Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using  the  bare numbers to set the 'bDescriptorType' field of the Hub
Descriptors while the values are #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare numbers to set the 'bHubCharacteristics' field of the Hub
Descriptor while the values are #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Fix  using the  bare number to set the 'bDescriptorType' field of the Hub
Descriptor while the value  is #define'd in <linux/usb/ch11.h>.

Signed-off-by: Sergei Shtylyov <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Commit 3e45737 ("usb: musb: Fix fifo reads for dm816x with musb_dsps")
fixed a USB error on dm816x, but introduced a new build error on i386
when COMPILE_TEST is set:

drivers/usb/musb/musb_dsps.c: In function ‘dsps_read_fifo32’:
drivers/usb/musb/musb_dsps.c:624:3: error: implicit declaration of function
‘readsl’ [-Werror=implicit-function-declaration]
readsl(fifo, dst, len >> 2);

Let's fix this by using ioread32_rep() instead of readsl() as that's
more portable.

Fixes: 3e45737 ("usb: musb: Fix fifo reads for dm816x with musb_dsps")
Reported-by: Fengguang Wu <[email protected]>
Cc: Bin Liu <[email protected]>
Cc: Brian Hutchinson <[email protected]>
Cc: George Cherian <[email protected]>
Cc: Sergei Shtylyov <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>
Signed-off-by: Felipe Balbi <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

This reverts commit 6ad6b5e.

It added a file that should not be in the kernel source tree.

Cc: Amitoj Kaur Chawla <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Quentin caught a corner case with the generation of instruction
padding in the ALTERNATIVE_2 macro: if len(orig_insn) <
len(alt1) < len(alt2), then not enough padding gets added and
that is not good(tm) as we could overwrite the beginning of the
next instruction.

Luckily, at the time of this writing, we don't have
ALTERNATIVE_2() invocations which have that problem and even if
we did, a simple fix would be to prepend the instructions with
enough prefixes so that that corner case doesn't happen.

However, best it would be if we fixed it properly. See below for
a simple, abstracted example of what we're doing.

So what we ended up doing is, we compute the

	max(len(alt1), len(alt2)) - len(orig_insn)

and feed that value to the .skip gas directive. The max() cannot
have conditionals due to gas limitations, thus the fancy integer
math.

With this patch, all ALTERNATIVE_2 sites get padded correctly;
generating obscure test cases pass too:

  #define alt_max_short(a, b)    ((a) ^ (((a) ^ (b)) & -(-((a) < (b)))))

  #define gen_skip(orig, alt1, alt2, marker)	\
  	.skip -((alt_max_short(alt1, alt2) - (orig)) > 0) * \
  		(alt_max_short(alt1, alt2) - (orig)),marker

  	.pushsection .text, "ax"
  .globl main
  main:
  	gen_skip(1, 2, 4, 0x09)
  	gen_skip(4, 1, 2, 0x10)
  	...
  	.popsection

Thanks to Quentin for catching it and double-checking the fix!

Reported-by: Quentin Casasnovas <[email protected]>
Signed-off-by: Borislav Petkov <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Brian Gerst <[email protected]>
Cc: Denys Vlasenko <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>

Return a negative error code on failure.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
identifier ret; expression e1,e2;
@@
(
if (\(ret < 0\|ret != 0\))
 { ... return ret; }
|
ret = 0
)
... when != ret = e1
    when != &ret
*if(...)
{
  ... when != ret = e2
      when forall
 return ret;
}
// </smpl>

Signed-off-by: Julia Lawall <[email protected]>
Signed-off-by: Sebastian Reichel <[email protected]>

On chips with newer PWM control, the PWM frequency divider is 256
instead of 128. Since the base PWM frequency remained the same, the actual
PWM frequency is half of what it used to be with the older PWM control
mechanism.

Reviewed-by: Jean Delvare <[email protected]>
Signed-off-by: Guenter Roeck <[email protected]>

ITE chips may have 'E', 'F', or both 'E' and 'F' suffixes.
Introduce suffic configuration to the it87_devices structure
to simplify adding new chips.

Reviewed-by: Jean Delvare <[email protected]>
Signed-off-by: Guenter Roeck <[email protected]>

On some chips, in7 is always an internal voltage sensor. Introduce
feature flag to reflect this condition to simplify adding support
for new chips.

Reviewed-by: Jean Delvare <[email protected]>
Signed-off-by: Guenter Roeck <[email protected]>

IT8790E is a super-IO chip with three fan tachometers. It is mostly
compatible to IT8728F, but only supports three fan tachometers
instead of five.

Reviewed-by: Jean Delvare <[email protected]>
Signed-off-by: Guenter Roeck <[email protected]>

IT8620E is mostly compatible to IT7828F. Add generic support for it.

IT8620E supports up to 6 fan tachometers and 6 pwm controls.
Support for the 6th tachometer and for the additional pwm controls
are addded in separate patches.

Reviewed-by: Jean Delvare <[email protected]>
Signed-off-by: Guenter Roeck <[email protected]>

IT8620E supports up to 6 fan tachometers.

Reviewed-by: Jean Delvare <[email protected]>
Signed-off-by: Guenter Roeck <[email protected]>

Sparse reports:

drivers/staging/lustre/lustre/obdclass/obd_mount.c:1284:6: warning:
 symbol 'lustre_kill_super' was not declared. Should it be static?

Fix this warning by making lustre_kill_super static.
It is not used outside this file.

Signed-off-by: Tal Shorer <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Return a negative error code on failure.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
identifier ret; expression e1,e2;
@@
(
if (\(ret < 0\|ret != 0\))
 { ... return ret; }
|
ret = 0
)
... when != ret = e1
    when != &ret
*if(...)
{
  ... when != ret = e2
      when forall
 return ret;
}
// </smpl>

Signed-off-by: Julia Lawall <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

Orthography and coding style corrections.

Signed-off-by: Amaury Bouchra Pilet <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>

The 'pax' argument is unnecesary.  Instead, store the RAX value
directly in regs.

This pattern goes all the way back to 2.1.106pre1, when restore_sigcontext()
was changed to return an error code instead of EAX directly:

  https://git.kernel.org/cgit/linux/kernel/git/history/history.git/diff/arch/i386/kernel/signal.c?id=9a8f8b7ca3f319bd668298d447bdf32730e51174

In 2007 sigaltstack syscall support was added, where the return
value of restore_sigcontext() was changed to carry the memory-copying
failure code.

But instead of putting 'ax' into regs->ax directly, it was carried
in via a pointer and then returned, where the generic syscall return
code copied it to regs->ax.

So there was never any deeper reason for this suboptimal pattern, it
was simply never noticed after being introduced.

Signed-off-by: Brian Gerst <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Denys Vlasenko <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>

On failure, sys_execve() does not clobber EXTRA_REGS, so we can
just return to userpsace without saving/restoring them.

On success, ELF_PLAT_INIT() in sys_execve() clears all these
registers.

On other executable formats:

  - binfmt_flat.c has similar FLAT_PLAT_INIT, but x86 (and everyone
    else except sh) doesn't define it.

  - binfmt_elf_fdpic.c has ELF_FDPIC_PLAT_INIT, but x86 (and most
    others) doesn't define it.

  - There are no such hooks in binfmt_aout.c et al. We inherit
    EXTRA_REGS from the prior executable.

This inconsistency was not intended.

This change removes SAVE/RESTORE_EXTRA_REGS in stub_execve,
removes register clearing in ELF_PLAT_INIT(),
and instead simply clears them on success in stub_execve.

Run-tested.

Signed-off-by: Denys Vlasenko <[email protected]>
Cc: Alexei Starovoitov <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Frederic Weisbecker <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: Steven Rostedt <[email protected]>
Cc: Will Drewry <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>

Take a look at the first instruction byte before optimizing the NOP -
there might be something else there already, like the ALTERNATIVE_2()
in rdtsc_barrier() which NOPs out on AMD even though we just
patched in an MFENCE.

This happens because the alternatives sees X86_FEATURE_MFENCE_RDTSC,
AMD CPUs set it, we patch in the MFENCE and right afterwards it sees
X86_FEATURE_LFENCE_RDTSC which AMD CPUs don't set and we blindly
optimize the NOP.

Checking whether at least the first byte is 0x90 prevents that.

Signed-off-by: Borislav Petkov <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Brian Gerst <[email protected]>
Cc: Denys Vlasenko <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>

The sysfs code usually belongs to the botom of the file since it deals
with high level objects. In the workqueue code it's misplaced and such
that we'll need to work around functions references to allow the sysfs
code to call APIs like apply_workqueue_attrs().

Lets move that block further in the file, almost the botom.

And declare workqueue_sysfs_unregister() just before destroy_workqueue()
which reference it.

tj: Moved workqueue_sysfs_unregister() forward declaration where other
    forward declarations are.

Suggested-by: Tejun Heo <[email protected]>
Cc: Christoph Lameter <[email protected]>
Cc: Kevin Hilman <[email protected]>
Cc: Lai Jiangshan <[email protected]>
Cc: Mike Galbraith <[email protected]>
Cc: Paul E. McKenney <[email protected]>
Cc: Tejun Heo <[email protected]>
Cc: Viresh Kumar <[email protected]>
Signed-off-by: Frederic Weisbecker <[email protected]>
Signed-off-by: Lai Jiangshan <[email protected]>
Signed-off-by: Tejun Heo <[email protected]>

Currently, max17042 battery driver choose register map by MAX17042_DevName
register. But it is return IC specific firmware version. So other maxim chip
hard to use this drvier. This patch choose chip type from driver_data.

Signed-off-by: Beomho Seo <[email protected]>
Reviewed-by: Krzysztof Kozlowski <[email protected]>
Signed-off-by: Sebastian Reichel <[email protected]>

This patch add missed blank line after decalations.

Signed-off-by: Beomho Seo <[email protected]>
Reviewed-by: Krzysztof Kozlowski <[email protected]>
Signed-off-by: Sebastian Reichel <[email protected]>

We need "ret" to be unsigned for the error handling to work.  The
signedness of "i" and "n" don't matter but qspi_set_send_trigger()
returns an int so I've changed them to int as well.

Fixes: 4b6fe3e ('spi: Using Trigger number to transmit/receive data')
Signed-off-by: Dan Carpenter <[email protected]>
Signed-off-by: Mark Brown <[email protected]>

Add a generic SYSCON register mapped poweroff mechanism.

Signed-off-by: Moritz Fischer <[email protected]>
Signed-off-by: Sebastian Reichel <[email protected]>

Add documentation for generic SYSCON poweroff driver.

Signed-off-by: Moritz Fischer <[email protected]>
Signed-off-by: Sebastian Reichel <[email protected]>

Previous algorithm had an outer loop with the values {2,3,5,7} and an
inner loop with {2,4,6,8,16,32,...,32768}, and would pick the first
value over the required scaling value (where the total scale was the two
numbers multiplied).

Since the inner loop went up to 32768 it would always pick a value of 2
for PBR and a much higher than necessary value for BR.  The desired
scale factor was being divided by two I believe to compensate for the
much higher scale factors (the divide by two not specified in the
reference manual).

Updated to check all values and find the smallest scale factor possible
without going over the desired clock rate.

Signed-off-by: Aaron Brice <[email protected]>
Signed-off-by: Mark Brown <[email protected]>

Adding fsl,spi-cs-sck-delay and fsl,spi-sck-cs-delay properties to
support delays before and after starting the clock in a transfer.

Signed-off-by: Aaron Brice <[email protected]>
Signed-off-by: Mark Brown <[email protected]>

Add delay between chip select and clock signals, before clock starts and
after clock stops.

Signed-off-by: Aaron Brice <[email protected]>
Signed-off-by: Mark Brown <[email protected]>

Because of added iio error handling private data allocation was converted
to managed to simplify code.

Signed-off-by: Marek Belisko <[email protected]>
Reviewed-By: Sebastian Reichel <[email protected]>
Signed-off-by: Sebastian Reichel <[email protected]>

Without MODULE_ALIAS twl4030_madc_battery won't get loaded automatically.

Signed-off-by: Marek Belisko <[email protected]>
Signed-off-by: Sebastian Reichel <[email protected]>

We want those fixes (iio primarily) into the -next branch to help with
merge and testing issues.

Signed-off-by: Greg Kroah-Hartman <[email protected]>

We want the fixes in here, and to help resolve merge issues.

Signed-off-by: Greg Kroah-Hartman <[email protected]>

…nel/git/broonie/spi into spi-fsl-dspi

Conflicts:
	drivers/spi/spi-fsl-dspi.c

In preparation for switching to using the SPI core's CS GPIO handling,
move setup of the PORT_STATE register, which must be configured before
CS is asserted, to a prepare_message() callback.

Signed-off-by: Ezequiel Garcia <[email protected]>
Signed-off-by: Andrew Bresticker <[email protected]>
Signed-off-by: Mark Brown <[email protected]>

Although the SPFI BITCLK divider supports a value of up to 255, only
values up to 128 are usable.  This results in a maximum possible bit
clock rate of 1/4th the input clock rate.

Signed-off-by: Andrew Bresticker <[email protected]>
Signed-off-by: Mark Brown <[email protected]>

…ernel_node_hotplug()

I got below kernel panic during kdump test on Thinkpad T420
laptop:

[    0.000000] No NUMA configuration found
[    0.000000] Faking a node at [mem 0x0000000000000000-0x0000000037ba4fff]
[    0.000000] Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffffff81d21910
 ...
[    0.000000] Call Trace:
[    0.000000]  [<ffffffff817c2a26>] dump_stack+0x45/0x57
[    0.000000]  [<ffffffff817bc8d2>] panic+0xd0/0x204
[    0.000000]  [<ffffffff81d21910>] ? numa_clear_kernel_node_hotplug+0xe6/0xf2
[    0.000000]  [<ffffffff8107741b>] __stack_chk_fail+0x1b/0x20
[    0.000000]  [<ffffffff81d21910>] numa_clear_kernel_node_hotplug+0xe6/0xf2
[    0.000000]  [<ffffffff81d21e5d>] numa_init+0x1a5/0x520
[    0.000000]  [<ffffffff81d222b1>] x86_numa_init+0x19/0x3d
[    0.000000]  [<ffffffff81d22460>] initmem_init+0x9/0xb
[    0.000000]  [<ffffffff81d0d00c>] setup_arch+0x94f/0xc82
[    0.000000]  [<ffffffff81d05120>] ? early_idt_handlers+0x120/0x120
[    0.000000]  [<ffffffff817bd0bb>] ? printk+0x55/0x6b
[    0.000000]  [<ffffffff81d05120>] ? early_idt_handlers+0x120/0x120
[    0.000000]  [<ffffffff81d05d9b>] start_kernel+0xe8/0x4d6
[    0.000000]  [<ffffffff81d05120>] ? early_idt_handlers+0x120/0x120
[    0.000000]  [<ffffffff81d05120>] ? early_idt_handlers+0x120/0x120
[    0.000000]  [<ffffffff81d055ee>] x86_64_start_reservations+0x2a/0x2c
[    0.000000]  [<ffffffff81d05751>] x86_64_start_kernel+0x161/0x184
[    0.000000] ---[ end Kernel panic - not syncing: stack-protector: Kernel sta

This is caused by writing over the end of numa mask bitmap
in numa_clear_kernel_node().

numa_clear_kernel_node() tries to set the node id in a mask bitmap,
by iterating all reserved regions and assuming that every region
has a valid nid.

This assumption is not true because there's an exception for some
graphic memory quirks. See trim_snb_memory() in arch/x86/kernel/setup.c

It is easily to reproduce the bug in the kdump kernel because kdump
kernel use pre-reserved memory instead of the whole memory, but
kexec pass other reserved memory ranges to 2nd kernel as well.
like below in my test:

kdump kernel ram 0x2d000000 - 0x37bfffff
One of the reserved regions: 0x40000000 - 0x40100000 which
includes 0x40004000, a page excluded in trim_snb_memory(). For
this memblock reserved region the nid is not set, it is still
default value MAX_NUMNODES. later node_set will set bit
MAX_NUMNODES thus stack corruption happen.

This also happens when booting with mem= kernel commandline
during my test.

Fixing it by adding a check, do not call node_set in case nid is
MAX_NUMNODES.

Signed-off-by: Dave Young <[email protected]>
Reviewed-by: Yasuaki Ishimatsu <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: [email protected]
Cc: [email protected]
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>

…ux/kernel/git/kvmarm/kvmarm into 'kvm-next'

Fixes for KVM/ARM for 4.0-rc5.

Fixes page refcounting issues in our Stage-2 page table management code,
fixes a missing unlock in a gicv3 error path, and fixes a race that can
cause lost interrupts if signals are pending just prior to entering the
guest.

…nel/git/kvmarm/kvmarm into 'kvm-next'

KVM/ARM changes for v4.1:

- fixes for live migration
- irqfd support
- kvm-io-bus & vgic rework to enable ioeventfd
- page ageing for stage-2 translation
- various cleanups

…nux/kernel/git/kvms390/linux into HEAD

Features and fixes for 4.1 (kvm/next)

1. Assorted changes
1.1 allow more feature bits for the guest
1.2 Store breaking event address on program interrupts

2. Interrupt handling rework
2.1 Fix copy_to_user while holding a spinlock (cc stable)
2.2 Rework floating interrupts to follow the priorities
2.3 Allow to inject all local interrupts via new ioctl
2.4 allow to get/set the full local irq state, e.g. for migration
    and introspection

Every USB Host controller should use this new
macro to define for how long resume signalling
should be driven on the bus.

Currently, almost every single USB controller
is using a 20ms timeout for resume signalling.

That's problematic for two reasons:

a) sometimes that 20ms timer expires a little
before 20ms, which makes us fail certification

b) some (many) devices actually need more than
20ms resume signalling.

Sure, in case of (b) we can state that the device
is against the USB spec, but the fact is that
we have no control over which device the certification
lab will use. We also have no control over which host
they will use. Most likely they'll be using a Windows
PC which, again, we have no control over how that
USB stack is written and how long resume signalling
they are using.

At the end of the day, we must make sure Linux passes
electrical compliance when working as Host or as Device
and currently we don't pass compliance as host because
we're driving resume signallig for exactly 20ms and
that confuses certification test setup resulting in
Certification failure.

Cc: <[email protected]> # v3.10+
Acked-by: Greg Kroah-Hartman <[email protected]>
Acked-by: Peter Chen <[email protected]>
Signed-off-by: Felipe Balbi <[email protected]>

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Cc: <[email protected]> # v3.10+
Acked-by: Mathias Nyman <[email protected]>
Signed-off-by: Felipe Balbi <[email protected]>

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Cc: <[email protected]> # v3.10+
Signed-off-by: Felipe Balbi <[email protected]>

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Cc: <[email protected]> # v3.10+
Signed-off-by: Felipe Balbi <[email protected]>

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Based on original work by Bin Liu <Bin Liu <[email protected]>>

Cc: Bin Liu <[email protected]>
Cc: <[email protected]> # v3.10+
Signed-off-by: Felipe Balbi <[email protected]>

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Cc: <[email protected]> # v3.10+
Signed-off-by: Felipe Balbi <[email protected]>

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Cc: <[email protected]> # v3.10+
Signed-off-by: Felipe Balbi <[email protected]>

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Cc: <[email protected]> # v3.10+
Signed-off-by: Felipe Balbi <[email protected]>

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Cc: <[email protected]> # v3.10+
Signed-off-by: Felipe Balbi <[email protected]>

While this driver was already using a 50ms resume
timeout, let's make sure everybody uses the same
macro so it's easy to fix later should anything
go wrong.

It also gives a more "stable" expectation to Linux
users.

Cc: <[email protected]> # v3.10+
Signed-off-by: Felipe Balbi <[email protected]>

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Cc: <[email protected]> # v3.10+
Signed-off-by: Felipe Balbi <[email protected]>

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Cc: <[email protected]> # v3.10+
Signed-off-by: Felipe Balbi <[email protected]>

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Cc: <[email protected]> # v3.10+
Signed-off-by: Felipe Balbi <[email protected]>

Make sure we're using the new macro, so our
resume signaling will always pass certification.

Cc: <[email protected]> # v3.10+
Signed-off-by: Felipe Balbi <[email protected]>

If a driver doesn't implement the master->handle_err() callback and an
SPI transfer fails, the kernel will crash with a NULL pointer
dereference:

    Unable to handle kernel NULL pointer dereference at virtual address 00000000
    pgd = c0003000
    [00000000] *pgd=80000040004003, *pmd=00000000
    Internal error: Oops: 80000206 [#1] SMP ARM
    Modules linked in:
    CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.0.0-rc7-koelsch-05861-g1fc9fdd4add4f783 #1046
    Hardware name: Generic R8A7791 (Flattened Device Tree)
    task: eec359c0 ti: eec54000 task.ti: eec54000
    PC is at 0x0
    LR is at spi_transfer_one_message+0x1cc/0x1f0

Make the master->handle_err() callback optional to avoid the crash.

Also fix a spelling mistake in the callback documentation while we're at
it.

Fixes: b716c4f ("spi: introduce master->handle_err() callback")
Signed-off-by: Geert Uytterhoeven <[email protected]>
Signed-off-by: Mark Brown <[email protected]>

Simon reported the md io stats accounting issue:
"
I'm seeing "iostat -x -k 1" print this after a RAID1 rebuild on 4.0-rc5.
It's not abnormal other than it's 3-disk, with one being SSD (sdc) and
the other two being write-mostly:

Device:         rrqm/s   wrqm/s     r/s     w/s    rkB/s    wkB/s avgrq-sz avgqu-sz   await r_await w_await  svctm  %util
sda               0.00     0.00    0.00    0.00     0.00     0.00     0.00     0.00    0.00    0.00    0.00   0.00   0.00
sdb               0.00     0.00    0.00    0.00     0.00     0.00     0.00     0.00    0.00    0.00    0.00   0.00   0.00
sdc               0.00     0.00    0.00    0.00     0.00     0.00     0.00     0.00    0.00    0.00    0.00   0.00   0.00
md0               0.00     0.00    0.00    0.00     0.00     0.00     0.00   345.00    0.00    0.00    0.00   0.00 100.00
md2               0.00     0.00    0.00    0.00     0.00     0.00     0.00 58779.00    0.00    0.00    0.00   0.00 100.00
md1               0.00     0.00    0.00    0.00     0.00     0.00     0.00    12.00    0.00    0.00    0.00   0.00 100.00
"
The cause is commit "18c0b223cf9901727ef3b02da6711ac930b4e5d4" uses the
generic_start_io_acct to account the disk stats rather than the open code,
but it also introduced the increase to .in_flight[rw] which is needless to
md. So we re-use the open code here to fix it.

Reported-by: Simon Kirby <[email protected]>
Cc: <[email protected]> 3.19
Signed-off-by: Gu Zheng <[email protected]>
Signed-off-by: NeilBrown <[email protected]>

By pass pullup DP in OTG fsm mode when do gadget connect, to let it handled
by OTG state machine.

This patch can fix the problem you found with my HNP polling patchset after
below 3 patches introduced:
467a78c usb: chipidea: udc: apply new usb_udc_vbus_handler interface
628ef0d usb: udc: add usb_udc_vbus_handler
dfea9c9 usb: udc: store usb_udc pointer in struct usb_gadget

Problem:
- Connect USB cable and MicroAB cable between two boards
- Boot up two boards
- load g_mass_storage at B-device side, the enumeration will success,
and A will see a usb mass-storage device
- load g_mass_storage at A-device side, the problem has occurred, the
connection will be lost at the beginning, then connect again.

This patch is based on
commit eff933c1d3a2e046492b3dfc86db813856553a29
(chipidea: pci: make it depends on NOP_USB_XCEIV)
on branch peter-usb-dev of
git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/usb.git

Signed-off-by: Li Jun <[email protected]>
Signed-off-by: Peter Chen <[email protected]>

This is my sigreturn test, added mostly unchanged from its old
home. It exercises the sigreturn(2) syscall, specifically
focusing on its interactions with various IRET corner cases.

It tests for correct behavior in several areas that were
historically dangerously buggy. For example, it exercises espfix
on kernels of both bitnesses under various conditions, and it
contains testcases for several now-fixed bugs in IRET error
handling.

If you run it on older kernels without the fixes, your system will
crash. It probably won't eat your data in the process.

There is no released kernel on which the sigreturn_64 test will
pass, but it passes on tip:x86/asm.

I plan to switch to lib.mk for Linux 4.2.

I'm not using the ksft_ helpers at all yet.  I can do that later.

Signed-off-by: Andy Lutomirski <[email protected]>
Acked-by: Shuah Khan <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Brian Gerst <[email protected]>
Cc: Denys Vlasenko <[email protected]>
Cc: Denys Vlasenko <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Michael Ellerman <[email protected]>
Cc: Shuah Khan <[email protected]>
Cc: Steven Rostedt <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Link: http://lkml.kernel.org/r/89d10b76b92c7202d8123654dc8d36701c017b3d.1428386971.git.luto@kernel.org
[ Fixed empty format string GCC build warning in trivial_32bit_program.c ]
Signed-off-by: Ingo Molnar <[email protected]>

Since the required clock to access registers is gated off in low power mode,
add ci->in_lpm check before try to dump registers value.

Signed-off-by: Li Jun <[email protected]>
Signed-off-by: Peter Chen <[email protected]>

Conflicts:
	arch/x86/kernel/entry_64.S

Signed-off-by: Ingo Molnar <[email protected]>

This change does two things:

Copy-pastes "retint_swapgs:" code into syscall handling code,
the copy is under "syscall_return:" label. The code is unchanged
apart from some label renames.

Removes "opportunistic sysret" code from "retint_swapgs:" code
block, since now it won't be reached by syscall return. This in
fact removes most of the code in question.

   text	   data	    bss	    dec	    hex	filename
  12530	      0	      0	  12530	   30f2	entry_64.o.before
  12562	      0	      0	  12562	   3112	entry_64.o

Run-tested.

Acked-and-Tested-by: Borislav Petkov <[email protected]>
Signed-off-by: Denys Vlasenko <[email protected]>
Cc: Alexei Starovoitov <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Frederic Weisbecker <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: Steven Rostedt <[email protected]>
Cc: Will Drewry <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>

Interrupt entry points are handled with the following code,
each 32-byte code block contains seven entry points:

		...
		[push][jump 22] // 4 bytes
		[push][jump 18] // 4 bytes
		[push][jump 14] // 4 bytes
		[push][jump 10] // 4 bytes
		[push][jump  6] // 4 bytes
		[push][jump  2] // 4 bytes
		[push][jump common_interrupt][padding] // 8 bytes

		[push][jump]
		[push][jump]
		[push][jump]
		[push][jump]
		[push][jump]
		[push][jump]
		[push][jump common_interrupt][padding]

		[padding_2]
	common_interrupt:

And there is a table which holds pointers to every entry point,
IOW: to every push.

In cold cache, two jumps are still costlier than one, even
though we get the benefit of them residing in the same
cacheline.

This change replaces short jumps with near ones to
'common_interrupt', and pads every push+jump pair to 8 bytes. This
way, each interrupt takes only one jump.

This change replaces ".p2align CONFIG_X86_L1_CACHE_SHIFT" before
dispatch table with ".align 8" - we do not need anything
stronger than that.

The table of entry addresses (the interrupt[] array) is no
longer necessary, the address of entries can be easily
calculated as (irq_entries_start + i*8).

   text	   data	    bss	    dec	    hex	filename
  12546	      0	      0	  12546	   3102	entry_64.o.before
  11626	      0	      0	  11626	   2d6a	entry_64.o

The size decrease is because 1656 bytes of .init.rodata are
gone. That's initdata, though. The resident size does go up a
bit.

Run-tested (32 and 64 bits).

Acked-and-Tested-by: Borislav Petkov <[email protected]>
Signed-off-by: Denys Vlasenko <[email protected]>
Cc: Alexei Starovoitov <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Frederic Weisbecker <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: Steven Rostedt <[email protected]>
Cc: Will Drewry <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>

Signed-off-by: Denys Vlasenko <[email protected]>
Cc: Alexei Starovoitov <[email protected]>
Cc: Andy Lutomirski <[email protected]>
Cc: Borislav Petkov <[email protected]>
Cc: Brian Gerst <[email protected]>
Cc: Frederic Weisbecker <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: Kees Cook <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: Steven Rostedt <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Will Drewry <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Ingo Molnar <[email protected]>

Guest can't be booted w/ ept=0, there is a message dumped as below:

If you're running a guest on an Intel machine without unrestricted mode
support, the failure can be most likely due to the guest entering an invalid
state for Intel VT. For example, the guest maybe running in big real mode
which is not supported on less recent Intel processors.

EAX=00000011 EBX=f000d2f6 ECX=00006cac EDX=000f8956
ESI=bffbdf62 EDI=00000000 EBP=00006c68 ESP=00006c68
EIP=0000d187 EFL=00000004 [-----P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =e000 000e0000 ffffffff 00809300 DPL=0 DS16 [-WA]
CS =f000 000f0000 ffffffff 00809b00 DPL=0 CS16 [-RA]
SS =0000 00000000 ffffffff 00809300 DPL=0 DS16 [-WA]
DS =0000 00000000 ffffffff 00809300 DPL=0 DS16 [-WA]
FS =0000 00000000 ffffffff 00809300 DPL=0 DS16 [-WA]
GS =0000 00000000 ffffffff 00809300 DPL=0 DS16 [-WA]
LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT
TR =0000 00000000 0000ffff 00008b00 DPL=0 TSS32-busy
GDT=     000f6a80 00000037
IDT=     000f6abe 00000000
CR0=00000011 CR2=00000000 CR3=00000000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000000
Code=01 1e b8 6a 2e 0f 01 16 74 6a 0f 20 c0 66 83 c8 01 0f 22 c0 <66> ea 8f d1 0f 00 08 00 b8 10 00 00 00 8e d8 8e c0 8e d0 8e e0 8e e8 89 c8 ff e2 89 c1 b8X

X86 eflags bit 1 is fixed set, which means that 1 << 1 is set instead of 1,
this patch fix it.

Signed-off-by: Wanpeng Li <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

Rename the old __vcpu_run to vcpu_run, and extract part of it to a new
function vcpu_block.

The next patch will add a new condition in vcpu_block, avoid extra
indentation.

Reviewed-by: David Matlack <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

The newly-added tracepoint shows the following results on
the tscdeadline_latency test:

        qemu-kvm-8387  [002]  6425.558974: kvm_vcpu_wakeup:      poll time 10407 ns
        qemu-kvm-8387  [002]  6425.558984: kvm_vcpu_wakeup:      poll time 0 ns
        qemu-kvm-8387  [002]  6425.561242: kvm_vcpu_wakeup:      poll time 10477 ns
        qemu-kvm-8387  [002]  6425.561251: kvm_vcpu_wakeup:      poll time 0 ns

and so on.  This is because we need to go through kvm_vcpu_block again
after the timer IRQ is injected.  Avoid it by polling once before
entering kvm_vcpu_block.

On my machine (Xeon E5 Sandy Bridge) this removes about 500 cycles (7%)
from the latency of the TSC deadline timer.

Signed-off-by: Paolo Bonzini <[email protected]>

The corresponding write functions just use __copy_to_user.  Do the
same on the read side.

This reverts what's left of commit 86ab8cf (KVM: introduce
gfn_to_hva_read/kvm_read_hva/kvm_read_hva_atomic, 2012-08-21)

Cc: Xiao Guangrong <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>
Message-Id: <[email protected]>

If we were migrated right after __getcpu, but before reading the
migration_count, we wouldn't notice that we read TSC of a different
VCPU, nor that KVM's bug made pvti invalid, as only migration_count
on source VCPU is increased.

Change vdso instead of updating migration_count on destination.

Cc: [email protected]
Signed-off-by: Radim Krčmář <[email protected]>
Fixes: 0a4e6be ("x86: kvm: Revert "remove sched notifier for cross-cpu migrations"")
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

Exposing the on-stack error code with internal error is cheap and
potentially useful.

Signed-off-by: Radim Krčmář <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

cpuid_maxphyaddr(), which performs lot of memory accesses is called
extensively across KVM, especially in nVMX code.

This patch adds a cached value of maxphyaddr to vcpu.arch to reduce the
pressure onto CPU cache and simplify the code of cpuid_maxphyaddr()
callers. The cached value is initialized in kvm_arch_vcpu_init() and
reloaded every time CPUID is updated by usermode. It is obvious that
these reloads occur infrequently.

Signed-off-by: Eugene Korenevsky <[email protected]>
Message-Id: <20150329205612.GA1223@gnote>
Signed-off-by: Paolo Bonzini <[email protected]>

On each VM-entry CPU should check the following VMCS fields for zero bits
beyond physical address width:
-  APIC-access address
-  virtual-APIC address
-  posted-interrupt descriptor address
This patch adds these checks required by Intel SDM.

Signed-off-by: Eugene Korenevsky <[email protected]>
Message-Id: <20150329205627.GA1244@gnote>
Signed-off-by: Paolo Bonzini <[email protected]>

After speed-up of cpuid_maxphyaddr() it can be called frequently:
instead of heavyweight enumeration of CPUID entries it returns a cached
pre-computed value. It is also inlined now. So caching its result became
unnecessary and can be removed.

Signed-off-by: Eugene Korenevsky <[email protected]>
Message-Id: <20150329205644.GA1258@gnote>
Signed-off-by: Paolo Bonzini <[email protected]>

Drop unused static procedure which doesn't have callers within its
translation unit. It had been already removed independently in QEMU[1]
from the OpenPIC implementation borrowed from the kernel.

[1] https://lists.gnu.org/archive/html/qemu-devel/2014-06/msg01812.html

Signed-off-by: Arseny Solokha <[email protected]>
Cc: Alexander Graf <[email protected]>
Cc: Gleb Natapov <[email protected]>
Cc: Paolo Bonzini <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

In mixed modes, we musn't deliver xAPIC IPIs like x2APIC and vice versa.
Instead of preserving the information in apic_send_ipi(), we regain it
by converting all destinations into correct MDA in the slow path.
This allows easier reasoning about subsequent matching.

Our kvm_apic_broadcast() had an interesting design decision: it didn't
consider IOxAPIC 0xff as broadcast in x2APIC mode ...
everything worked because IOxAPIC can't set that in physical mode and
logical mode considered it as a message for first 8 VCPUs.
This patch interprets IOxAPIC 0xff as x2APIC broadcast.

Signed-off-by: Radim Krčmář <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

Broadcast allowed only one global APIC mode, but mixed modes are
theoretically possible.  x2APIC IPI doesn't mean 0xff as broadcast,
the rest does.

x2APIC broadcasts are accepted by xAPIC.  If we take SDM to be logical,
even addreses beginning with 0xff should be accepted, but real hardware
disagrees.  This patch aims for simple code by considering most of real
behavior as undefined.

Signed-off-by: Radim Krčmář <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

We want to support mixed modes and the easiest solution is to avoid
optimizing those weird and unlikely scenarios.

Signed-off-by: Radim Krčmář <[email protected]>
Message-Id: <[email protected]>
[Add comment above KVM_APIC_MODE_* defines. - Paolo]
Signed-off-by: Paolo Bonzini <[email protected]>

recalculate_apic_map() uses two passes over all VCPUs.  This is a relic
from time when we selected a global mode in the first pass and set up
the optimized table in the second pass (to have a consistent mode).

Recent changes made mixed mode unoptimized and we can do it in one pass.
Format of logical MDA is a function of the mode, so we encode it in
apic_logical_id() and drop obsoleted variables from the struct.

Signed-off-by: Radim Krčmář <[email protected]>
Message-Id: <[email protected]>
[Add lid_bits temporary in apic_logical_id. - Paolo]
Signed-off-by: Paolo Bonzini <[email protected]>

After reset, the CPU can change the BSP, which will be used upon INIT.  Reset
should return the BSP which QEMU asked for, and therefore handled accordingly.

To quote: "If the MP protocol has completed and a BSP is chosen, subsequent
INITs (either to a specific processor or system wide) do not cause the MP
protocol to be repeated."
[Intel SDM 8.4.2: MP Initialization Protocol Requirements and Restrictions]

Signed-off-by: Nadav Amit <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

DR0-DR3 are not cleared as they should during reset and when they are set from
userspace.  It appears to be caused by c77fb5f ("KVM: x86: Allow the guest
to run with dirty debug registers").

Force their reload on these situations.

Signed-off-by: Nadav Amit <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

CR2 is not cleared as it should after reset.  See Intel SDM table named "IA-32
Processor States Following Power-up, Reset, or INIT".

Signed-off-by: Nadav Amit <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>

Dirty logging tracks sptes in 4k granularity, meaning that large sptes
have to be split.  If live migration is successful, the guest in the
source machine will be destroyed and large sptes will be created in the
destination. However, the guest continues to run in the source machine
(for example if live migration fails), small sptes will remain around
and cause bad performance.

This patch introduce lazy collapsing of small sptes into large sptes.
The rmap will be scanned in ioctl context when dirty logging is stopped,
dropping those sptes which can be collapsed into a single large-page spte.
Later page faults will create the large-page sptes.

Reviewed-by: Xiao Guangrong <[email protected]>
Signed-off-by: Wanpeng Li <[email protected]>
Message-Id: <[email protected]>
Signed-off-by: Paolo Bonzini <[email protected]>