh04 on IRC.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  arm/imx: fix imx6q mmc error when mounting rootfs
  arm/imx: fix AUTO_ZRELADDR selection
  arm/imx: fix the references to ARCH_MX3
  ARM: mx51/53: set pwm clock parent to ipg_perclk
  arm/tegra: enable headphone detection gpio on seaboard
  arm/dt: Fix ventana SDHCI power-gpios
  arm/tegra: Don't create duplicate gpio and pinmux devices
  ARM: at91: Fix USBA gadget registration
  atmel/spi: fix missing probe
  at91/yl-9200: Fix section mismatch
  at91: vmalloc fix missing AT91_VIRT_BASE define
  ARM: at91: usart: drop static map regs for dbgu
  ARM: picoxcell: add extra temp register to addruart
  ARM: msm: fix compilation flags for MSM_SCM
  arm/mxs: fix mmc device adding for mach-mx28evk
  ARM: mxc: Remove test_for_ltirq
  ARM:i.MX: fix build error in clock-mx51-mx53.c
  ARM:i.MX: fix build error in tzic/avic.c
  ARM: mxc: fix local timer interrupt handling
  msm: boards: Fix fallout from removal of machine_desc in fixup

The variable i is removed by commit ded84337
"[CPUFREQ] db8500: remove unneeded for loop iteration over freq_table",
but current code to print available frequencies still uses the i variable.
Thus add the i variable back to fix below buld error:

  CC      drivers/cpufreq/db8500-cpufreq.o
drivers/cpufreq/db8500-cpufreq.c: In function 'db8500_cpufreq_init':
drivers/cpufreq/db8500-cpufreq.c:123: error: 'i' undeclared (first use in this function)
drivers/cpufreq/db8500-cpufreq.c:123: error: (Each undeclared identifier is reported only once
drivers/cpufreq/db8500-cpufreq.c:123: error: for each function it appears in.)
make[2]: *** [drivers/cpufreq/db8500-cpufreq.o] Error 1
make[1]: *** [drivers/cpufreq] Error 2
make: *** [drivers] Error 2

This patch also fixes using uninitialized i variable as array index.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Dave Jones <davej@redhat.com>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: (29 commits)
  m68k/mac: Remove mac_irq_{en,dis}able() wrappers
  m68k/irq: Remove obsolete support for user vector interrupt fixups
  m68k/irq: Remove obsolete m68k irq framework
  m68k/q40: Convert Q40/Q60 to genirq
  m68k/sun3: Convert Sun3/3x to genirq
  m68k/sun3: Use the kstat_irqs_cpu() wrapper
  m68k/apollo: Convert Apollo to genirq
  m68k/vme: Convert VME to genirq
  m68k/hp300: Convert HP9000/300 and HP9000/400 to genirq
  m68k/mac: Optimize interrupts using chain handlers
  m68k/mac: Convert Mac to genirq
  m68k/amiga: Optimize interrupts using chain handlers
  m68k/amiga: Convert Amiga to genirq
  m68k/amiga: Refactor amiints.c
  m68k/atari: Remove code and comments about different irq types
  m68k/atari: Convert Atari to genirq
  m68k/irq: Add genirq support
  m68k/irq: Remove obsolete IRQ_FLG_* users
  m68k/irq: Rename {,__}m68k_handle_int()
  m68k/irq: Add m68k_setup_irq_controller()
  ...

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  [media] v4l2-ctrl: Send change events to all fh for auto cluster slave controls
  [media] v4l2-event: Don't set sev->fh to NULL on unsubscribe
  [media] v4l2-event: Remove pending events from fh event queue when unsubscribing
  [media] v4l2-event: Deny subscribing with a type of V4L2_EVENT_ALL
  [media] MAINTAINERS: add a maintainer for s5p-mfc driver
  [media] v4l: s5p-mfc: fix reported capabilities
  [media] media: vb2: reset queued list on REQBUFS(0) call
  [media] media: vb2: set buffer length correctly for all buffer types
  [media] media: vb2: add a check for uninitialized buffer
  [media] mxl111sf: fix build warning
  [media] mxl111sf: remove pointless if condition in mxl111sf_config_spi
  [media] mxl111sf: check for errors after mxl111sf_write_reg in mxl111sf_idac_config
  [media] mxl111sf: fix return value of mxl111sf_idac_config
  [media] uvcvideo: GET_RES should only be checked for BITMAP type menu controls

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc/kvm: Fix build failure with HV KVM and CBE
  powerpc/ps3: Fix lv1_gpu_attribute hcall
  powerpc/ps3: Fix PS3 repository build warnings
  powerpc/ps3: irq: Remove IRQF_DISABLED
  powerpc/irq: Remove IRQF_DISABLED
  powerpc/numa: NUMA topology support for PowerNV
  powerpc: Add System RAM to /proc/iomem
  powerpc: Add KVM as module to defconfigs
  powerpc/kvm: Fix build with older toolchains
  powerpc, tqm5200: update tqm5200_defconfig to fit for charon board.
  powerpc/5200: add support for charon board