The number of entries is multiplied by the entry size, which can
overflow on 32-bit hosts.  Bound the entry count instead.
Reported-by: NDavid Wagner <daw@cs.berkeley.edu>
Cc: stable@kernel.org
Signed-off-by: NAvi Kivity <avi@redhat.com>

It is possible that stale EPTP-tagged mappings are used, if a
vcpu migrates to a different pcpu.

Set KVM_REQ_TLB_FLUSH in vmx_vcpu_load, when switching pcpus, which
will invalidate both VPID and EPT mappings on the next vm-entry.

Cc: stable@kernel.org
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>

Don't overflow when computing the 64-bit period from 32-bit registers.

Fixes sourceforge bug #2826486.
Signed-off-by: NAurelien Jarno <aurelien@aurel32.net>
Cc: stable@kernel.org
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>

commit 628eb9b8
    KVM: s390: streamline memslot handling

introduced kvm_s390_vcpu_get_memsize. This broke guests >=4G, since this
function returned an int.

This patch changes the return value to a long.
Signed-off-by: NChristian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: NAvi Kivity <avi@redhat.com>

When running nested we need to touch the l1 guests
tsc_offset. Otherwise changes will be lost or a wrong value
be read.

Cc: stable@kernel.org
Signed-off-by: NJoerg Roedel <joerg.roedel@amd.com>
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>

When svm_vcpu_load is called while the vcpu is running in
guest mode the tsc adjustment made there is lost on the next
emulated #vmexit. This causes the tsc running backwards in
the guest. This patch fixes the issue by also adjusting the
tsc_offset in the emulated hsave area so that it will not
get lost.

Cc: stable@kernel.org
Signed-off-by: NJoerg Roedel <joerg.roedel@amd.com>
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>

* 'for-linus' of git://www.linux-m32r.org/git/takata/linux-2.6_dev:
  m32r: Fix IPI function calls for SMP
  m32r: Fix set_memory() for DISCONTIGMEM
  m32r: add rtc_lock variable
  m32r: define ioread* and iowrite* macros
  m32r: export delay loop symbols
  m32r: fix tme_handler

A couple of people have hit the WARN_ON() in drivers/char/tty_io.c,
tty_open() that is unhappy about seeing the tty line discipline go away
during the tty hangup. See for example

	http://bugzilla.kernel.org/show_bug.cgi?id=14255

and the reason is that we do the tty_ldisc_halt() outside the
ldisc_mutex in order to be able to flush the scheduled work without a
deadlock with vhangup_work.

However, it turns out that we can solve this particular case by

 - using "cancel_delayed_work_sync()" in tty_ldisc_halt(), which waits
   for just the particular work, rather than synchronizing with any
   random outstanding pending work.

   This won't deadlock, since the buf.work we synchronize with doesn't
   care about the ldisc_mutex, it just flushes the tty ldisc buffers.

 - realize that for this particular case, we don't need to wait for any
   hangup work, because we are inside the hangup codepaths ourselves.

so as a result we can just drop the flush_scheduled_work() entirely, and
then move the tty_ldisc_halt() call to inside the mutex.  That way we
never expose the partially torn down ldisc state to tty_open(), and hold
the ldisc_mutex over the whole sequence.
Reported-by: NIngo Molnar <mingo@elte.hu>
Reported-by: NHeinz Diehl <htd@fancy-poultry.org>
Cc: stable@kernel.org
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

This patch fixes the m32r SMP kernel after 2.6.27.

A part of the following patch breaks m32r SMP operation.
> m32r: convert to generic helpers for IPI function calls
> commit 7b7426c8

In the above patch, a CALL_FUNC_SINGLE_IPI was newly introduced,
but the its IPI vector number was wrong in the patch code.

The m32r SMP kernel hanged-up during boot operation, because
the CPU_BOOT_IPI was called instead of CALL_FUNC_SINGLE_IPI
(CPU_BOOT_IPI had no side effect at that time because the 2nd
core had already been started up),
as a result, csd_unlock() was not called, then a dead lock
occurred in csd_lock_wait() after the detection of Compact Flash
memory as IDE generic disk.
Signed-off-by: NToshihiro HANAWA <hanawa@ccs.tsukuba.ac.jp>
Signed-off-by: NHirokazu Takata <takata@linux-m32r.org>

In case CONFIG_DISCONTIGMEM is set, the memory size of system was
always determined by CONFIG_MEMORY_SIZE and was not changeable.

This patch fixes set_memory() of arch/m32r/mm/discontig.c so that
we can specify memory size by the "mem=<size>" kernel parameter.
Signed-off-by: NHirokazu Takata <takata@linux-m32r.org>

Add a spinlock variable "rtc_lock".
This is taken from arch/arm/kernel/time.c.
Signed-off-by: NHirokazu Takata <takata@linux-m32r.org>

Define ioread* and iowrite* macros to fix the following build errors:

  CC [M]  drivers/uio/uio_smx.o
drivers/uio/uio_smx.c: In function 'smx_handler':
drivers/uio/uio_smx.c:31: error: implicit declaration of function 'ioread32'
drivers/uio/uio_smx.c:37: error: implicit declaration of function 'iowrite32'
Signed-off-by: NHirokazu Takata <takata@linux-m32r.org>

- Move EXPORT_SYMBOL lines of delay loop functions
  from arch/m32r/kernel/m32r_ksyms.c to arch/m32r/lib/delay.c.
- Export __ndelay.
Signed-off-by: NHirokazu Takata <takata@linux-m32r.org>

Fix pmd_bad check code of tme_handler (TLB Miss Exception handler).
The correct _KERNPG_TABLE value is not 0x263(=611) but 0x163.
Signed-off-by: NHirokazu Takata <takata@linux-m32r.org>

* 'for-linus' of ssh://master.kernel.org/pub/scm/linux/kernel/git/tiwai/sound-2.6: (21 commits)
  ALSA: usb - Use strlcat() correctly
  ALSA: Fix invalid __exit in sound/mips/*.c
  ALSA: hda - Fix / improve ALC66x parser
  ALSA: ctxfi: Swapped SURROUND-SIDE mute
  sound: Make keywest_driver static
  ALSA: intel8x0 - Mute External Amplifier by default for Sony VAIO VGN-B1VP
  ALSA: hda - Fix digita/analog mic auto-switching with IDT codecs
  ASoC: fix kconfig order of Blackfin drivers
  ALSA: hda - Added quirk to enable sound on Toshiba NB200
  ASoC: Fix dependency of CONFIG_SND_PXA2XX_SOC_IMOTE2
  ALSA: Don't assume i2c device probing always succeeds
  ALSA: intel8x0 - Mute External Amplifier by default for Sony VAIO VGN-T350P
  ALSA: echoaudio - Re-enable the line-out control for the Mia card
  ALSA: hda - Resurrect input-source mixer of ALC268 model=acer
  ALSA: hda - Analog Devices AD1984A add HP Touchsmart model
  ALSA: hda - Add HP Pavilion dv4t-1300 to MSI whitelist
  ALSA: hda - CD-audio sound for hda-intel conexant benq laptop
  ASoC: DaVinci: Correct McASP FIFO initialization
  ASoC: Davinci: Fix race with cpu_dai->dma_data
  ASoC: DaVinci: Fix divide by zero error during 1st execution
  ...

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  [PATCH] ext4: retry failed direct IO allocations
  ext4: Fix build warning in ext4_dirty_inode()
  ext4: drop ext4dev compat
  ext4: fix a BUG_ON crash by checking that page has buffers attached to it

On a 256M filesystem, doing this in a loop:

        xfs_io -F -f -d -c 'pwrite 0 64m' test
        rm -f test

eventually leads to ENOSPC.  (the xfs_io command does a
64m direct IO write to the file "test")

As with other block allocation callers, it looks like we need to
potentially retry the allocations on the initial ENOSPC.
Signed-off-by: NEric Sandeen <sandeen@redhat.com>
Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>

This fixes the following warning:

fs/ext4/inode.c: In function 'ext4_dirty_inode':
fs/ext4/inode.c:5615: warning: unused variable 'current_handle'

We remove the jbd_debug() statement which does use current_handle, as
it's not terribly important in the grand scheme of things.

Thanks to Stephen Rothwell for pointing this out.
Signed-off-by: NCurt Wohlgemuth <curtw@google.com>
Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>

* master.kernel.org:/home/rmk/linux-2.6-arm: (25 commits)
  ARM: 5728/1: Proper prefetch abort handling on ARMv6 and ARMv7
  ARM: 5727/1: Pass IFSR register to do_PrefetchAbort()
  ARM: 5740/1: fix valid_phys_addr_range() range check
  ARM: 5739/1: ARM: allow empty ATAG_CORE
  ARM: 5735/1: sa1111: CodingStyle cleanups
  ARM: 5738/1: Correct TCM documentation
  ARM: 5734/1: arm: fix compilation of entry-common.S for older CPUs
  ARM: 5733/1: fix bcmring compile error
  ARM: 5732/1: remove redundant include file
  ARM: 5731/2: Fix U300 generic GPIO, remove ifdefs from MMCI v3
  ARM: Ensure do_cache_op takes mmap_sem
  ARM: Fix __cpuexit section mismatch warnings
  ARM: Don't allow highmem on SMP platforms without h/w TLB ops broadcast
  ARM: includecheck fix: mach-davinci, board-dm365-evm.c
  ARM: Remove unused CONFIG SA1100_H3XXX
  ARM: Fix warning: unused variable 'highmem'
  ARM: Fix warning: #warning syscall migrate_pages not implemented
  ARM: Fix SA11x0 clocksource warning
  ARM: Fix SA1100 Neponset serial section mismatch
  ARM: Fix SA1100 Assabet/Neponset PCMCIA section mismatch warnings
  ...

Currently, on ARMv6 and ARMv7, if an application tries to execute
code (or garbage) on non-executable page it hangs. It caused by
incorrect prefetch abort handling. Now every prefetch abort
processes as a translation fault.

To fix this we have to analyze instruction fault status register
to figure out reason why we've got the abort and process it
accordingly.

To make IFSR different from DFSR we set bit 31 which is reserved in
both IFSR and DFSR.

This patch also tries to protect from future hangs on unexpected
exceptions. An application will be killed if unexpected exception
type was received.
Signed-off-by: NKirill A. Shutemov <kirill@shutemov.name>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Instruction fault status register, IFSR, was introduced on ARMv6 to
provide status information about the last insturction fault. It
needed for proper prefetch abort handling.

Now we have three prefetch abort model:

  * legacy - for CPUs before ARMv6. They doesn't provide neither
    IFSR nor IFAR. We simulate IFSR with section translation fault
    status for them to generalize code;
  * ARMv6 - provides IFSR, but not IFAR;
  * ARMv7 - provides both IFSR and IFAR.
Signed-off-by: NKirill A. Shutemov <kirill@shutemov.name>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Commit 1522ac3e
("Fix virtual to physical translation macro corner cases")
breaks the end of memory check in valid_phys_addr_range().
The modified expression results in the apparent /dev/mem size
being 2 bytes smaller than what it actually is.

This patch reworks the expression to correctly check the address,
while maintaining use of a valid address to __pa().
Signed-off-by: NGreg Ungerer <gerg@uclinux.org>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

From: David Brown <davidb@quicinc.com>

The ATAG_CORE is allowed to be empty.  Although this is handled
by parse_tag_core(), __vet_atags during startup rejects this tag
unless it contains data.  Allow the initial tag to be either the
full size, or empty.
Signed-off-by: NDavid Brown <davidb@quicinc.com>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

EXPORT_* macros should follow immediately after the closing function
brace line.
Signed-off-by: NH Hartley Sweeten <hsweeten@visionengravers.com>
Acked-by: NKristoffer Ericson <kristoffer.ericson@gmail.com>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Conflicts:
	MAINTAINERS

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (46 commits)
  cnic: Fix NETDEV_UP event processing.
  uvesafb/connector: Disallow unpliviged users to send netlink packets
  pohmelfs/connector: Disallow unpliviged users to configure pohmelfs
  dst/connector: Disallow unpliviged users to configure dst
  dm/connector: Only process connector packages from privileged processes
  connector: Removed the destruct_data callback since it is always kfree_skb()
  connector/dm: Fixed a compilation warning
  connector: Provide the sender's credentials to the callback
  connector: Keep the skb in cn_callback_data
  e1000e/igb/ixgbe: Don't report an error if devices don't support AER
  net: Fix wrong sizeof
  net: splice() from tcp to pipe should take into account O_NONBLOCK
  net: Use sk_mark for routing lookup in more places
  sky2: irqname based on pci address
  skge: use unique IRQ name
  IPv4 TCP fails to send window scale option when window scale is zero
  net/ipv4/tcp.c: fix min() type mismatch warning
  Kconfig: STRIP: Remove stale bits of STRIP help text
  NET: mkiss: Fix typo
  tg3: Remove prev_vlan_tag from struct tx_ring_info
  ...

This fixes the problem of not handling the NETDEV_UP event properly
during hot-plug or modprobe of bnx2 after cnic.  The handling was
skipped by mistakenly using "else if" to check for the event.

Also update version to 2.0.1.
Signed-off-by: NMichael Chan <mchan@broadcom.com>
Signed-off-by: NBenjamin Li <benli@broadcom.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NPhilipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NPhilipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NPhilipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NPhilipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NPhilipp Reisner <philipp.reisner@linbit.com>
Acked-by: NLars Ellenberg <lars.ellenberg@linbit.com>
Acked-by: NEvgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NPhilipp Reisner <philipp.reisner@linbit.com>
Acked-by: NLars Ellenberg <lars.ellenberg@linbit.com>
Acked-by: NEvgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NPhilipp Reisner <philipp.reisner@linbit.com>
Acked-by: NLars Ellenberg <lars.ellenberg@linbit.com>
Acked-by: NEvgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NPhilipp Reisner <philipp.reisner@linbit.com>
Acked-by: NLars Ellenberg <lars.ellenberg@linbit.com>
Acked-by: NEvgeniy Polyakov <zbr@ioremap.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

The only error returned by pci_{en,dis}able_pcie_error_reporting() is
-EIO which simply means that Advanced Error Reporting is not supported.
There is no need to report that, so remove the error check from e1000e,
igb and ixgbe.
Signed-off-by: NFrans Pop <elendil@planet.nl>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Which is why I have always preferred sizeof(struct foo) over
sizeof(var).
Signed-off-by: NJean Delvare <khali@linux-fr.org>
Acked-by: NRandy Dunlap <rdunlap@xenotime.net>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

tcp_splice_read() doesnt take into account socket's O_NONBLOCK flag

Before this patch :

splice(socket,0,pipe,0,128*1024,SPLICE_F_MOVE);
causes a random endless block (if pipe is full) and
splice(socket,0,pipe,0,128*1024,SPLICE_F_MOVE | SPLICE_F_NONBLOCK);
will return 0 immediately if the TCP buffer is empty.

User application has no way to instruct splice() that socket should be in blocking mode
but pipe in nonblock more.

Many projects cannot use splice(tcp -> pipe) because of this flaw.

http://git.samba.org/?p=samba.git;a=history;f=source3/lib/recvfile.c;h=ea0159642137390a0f7e57a123684e6e63e47581;hb=HEAD
http://lkml.indiana.edu/hypermail/linux/kernel/0807.2/0687.html

Linus introduced  SPLICE_F_NONBLOCK in commit 29e35094
(splice: add SPLICE_F_NONBLOCK flag )

  It doesn't make the splice itself necessarily nonblocking (because the
  actual file descriptors that are spliced from/to may block unless they
  have the O_NONBLOCK flag set), but it makes the splice pipe operations
  nonblocking.

Linus intention was clear : let SPLICE_F_NONBLOCK control the splice pipe mode only

This patch instruct tcp_splice_read() to use the underlying file O_NONBLOCK
flag, as other socket operations do.

Users will then call :

splice(socket,0,pipe,0,128*1024,SPLICE_F_MOVE | SPLICE_F_NONBLOCK );

to block on data coming from socket (if file is in blocking mode),
and not block on pipe output (to avoid deadlock)

First version of this patch was submitted by Octavian Purdila
Reported-by: NVolker Lendecke <vl@samba.org>
Reported-by: NJason Gunthorpe <jgunthorpe@obsidianresearch.com>
Signed-off-by: NEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: NOctavian Purdila <opurdila@ixiacom.com>
Acked-by: NLinus Torvalds <torvalds@linux-foundation.org>
Acked-by: NJens Axboe <jens.axboe@oracle.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>