Merge tag 'renesas-dt-cleanups-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into next/cleanup

Pull "Renesas ARM Based SoC DT Cleanups for v3.19" from Simon Horman:

* Add chosen/stdout-path to DTS files for shmobile boards
* Remove r7s72100-genmai.dtb for ARCH_SHMOBILE_LEGACY
  - The corresponding board file has already been removed
* Sort dts nodes by address
* Sort SHMOBILE dtbs alphabetically in Makefile

* tag 'renesas-dt-cleanups-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  ARM: shmobile: kzm9d dts: Add chosen/stdout-path
  ARM: shmobile: kzm9g-reference dts: Add chosen/stdout-path
  ARM: shmobile: alt dts: Add chosen/stdout-path
  ARM: shmobile: koelsch dts: Add chosen/stdout-path
  ARM: shmobile: henninger dts: Add chosen/stdout-path
  ARM: shmobile: lager dts: Add chosen/stdout-path
  ARM: shmobile: marzen dts: Add chosen/stdout-path
  ARM: shmobile: bockw-reference dts: Add chosen/stdout-path
  ARM: shmobile: armadillo800eva dts: Add chosen/stdout-path
  ARM: shmobile: ape6evm-reference dts: Add chosen/stdout-path
  ARM: shmobile: genmai dts: Add chosen/stdout-path
  ARM: shmobile: emev2 dtsi: Add uart* labels for easier referencing
  ARM: shmobile: emev2 dtsi: Use generic names for device nodes
  ARM: shmobile: r7s72100: Remove r7s72100-genmai.dtb for ARCH_SHMOBILE_LEGACY
  ARM: shmobile: r8a73a4: sort dtsi file by address
  ARM: shmobile: kzm9d: sort dts file by address
  ARM: shmobile: r7s72100: sort dtsi file by address
  ARM: shmobile: r8a73a4: Remove spurious dma-multiplexer base addresses
  ARM: dts: Sort SHMOBILE dtbs alphabetically
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Commits bcf8c7e7 and
4bf7753b introduced compilation errors
("error: 'NR_IRQS_LEGACY' undeclared (first use in this function)") because
they remove the asm/irq.h inclusion while the init_time function needs it
for the NR_IRQS_LEGACY definition.

In the other hand, the point of these commits is to remove board file
support, and init_time is only needed when booting non-DT boards, we can
thus safely remove init_time functions.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge tag 'renesas-dt-du-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into next/cleanup

Pull "Renesas ARM Based SoC DT DU Updates for v3.19" from Simon Horman:

* Enable DU using DT on marzen/r8a7779, lager/r8a7790 and koelsch/r8a7791

* tag 'renesas-dt-du-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  ARM: shmobile: koelsch: Enable DU device in DT
  ARM: shmobile: koelsch-reference: Remove DU platform device
  ARM: shmobile: lager: Enable DU device in DT
  ARM: shmobile: lager-reference: Remove DU platform device
  ARM: shmobile: marzen: Enable DU device in DT
  ARM: shmobile: dts: Add common file for AA104XD12 panel
  ARM: shmobile: r8a7791: Add DU node to device tree
  ARM: shmobile: r8a7790: Add DU node to device tree
  ARM: shmobile: r8a7779: Add DU node to device tree
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge tag 'renesas-boards-cleanups2-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into next/cleanup

Pull "Second Round of Renesas ARM Based SoC Boards Cleanups for v3.19" form Simon Horman:

* marzen-reference: Don't include legacy clock.h

* tag 'renesas-boards-cleanups2-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  ARM: shmobile: marzen-reference: Don't include legacy clock.h
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Fixes the following missing includes:

arch/arm/mach-at91/at91sam9g45.c: In function 'at91sam9g45_init_time':
arch/arm/mach-at91/at91sam9g45.c:39:23: error: 'NR_IRQS_LEGACY' undeclared (first use in this function)
  at91sam926x_pit_init(NR_IRQS_LEGACY + AT91_ID_SYS);
                       ^
arch/arm/mach-at91/at91sam9g45.c:39:23: note: each undeclared identifier is reported only once for each function it appears in
make[3]: *** [arch/arm/mach-at91/at91sam9g45.o] Error 1
arch/arm/mach-at91/at91sam9rl.c: In function 'at91sam9rl_init_time':
arch/arm/mach-at91/at91sam9rl.c:51:23: error: 'NR_IRQS_LEGACY' undeclared (first use in this function)
  at91sam926x_pit_init(NR_IRQS_LEGACY + AT91_ID_SYS);

Cc: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'at91-cleanup' of git://git.kernel.org/pub/scm/linux/kernel/git/nferre/linux-at91 into next/cleanup

Merge "at91: cleanup for 3.19 #1" from Nicolas Ferre:

"The pull-request that was sent late for 3.18. It was removing the old
!MMU at91x40 and 2 board files plus the whole code in at91sam9g45 &
at91sam9rl files for implementing this deprecated method. For these
particular ones, the EK were the only one to use this code. We can use
these boards with DT right now."

First batch of cleanup/SoC for 3.19:
- removal of old at91x40 !MMU ARM7TDMI support which was kind of rusty
- removal of board-sam9m10g45ek.c and board-sam9rlek.c from mach-at91
  and the code related to these board C files + defconfigs. Use DT for them
  now!

* tag 'at91-cleanup' of git://git.kernel.org/pub/scm/linux/kernel/git/nferre/linux-at91:
  ARM: at91: remove at91sam9rl legacy board support
  ARM: at91: remove at91sam9g45/9m10 legacy board support
  ARM: at91: remove no-MMU at91x40 support
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'renesas-cleanup-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into next/cleanup

Merge "Renesas ARM Based SoC Cleanup for v3.19" from Simon Horman:

* Remove FSF address from copyright headers

* tag 'renesas-cleanup-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  ARM: shmobile: Remove FSF address from copyright headers
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'renesas-soc-cleanups-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into next/cleanup

Merge "Renesas ARM Based SoC Soc Cleanups for v3.19" from Simon Horman:

* Remove sh73a0_init_delay and r8a7778_init_delay wrappers

* tag 'renesas-soc-cleanups-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  ARM: shmobile: sh73a0: Remove wrapper sh73a0_init_delay()
  ARM: shmobile: r8a7778: Remove wrapper r8a7778_init_delay()
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'renesas-boards-cleanups-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into next/cleanup

Merge "Renesas ARM Based SoC Boards Cleanups for v3.19" from Simon Horman:

* Sort armadillo800eva includes

* tag 'renesas-boards-cleanups-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  ARM: shmobile: armadillo800eva: Sort includes
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'renesas-kconfig-cleanups-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas into next/cleanup

Renesas ARM Based SoC Kconfig Cleanups for v3.19

* Remove reference to ARCH_HAS_OPP, it has been removed

* tag 'renesas-kconfig-cleanups-for-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  ARM: shmobile: Remove ARCH_HAS_OPP completely
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'samsung-cleanup' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into next/cleanup

Merge "1st Round of Samsung cleanup for v3.19" from Kukjin Kim:

Samsung cleanup for v3.19

- Cleanup SMP/hotplug codes from hotplug.c to platsmp.c
- Remove unneeded __ref annotation for exynos_cpu_die()
- Fix the way to power down CPU on exynos4 and CPUidle
  clock down after power down some CPU

* tag 'samsung-cleanup' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
  ARM: EXYNOS: Fix CPU idle clock down after CPU off
  ARM: EXYNOS: Remove unneeded __ref annotation for cpu_die function
  ARM: EXYNOS: Move code from hotplug.c to platsmp.c
Signed-off-by: Olof Johansson <olof@lixom.net>

Merge tag 'dts-subdirs-for-arm-soc-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/rric/linux into next/cleanup

Pull "dts, kbuild: Implement support for dtb vendor subdirs" from
Robert Richter:

dts, kbuild: Implement support for dtb vendor subdirs

For arm64 we want to put dts files into vendor's subdirectories from
the beginning. This patch set implements this. As this is a generic
kbuild implementation, vendor subdirs will be also available for
arch/arm and other architectures. The subdirectory tree is also
reflected in the install path.

A new makefile variable dts-dirs is introduced to point to dts
subdirs. This variable is used by kbuild for building and installation
of dtb files.

A dts Makefile looks now as follows:

----
dtb-$(CONFIG_...) += some_file_1.dtb
dtb-$(CONFIG_...) += some_file_2.dtb

dts-dirs          += dir_vendor_a
dts-dirs          += dir_vendor_b

always         := $(dtb-y)
subdir-y       := $(dts-dirs)
clean-files    := *.dtb
----

This patches also introduces the dtbs_install make target for
arm64. Install rules are moved to Makefile.dtbinst using the same
style and calling convention like for modinst and fwinst.

* tag 'dts-subdirs-for-arm-soc-v3.19' of git://git.kernel.org/pub/scm/linux/kernel/git/rric/linux:
  dts, arm: Remove $(MACHINE) variable from dtbs make recipes
  dts, arm64: Move dts files to vendor subdirs
  dts, kbuild: Implement support for dtb vendor subdirs
  dts, arm/arm64: Remove dtbs build rules in sub-makes
  dts, kbuild: Factor out dtbs install rules to Makefile.dtbinst
  dts, arm64: Add dtbs_install make target
Signed-off-by: Olof Johansson <olof@lixom.net>

Remove legacy support for at91sam9rl boards.
This include board files removal plus all legacy code for non DT boards
support.
Use the Device Tree for running this board with newer kernels.
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
[nicolas.ferre@atmel.com: Add sentence about DT]
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>

Remove legacy support for at91sam9g45/9m10 boards.
This include board files removal plus all legacy code for non DT boards
support (i.e. at91sam9g45.c and at91sam9g45_devices.c).
Use the Device Tree for running this board with newer kernels.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
[nicolas.ferre@atmel.com: Add sentence about DT, removed defconfig]
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>

As there is currently no-one to take care of this old !MMU target and as its
support in recent kernels is a bit rotten, remove this at91x40 support and the
board file associated with it (at91eb01).
There are modern ARM !MMU in Mainline now so this target is not interesting for
building tests anymore. It would be better to start from these modern ARM !MMU
platforms to reintroduce at91x40 support if needed.
Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Greg Ungerer <gerg@uclinux.org>
Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>

Pull MTD fixes from Brian Norris:
 "Three main MTD fixes for 3.18:

   - A regression from 3.16 which was noticed in 3.17.  With the
     restructuring of the m25p80.c driver and the SPI NOR library
     framework, we omitted proper listing of the SPI device IDs.  This
     means m25p80.c wouldn't auto-load (modprobe) properly when built as
     a module.  For now, we duplicate the device IDs into both modules.

   - The OMAP / ELM modules were depending on an implicit link ordering.
     Use deferred probing so that the new link order (in 3.18-rc) can
     still allow for successful probing.

   - Fix suspend/resume support for LH28F640BF NOR flash"

* tag 'for-linus-20141102' of git://git.infradead.org/linux-mtd:
  mtd: cfi_cmdset_0001.c: fix resume for LH28F640BF chips
  mtd: omap: fix mtd devices not showing up
  mtd: m25p80,spi-nor: Fix module aliases for m25p80
  mtd: spi-nor: make spi_nor_scan() take a chip type name, not spi_device_id
  mtd: m25p80: get rid of spi_get_device_id

Pull SCSI fixes from James Bottomley:
 "This is a set of six patches consisting of:
   - two MAINTAINER updates
   - two scsi-mq fixs for the old parallel interface (not every request
     is tagged and we need to set the right flags to populate the SPI
     tag message)
   - a fix for a memory leak in scatterlist traversal caused by a
     preallocation update in 3.17
   - an ipv6 fix for cxgbi"

[ The scatterlist fix also came in separately through the block layer tree ]

* tag 'scsi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  MAINTAINERS: ufs - remove self
  MAINTAINERS: change hpsa and cciss maintainer
  libcxgbi : support ipv6 address host_param
  scsi: set REQ_QUEUE for the blk-mq case
  Revert "block: all blk-mq requests are tagged"
  lib/scatterlist: fix memory leak with scsi-mq

Pull drm fixes from Dave Airlie:
 "Nothing too astounding or major: radeon, i915, vmwgfx, armada and
  exynos.

  Biggest ones:
   - vmwgfx has one big locking regression fix
   - i915 has come displayport fixes
   - radeon has some stability and a memory alloc failure
   - armada and exynos have some vblank fixes"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (24 commits)
  drm/exynos: correct connector->dpms field before resuming
  drm/exynos: enable vblank after DPMS on
  drm/exynos: init kms poll at the end of initialization
  drm/exynos: propagate plane initialization errors
  drm/exynos: vidi: fix build warning
  drm/exynos: remove explicit encoder/connector de-initialization
  drm/exynos: init vblank with real number of crtcs
  drm/vmwgfx: Filter out modes those cannot be supported by the current VRAM size.
  drm/vmwgfx: Fix hash key computation
  drm/vmwgfx: fix lock breakage
  drm/i915/dp: only use training pattern 3 on platforms that support it
  drm/radeon: remove some buggy dead code
  drm/i915: Ignore VBT backlight check on Macbook 2, 1
  drm/radeon: remove invalid pci id
  drm/radeon: dpm fixes for asrock systems
  radeon: clean up coding style differences in radeon_get_bios()
  drm/radeon: Use drm_malloc_ab instead of kmalloc_array
  drm/radeon/dpm: disable ulv support on SI
  drm/i915: Fix GMBUSFREQ on vlv/chv
  drm/i915: Ignore long hpds on eDP ports
  ...

Pull ARM fixes from Russell King:
 - add the new bpf syscall to ARM.
 - drop a redundant return statement in __iommu_alloc_remap()
 - fix a performance issue noticed by Thomas Petazzoni with
   kmap_atomic().
 - fix an issue with the L2 cache OF parsing code which caused it to
   incorrectly print warnings on each boot, and make the warning text
   more consistent with the rest of the code

* 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
  ARM: 8180/1: mm: implement no-highmem fast path in kmap_atomic_pfn()
  ARM: 8183/1: l2c: Improve l2c310_of_parse() error message
  ARM: 8181/1: Drop extra return statement
  ARM: 8182/1: l2c: Make l2x0_cache_size_of_parse() return 'int'
  ARM: enable bpf syscall

Pull kvm fixes from Paolo Bonzini:
 "A small set of x86 fixes.  The most serious is an SRCU lockdep fix.

  A bit late - needed some time to test the SRCU fix, which only came in
  on Friday"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: vmx: defer load of APIC access page address during reset
  KVM: nVMX: Disable preemption while reading from shadow VMCS
  KVM: x86: Fix far-jump to non-canonical check
  KVM: emulator: fix execution close to the segment limit
  KVM: emulator: fix error code for __linearize

Merge branch 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-fixes

This pull-request includes some bug fixes and code cleanups.
Especially, this fixes the bind failure issue occurred when it tries
to re-bind Exynos drm driver after unbound, and the modetest failure
issue incurred by not having a pair to vblank on and off requests.

* 'exynos-drm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
  drm/exynos: correct connector->dpms field before resuming
  drm/exynos: enable vblank after DPMS on
  drm/exynos: init kms poll at the end of initialization
  drm/exynos: propagate plane initialization errors
  drm/exynos: vidi: fix build warning
  drm/exynos: remove explicit encoder/connector de-initialization
  drm/exynos: init vblank with real number of crtcs

Pull VFS fixes from Al Viro:
 "A bunch of assorted fixes, most of them followups to overlayfs merge"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  ovl: initialize ->is_cursor
  Return short read or 0 at end of a raw device, not EIO
  isofs: don't bother with ->d_op for normal case
  isofs_cmp(): we'll never see a dentry for . or ..
  overlayfs: fix lockdep misannotation
  ovl: fix check for cursor
  overlayfs: barriers for opening upper-layer directory
  rcu: Provide counterpart to rcu_dereference() for non-RCU situations
  staging: android: logger: Fix log corruption regression

The sk_prot is irda's own set of protocol handlers, so irda should
statically know what that function is anyway, without using an indirect
pointer.  And as it happens, we know *exactly* what that pointer is
statically: it's NULL, because irda doesn't define a disconnect
operation.

So calling that function is doubly wrong, and will just cause an oops.
Reported-by: Martin Lang <mlg.hessigheim@gmail.com>
Cc: Samuel Ortiz <samuel@sortiz.org>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

During system suspend after connector switch off its dpms field
is set to connector previous dpms state. To properly resume dpms field
should be set to its actual state (off) before resuming to previous dpms state.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

Before DPMS off driver disables vblank.
It should be balanced by vblank enable after DPMS on.
The patch fixes issue with page_flip ioctl not being able
to acquire vblank counter introduced by patch:
drm: Always reject drm_vblank_get() after drm_vblank_off()
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

HPD events can be generated by components even if drm_dev is not fully
initialized, to skip such events kms poll initialization should
be performed at the end of load callback followed directly by forced
connection detection.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

In case of error during plane initialization load callback
incorrectly return success, this patch fixes it.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

encoder object isn't used anymore so remove it.
Signed-off-by: Inki Dae <inki.dae@samsung.com>

All KMS objects are destroyed by drm_mode_config_cleanup in proper order
so component drivers should not care about it.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

Initialization of vblank with MAX_CRTC caused attempts
to disabling vblanks for non-existing crtcs in case
drm used fewer crtcs. The patch fixes it.
Signed-off-by: Andrzej Hajda <a.hajda@samsung.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>

Most call paths to vmx_vcpu_reset do not hold the SRCU lock.  Defer loading
the APIC access page to the next vmentry.

This avoids the following lockdep splat:

[ INFO: suspicious RCU usage. ]
3.18.0-rc2-test2+ #70 Not tainted
-------------------------------
include/linux/kvm_host.h:474 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 0
1 lock held by qemu-system-x86/2371:
 #0:  (&vcpu->mutex){+.+...}, at: [<ffffffffa037d800>] vcpu_load+0x20/0xd0 [kvm]

stack backtrace:
CPU: 4 PID: 2371 Comm: qemu-system-x86 Not tainted 3.18.0-rc2-test2+ #70
Hardware name: Dell Inc. OptiPlex 9010/0M9KCM, BIOS A12 01/10/2013
 0000000000000001 ffff880209983ca8 ffffffff816f514f 0000000000000000
 ffff8802099b8990 ffff880209983cd8 ffffffff810bd687 00000000000fee00
 ffff880208a2c000 ffff880208a10000 ffff88020ef50040 ffff880209983d08
Call Trace:
 [<ffffffff816f514f>] dump_stack+0x4e/0x71
 [<ffffffff810bd687>] lockdep_rcu_suspicious+0xe7/0x120
 [<ffffffffa037d055>] gfn_to_memslot+0xd5/0xe0 [kvm]
 [<ffffffffa03807d3>] __gfn_to_pfn+0x33/0x60 [kvm]
 [<ffffffffa0380885>] gfn_to_page+0x25/0x90 [kvm]
 [<ffffffffa038aeec>] kvm_vcpu_reload_apic_access_page+0x3c/0x80 [kvm]
 [<ffffffffa08f0a9c>] vmx_vcpu_reset+0x20c/0x460 [kvm_intel]
 [<ffffffffa039ab8e>] kvm_vcpu_reset+0x15e/0x1b0 [kvm]
 [<ffffffffa039ac0c>] kvm_arch_vcpu_setup+0x2c/0x50 [kvm]
 [<ffffffffa037f7e0>] kvm_vm_ioctl+0x1d0/0x780 [kvm]
 [<ffffffff810bc664>] ? __lock_is_held+0x54/0x80
 [<ffffffff812231f0>] do_vfs_ioctl+0x300/0x520
 [<ffffffff8122ee45>] ? __fget+0x5/0x250
 [<ffffffff8122f0fa>] ? __fget_light+0x2a/0xe0
 [<ffffffff81223491>] SyS_ioctl+0x81/0xa0
 [<ffffffff816fed6d>] system_call_fastpath+0x16/0x1b
Reported-by: Takashi Iwai <tiwai@suse.de>
Reported-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Reviewed-by: Wanpeng Li <wanpeng.li@linux.intel.com>
Tested-by: Wanpeng Li <wanpeng.li@linux.intel.com>
Fixes: 38b99173Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

In order to access the shadow VMCS, we need to load it. At this point,
vmx->loaded_vmcs->vmcs and the actually loaded one start to differ. If
we now get preempted by Linux, vmx_vcpu_put and, on return, the
vmx_vcpu_load will work against the wrong vmcs. That can cause
copy_shadow_to_vmcs12 to corrupt the vmcs12 state.

Fix the issue by disabling preemption during the copy operation.
copy_vmcs12_to_shadow is safe from this issue as it is executed by
vmx_vcpu_run when preemption is already disabled before vmentry.

This bug is exposed by running Jailhouse within KVM on CPUs with
shadow VMCS support.  Jailhouse never expects an interrupt pending
vmexit, but the bug can cause it if, after copy_shadow_to_vmcs12
is preempted, the active VMCS happens to have the virtual interrupt
pending flag set in the CPU-based execution controls.
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Commit d1442d85 ("KVM: x86: Handle errors when RIP is set during far
jumps") introduced a bug that caused the fix to be incomplete.  Due to
incorrect evaluation, far jump to segment with L bit cleared (i.e., 32-bit
segment) and RIP with any of the high bits set (i.e, RIP[63:32] != 0) set may
not trigger #GP.  As we know, this imposes a security problem.

In addition, the condition for two warnings was incorrect.

Fixes: d1442d85Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
[Add #ifdef CONFIG_X86_64 to avoid complaints of undefined behavior. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

A critical 3.18 regression fix from Rob, (thanks!)
A fix to avoid advertizing modes we can't support from Sinclair
  (welcome Sinclair!)
and a fix for an incorrect  hash key computation from me that is
  completely harmless, but can wait 'til the next merge window if necessary.
  (I can't really bother stable with this one).

* 'vmwgfx-fixes-3.18' of git://people.freedesktop.org/~thomash/linux:
  drm/vmwgfx: Filter out modes those cannot be supported by the current VRAM size.
  drm/vmwgfx: Fix hash key computation
  drm/vmwgfx: fix lock breakage

Pull staging fixes from Greg KH:
 "Here are some staging driver fixes for 3.18-rc3.  Mostly iio and
  comedi driver fixes for issues reported by people.

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'staging-3.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: comedi: fix memory leak / bad pointer freeing for chanlist
  staging: comedi: Kconfig: fix config COMEDI_ADDI_APCI_3120 dependants
  staging: comedi: widen subdevice number argument in ioctl handlers
  staging: rtl8723au: Fix alignment of mac_addr for ether_addr_copy() usage
  drivers/staging/comedi/Kconfig: Let COMEDI_II_PCI20KC depend on HAS_IOMEM
  staging: comedi: (regression) channel list must be set for COMEDI_CMD ioctl
  iio: adc: mxs-lradc: Disable the clock on probe failure
  iio: st_sensors: Fix buffer copy
  staging:iio:ad5933: Drop "raw" from channel names
  staging:iio:ad5933: Fix NULL pointer deref when enabling buffer

Pull USB fixes from Greg KH:
 "Here are a bunch of USB fixes for 3.18-rc3.

  Mostly usb-serial device ids and gadget fixes for issues that have
  been reported.  Full details are in the shortlog.

  All of these have been in linux-next for a while"

* tag 'usb-3.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (42 commits)
  usb: chipidea: Fix oops when removing the ci_hdrc module
  usb: gadget: function: Fixed the return value on error path
  usb: dwc2: gadget: disable phy before turning off power regulators
  usb: gadget: function: Remove redundant usb_free_all_descriptors
  usb: dwc3: gadget: Properly initialize LINK TRB
  usb: dwc2: gadget: fix gadget unregistration in udc_stop() function
  usb: dwc2: Bits in bitfield should add up to 32
  usb: dwc2: gadget: sparse warning of context imbalance
  usb: gadget: udc: core: fix kernel oops with soft-connect
  usb: musb: musb_dsps: fix NULL pointer in suspend
  usb: musb: dsps: start OTG timer on resume again
  usb: gadget: loopback: don't queue requests to bogus endpoints
  usb: ffs: fix regression when quirk_ep_out_aligned_size flag is set
  usb: gadget: f_fs: remove redundant ffs_data_get()
  usb: gadget: udc: USB_GADGET_XILINX should depend on HAS_DMA
  Revert "usb: dwc3: dwc3-omap: Disable/Enable only wrapper interrupts in prepare/complete"
  usb: gadget: composite: enable BESL support
  usb: musb: cppi41: restart hrtimer only if not yet done
  usb: dwc3: ep0: fix Data Phase for transfer sizes aligned to wMaxPacketSize
  usb: serial: ftdi_sio: add "bricked" FTDI device PID
  ...

Pull btrfs fixes from Chris Mason:
 "Filipe is nailing down some problems with our skinny extent variation,
  and Dave's patch fixes endian problems in the new super block checks"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  Btrfs: fix race that makes btrfs_lookup_extent_info miss skinny extent items
  Btrfs: properly clean up btrfs_end_io_wq_cache
  Btrfs: fix invalid leaf slot access in btrfs_lookup_extent()
  btrfs: use macro accessors in superblock validation checks

Pull input updates from Dmitry Torokhov:
 "A bunch of fixes for minor defects reported by Coverity, a few driver
  fixups and revert of i8042.nomux change so that we are once again
  enable active MUX mode if box claims to support it"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Revert "Input: i8042 - disable active multiplexing by default"
  Input: altera_ps2 - use correct type for irq return value
  Input: altera_ps2 - write to correct register when disabling interrupts
  Input: max77693-haptic - fix potential overflow
  Input: psmouse - remove unneeded check in psmouse_reconnect()
  Input: vsxxxaa - fix code dropping bytes from queue
  Input: ims-pcu - fix dead code in ims_pcu_ofn_reg_addr_store()
  Input: opencores-kbd - fix error handling
  Input: wm97xx - adapt parameters to tosa touchscreen.
  Input: i8042 - quirks for Fujitsu Lifebook A544 and Lifebook AH544
  Input: stmpe-keypad - fix valid key line bitmask
  Input: soc_button_array - update calls to gpiod_get*()

Pull ACPI and power management fixes from Rafael Wysocki:
 "These are fixes received after my previous pull request plus one that
  has been in the works for quite a while, but its previous version
  caused problems to happen, so it's been deferred till now.

  Fixed are two recent regressions (MFD enumeration and cpufreq-dt),
  ACPI EC regression introduced in 3.17, system suspend error code path
  regression introduced in 3.15, an older bug related to recovery from
  failing resume from hibernation and a cpufreq-dt driver issue related
  to operation performance points.

  Specifics:

   - Fix a crash on r8a7791/koelsch during resume from system suspend
     caused by a recent cpufreq-dt commit (Geert Uytterhoeven).

   - Fix an MFD enumeration problem introduced by a recent commit adding
     ACPI support to the MFD subsystem that exposed a weakness in the
     ACPI core causing ACPI enumeration to be applied to all devices
     associated with one ACPI companion object, although it should be
     used for one of them only (Mika Westerberg).

   - Fix an ACPI EC regression introduced during the 3.17 cycle causing
     some Samsung laptops to misbehave as a result of a workaround
     targeted at some Acer machines.  That includes a revert of a commit
     that went too far and a quirk for the Acer machines in question.
     From Lv Zheng.

   - Fix a regression in the system suspend error code path introduced
     during the 3.15 cycle that causes it to fail to take errors from
     asychronous execution of "late" suspend callbacks into account
     (Imre Deak).

   - Fix a long-standing bug in the hibernation resume error code path
     that fails to roll back everything correcty on "freeze" callback
     errors and leaves some devices in a "suspended" state causing more
     breakage to happen subsequently (Imre Deak).

   - Make the cpufreq-dt driver disable operation performance points
     that are not supported by the VR connected to the CPU voltage plane
     with acceptable tolerance instead of constantly failing voltage
     scaling later on (Lucas Stach)"

* tag 'pm+acpi-3.18-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI / EC: Fix regression due to conflicting firmware behavior between Samsung and Acer.
  Revert "ACPI / EC: Add support to disallow QR_EC to be issued before completing previous QR_EC"
  cpufreq: cpufreq-dt: Restore default cpumask_setall(policy->cpus)
  PM / Sleep: fix recovery during resuming from hibernation
  PM / Sleep: fix async suspend_late/freeze_late error handling
  ACPI: Use ACPI companion to match only the first physical device
  cpufreq: cpufreq-dt: disable unsupported OPPs