enter_lmode() and exit_lmode() modify the guest's EFER.LMA before calling
vmx_set_efer().  However, the latter function depends on the value of EFER.LMA
to determine whether MSR_KERNEL_GS_BASE needs reloading, via
vmx_load_host_state().  With EFER.LMA changing under its feet, it took the
wrong choice and corrupted userspace's %gs.

This causes 32-on-64 host userspace to fault.

Fix not touching EFER.LMA; instead ask vmx_set_efer() to change it.
Signed-off-by: NAvi Kivity <avi@redhat.com>

* master.kernel.org:/home/rmk/linux-2.6-arm:
  ARM: 6205/1: perf: ensure counter delta is treated as unsigned
  ARM: 6202/1: Do not ARM_DMA_MEM_BUFFERABLE on RealView boards with L210/L220
  ARM: 6201/1: RealView: Do not use outer_sync() on ARM11MPCore boards with L220
  ARM: 6195/1: OMAP3: pmu: make CPU_HAS_PMU dependent on OMAP3_EMU
  ARM: 6194/1: change definition of cpu_relax() for ARM11MPCore
  ARM: 6193/1: RealView: Align the machine_desc.phys_io to 1MB section
  ARM: 6192/1: VExpress: Align the machine_desc.phys_io to 1MB section
  ARM: 6188/1: Add a config option for the ARM11MPCore DMA cache maintenance workaround
  ARM: 6187/1: The v6_dma_inv_range() function must preserve data on SMP
  ARM: 6186/1: Avoid the CONSISTENT_DMA_SIZE warning on noMMU builds
  ARM: mx3: mx31lilly: fix build error for !CONFIG_USB_ULPI
  [ARM] mmp: fix build failure due to IRQ_PMU depends on ARCH_PXA
  [ARM] pxa/mioa701: fix camera regression
  [ARM] pxa/z2: fix flash layout to final version
  [ARM] pxa/z2: fix missing include in battery driver
  [ARM] pxa: fix incorrect gpio type in udc_pxa2xx.h

Merge branch 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'perf-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  perf, x86: Fix incorrect branches event on AMD CPUs
  perf tools: Fix find tids routine by excluding "." and ".."
  x86: Send a SIGTRAP for user icebp traps

We should initialize the module dynamic debug datastructures
only after determining that the module is not loaded yet. This
fixes a bug that introduced in 2.6.35-rc2, where when a trying
to load a module twice, we also load it's dynamic printing data
twice which causes all sorts of nasty issues. Also handle
the dynamic debug cleanup later on failure.
Signed-off-by: NYehuda Sadeh <yehuda@hq.newdream.net>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> (removed a #ifdef)
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://oss.sgi.com/xfs/xfs:
  xfs: remove block number from inode lookup code
  xfs: rename XFS_IGET_BULKSTAT to XFS_IGET_UNTRUSTED
  xfs: validate untrusted inode numbers during lookup
  xfs: always use iget in bulkstat
  xfs: prevent swapext from operating on write-only files

* 'merge-devicetree' of git://git.secretlab.ca/git/linux-2.6:
  of/dma: fix build breakage in ppc4xx adma driver

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/i7core:
  MAINTAINERS: Add an entry for i7core_edac
  i7core_edac: Avoid doing multiple probes for the same card
  i7core_edac: Properly discover the first QPI device

* 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6:
  kbuild: Propagate LOCALVERSION= down to scripts/setlocalversion
  kbuild: Clean up and speed up the localversion logic

Hardware performance counters on ARM are 32-bits wide but atomic64_t
variables are used to represent counter data in the hw_perf_event structure.

The armpmu_event_update function right-shifts a signed 64-bit delta variable
and adds the result to the event count. This can lead to shifting in sign-bits
if the MSB of the 32-bit counter value is set. This results in perf output
such as:

 Performance counter stats for 'sleep 20':

 18446744073460670464  cycles             <-- 0xFFFFFFFFF12A6000
        7783773  instructions             #      0.000 IPC
            465  context-switches
            161  page-faults
        1172393  branches

   20.154242147  seconds time elapsed

This patch ensures that the delta value is treated as unsigned so that the
right shift sets the upper bits to zero.

Cc: <stable@kernel.org>
Acked-by: NJamie Iles <jamie.iles@picochip.com>
Signed-off-by: NWill Deacon <will.deacon@arm.com>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

While doing some performance counter validation tests on some
assembly language programs I noticed that the "branches:u"
count was very wrong on AMD machines.

It looks like the wrong event was selected.
Signed-off-by: NVince Weaver <vweaver1@eecs.utk.edu>
Acked-by: NPeter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Robert Richter <robert.richter@amd.com>
Cc: Borislav Petkov <borislav.petkov@amd.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: <stable@kernel.org>
LKML-Reference: <alpine.DEB.2.00.1007011526010.23160@cl320.eecs.utk.edu>
Signed-off-by: NIngo Molnar <mingo@elte.hu>

Convert ppc4xx adma driver to use new node pointer location
Signed-off-by: NDan Williams <dan.j.williams@intel.com>
Acked-by: NAnatolij Gustschin <agust@denx.de>
Signed-off-by: NGrant Likely <grant.likely@secretlab.ca>

While here, fixes the mailing list for i5400_edac
Acked-by: NDoug Thompson <dougthompson@xmission.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

As Nehalem/Nehalem-EP/Westmere devices uses several devices for the same
functionality (memory controller), the default way of proping devices doesn't
work. So, instead of a per-device probe, all devices should be probed at once.

This means that we should block any new attempt of probe, otherwise, it will
try to register the same device several times.
Acked-by: NDoug Thompson <dougthompson@xmission.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

On Nehalem/Nehalem-EP/Westmere, the first QPI device is the last PCI bus.
The last bus is generally at 0x3f or 0xff, but there are also other systems
using different setups. For example, HP Z800 has 0x7f as the last bus.

This patch adds a logic to discover the last bus, dynamically detecting it
at runtime.
Acked-by: NDoug Thompson <dougthompson@xmission.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>

Merge branch 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

* 'sched-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip:
  sched: Cure nr_iowait_cpu() users
  init: Fix comment
  init, sched: Fix race between init and kthreadd

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp:
  amd64_edac: Fix syndrome calculation on K8

When calculating the DCT channel from the syndrome we need to know the
syndrome type (x4 vs x8). On F10h, this is read out from extended PCI
cfg space register F3x180 while on K8 we only support x4 syndromes and
don't have extended PCI config space anyway.

Make the code accessing F3x180 F10h only and fall back to x4 syndromes
on everything else.

Cc: <stable@kernel.org> # .33.x .34.x
Reported-by: NJeffrey Merkey <jeffmerkey@gmail.com>
Signed-off-by: NBorislav Petkov <borislav.petkov@amd.com>

Conflicts:
	Makefile

RealView boards with certain revisions of the L210/L220 cache controller
may have issues (hardware deadlock) with the mandatory barriers (DSB
followed by an L2 cache sync) when ARM_DMA_MEM_BUFFERABLE is enabled.
The patch disables ARM_DMA_MEM_BUFFERABLE for these boards.
Tested-by: NLinus Walleij <linus.walleij@stericsson.com>
Signed-off-by: NCatalin Marinas <catalin.marinas@arm.com>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

RealView boards with certain revisions of the L220 cache controller (ARM11*
processors only) may have issues (hardware deadlock) with the recent changes to
the mb() barrier implementation (DSB followed by an L2 cache sync). The patch
redefines the RealView ARM11MPCore mandatory barriers without the outer_sync()
call.

Cc: <stable@kernel.org>
Tested-by: NLinus Walleij <linus.walleij@stericsson.com>
Signed-off-by: NCatalin Marinas <catalin.marinas@arm.com>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/anholt/drm-intel:
  drm/i915: fix page flip finish vs. prepare on plane B
  drm/i915: change default panel fitting mode to preserve aspect ratio
  drm/i915: fix uninitialized variable warning in i915_setup_compression()
  drm/i915: take struct_mutex in i915_dma_cleanup()
  drm/i915: Fix CRT hotplug regression in 2.6.35-rc1
  i915: fix ironlake edp panel setup (v4)
  drm/i915: don't access FW_BLC_SELF on 965G
  drm/i915: Account for space on the ring buffer consumed whilst wrapping.
  drm/i915: gen3 page flipping fixes
  drm/i915: don't queue flips during a flip pending event
  drm/i915: Fix incorrect intel_ring_begin size in BSD ringbuffer.
  drm/i915: Turn on 945 self-refresh only if single CRTC is active
  drm/i915/gen4: Fix interrupt setup ordering
  drm/i915: Use RSEN instead of HTPLG for tfp410 monitor detection.
  drm/i915: Move non-phys cursors into the GTT
  Revert "drm/i915: Don't enable pipe/plane/VCO early (wait for DPMS on)."

(Included the "fix page flip finish vs.  prepare on plane B" patch from
Jesse on top of the pull request from Eric.   -- Linus)

The refreshed patch had a copy & paste bug.
Reported-by: NSimon Farnsworth <simon.farnsworth@onelan.com>
Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

* 'upstream-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jgarzik/libata-dev:
  ata_generic: implement ATA_GEN_* flags and force enable DMA on MBP 7,1
  ahci,ata_generic: let ata_generic handle new MBP w/ MCP89
  libahci: Fix bug in storing EM messages

When booting 2.6.35-rc3 on a x86 system without an ERST ACPI table with
the 'quiet' option, we still observe an "ERST: Table is not found!"
warning.

Quiesce it to the same info log level as the other 'table not found'
warnings.
Signed-off-by: NDaniel J Blueman <daniel.blueman@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Since commit 4bdadb97 ("drm/i915:
Selectively enable self-reclaim"), we've been passing GFP_MOVABLE to the
i915 page allocator where we weren't before due to some over-eager
removal of the page mapping gfp_flags games the code used to play.

This caused hibernate on Intel hardware to result in a lot of memory
corruptions on resume.  See for example

  http://bugzilla.kernel.org/show_bug.cgi?id=13811

Reported-by: Evengi Golov (in bugzilla)
Signed-off-by: NDave Airlie <airlied@redhat.com>
Tested-by: NM. Vefa Bicakci <bicave@superonline.com>
Cc: stable@kernel.org
Cc: Chris Wilson <chris@chris-wilson.co.uk>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Hugh Dickins <hugh.dickins@tiscali.co.uk>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

We did this a long time ago in the DDX driver, but now this fix belongs
in the kernel.

Preserving the aspect ratio is a nicer default.

Fixes https://bugs.freedesktop.org/show_bug.cgi?id=18033.
Tested-by: NJosh Triplett <josh@freedesktop.org>
Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: NEric Anholt <eric@anholt.net>

Fixes:

drivers/gpu/drm/i915/i915_dma.c: In function ‘i915_setup_compression’:
drivers/gpu/drm/i915/i915_dma.c:1311: error: ‘compressed_llb’ may be used uninitialized in this function
Signed-off-by: NPrarit Bhargava <prarit@redhat.com>
Signed-off-by: NEric Anholt <eric@anholt.net>

intel_cleanup_ring_buffer() calls drm_gem_object_unreference() (as
opposed to drm_gem_object_unreference_unlocked()) so it needs to be
called with "struct_mutex" held.  If we don't hold the lock, it triggers
a BUG_ON(!mutex_is_locked(&dev->struct_mutex));

I also audited the other places that call intel_cleanup_ring_buffer()
and they all hold the lock so they're OK.

This was introduced in: 8187a2b7 "drm/i915: introduce
intel_ring_buffer structure (V2)" and it's a regression from v2.6.34.

Addresses: https://bugzilla.kernel.org/show_bug.cgi?id=16247Signed-off-by: NDan Carpenter <error27@gmail.com>
Reported-by: NBenny Halevy <bhalevy@panasas.com>
Tested-by: NBenny Halevy <bhalevy@panasas.com>
Signed-off-by: NEric Anholt <eric@anholt.net>

Commit 7a772c49 has two bugs which
made the hotplug problems on my laptop worse instead of better.

First, it did not, in fact, disable the CRT plug interrupt -- it
disabled all the other hotplug interrupts.  It seems rather doubtful
that that bit of the patch fixed anything, so let's just remove it.
(If you want to add it back, you probably meant ~CRT_HOTPLUG_INT_EN.)

Second, on at least my GM45, setting CRT_HOTPLUG_ACTIVATION_PERIOD_64
and CRT_HOTPLUG_VOLTAGE_COMPARE_50 (when they were previously unset)
causes a hotplug interrupt about three seconds later.  The old code
never restored PORT_HOTPLUG_EN so this could only happen once, but
they new code restores those registers.  So just set those bits when
we set up the interrupt in the first place.
Signed-off-by: NAndy Lutomirski <luto@mit.edu>
Signed-off-by: NEric Anholt <eric@anholt.net>

The eDP spec claims a 20% overhead for the 8:10 encoding scheme used
on the wire. Take this into account when picking the lane/clock speed
for the panel.

v3: some panels are out of spec, try our best to deal with them, don't
refuse modes on eDP panels, and try the largest allowed settings if
all else fails on eDP.
v4: fix stupid typo, forgot to git add before amending.

Fixes several reports in bugzilla:

      https://bugs.freedesktop.org/show_bug.cgi?id=28070Signed-off-by: NDave Airlie <airlied@redhat.com>
Signed-off-by: NEric Anholt <eric@anholt.net>

The register offset for FW_BLC_SELF is a totally different set of bits
on Broadwater (it's actually MI_RDRET_STATE), so don't treat it like
FW_BLC_SELF on 965G chips.

Fixes bug https://bugs.freedesktop.org/show_bug.cgi?id=26874.

Cc: stable@kernel.org
Tested-by: NNorman Yarvin <yarvin@yarchive.net>
Signed-off-by: NJesse Barnes <jbarnes@virtuousgeek.org>
Signed-off-by: NEric Anholt <eric@anholt.net>

If we fill the tail of the physical ring buffer with NOOP when wrapping,
we need to account for the reduction in available space.
Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: NEric Anholt <eric@anholt.net>

IDE mode of MCP89 on MBP 7,1 doesn't set DMA enable bits in the BMDMA
status register.  Make the following changes to work around the problem.

* Instead of using hard coded 1 in id->driver_data as class code
  match, use ATA_GEN_CLASS_MATCH and carry the matched id in
  host->private_data.

* Instead of matching PCI_VENDOR_ID_CENATEK, use ATA_GEN_FORCE_DMA
  flag in id instead.

* Add ATA_GEN_FORCE_DMA to the id entry of MBP 7,1.
Signed-off-by: NTejun Heo <tj@kernel.org>
Cc: Peer Chen <pchen@nvidia.com>
Cc: stable@kernel.org
Reported-by: NAnders Østhus <grapz666@gmail.com>
Reported-by: NAndreas Graf <andreas_graf@csgraf.de>
Reported-by: NBenoit Gschwind <gschwind@gnu-log.net>
Reported-by: NDamien Cassou <damien.cassou@gmail.com>
Reported-by: tixetsal@juno.com
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

For yet unknown reason, MCP89 on MBP 7,1 doesn't work w/ ahci under
linux but the controller doesn't require explicit mode setting and
works fine with ata_generic.  Make ahci ignore the controller on MBP
7,1 and let ata_generic take it for now.

Reported in bko#15923.

  https://bugzilla.kernel.org/show_bug.cgi?id=15923

NVIDIA is investigating why ahci mode doesn't work.
Signed-off-by: NTejun Heo <tj@kernel.org>
Cc: Peer Chen <pchen@nvidia.com>
Cc: stable@kernel.org
Reported-by: NAnders Østhus <grapz666@gmail.com>
Reported-by: NAndreas Graf <andreas_graf@csgraf.de>
Reported-by: NBenoit Gschwind <gschwind@gnu-log.net>
Reported-by: NDamien Cassou <damien.cassou@gmail.com>
Reported-by: tixetsal@juno.com
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

In function ahci_store_em_buffer(), if the input (signed char*) buffer
contains negative data, the constructed 32-bit long message data may
be wrong.
Signed-off-by: NHarry Zhang <harry.zhang@amd.com>
Signed-off-by: NJeff Garzik <jgarzik@redhat.com>

Introduce a filter function to skip "." and ".." directories when calculating
tid number, otherwise tid 0 will be included in the all_tid result array.

Cc: Ingo Molnar <mingo@elte.hu>
LKML-Reference: <4C185F68.1020505@cn.fujitsu.com>
Signed-off-by: NGui Jianfeng <guijianfeng@cn.fujitsu.com>
Signed-off-by: NArnaldo Carvalho de Melo <acme@redhat.com>

* git://git.kernel.org/pub/scm/linux/kernel/git/wim/linux-2.6-watchdog:
  watchdog: docs: add an entry for imx2_wdt

* 'drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/airlied/drm-2.6: (27 commits)
  drm/radeon/kms: remove rv100 bios connector quirk
  drm/radeon/kms/pm: fix power state indexing on igp chips in dynpm mode
  DRM / radeon / KMS: Fix hibernation regression related to radeon PM (was: Re: [Regression, post-2.6.34] Hibernation broken on machines with radeon/KMS and r300)
  drm/radeon/kms/igp: fix possible divide by 0 in bandwidth code (v2)
  drm/radeon: add quirk to make HP nx6125 laptop resume.
  drm/radeon/kms: add some missing regs to evergreen gpu init
  drm/radeon/kms: fix typos in evergreen command checker
  drm/radeon/kms: avoid oops on mac r4xx cards
  fb: fix colliding defines for fb flags.
  drm/radeon/kms: Force HDP_NONSURF to maximum size
  drm/radeon/kms: disable frac fb dividers for rs6xx
  drm/radeon/kms: don't read attempt to read bios from VRAM on unposted GPU.
  drm/radeon/kms: fix typo in evergreen_gpu_init
  drm/radeon/kms: return ret in cursor_set failure path
  drm/ttm: non pooled page allocation should have GFP_USER set
  drm/radeon/r100/r200: fix calculation of compressed cube maps
  drm/radeon/r200: handle more hw tex coord types
  drm/radeon/kms: CS checker texture fixes for r1xx/r2xx/r3xx
  drm/radeon: add fake RN50 table for powerpc
  drm/fb: Fix video= mode computation
  ...

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux-2.6:
  [IA64] Fix spinaphore down_spin()