When working on report indexes, always validate that they are in bounds.
Without this, a HID device could report a malicious feature report that
could trick the driver into a heap overflow:

[  634.885003] usb 1-1: New USB device found, idVendor=0596, idProduct=0500
...
[  676.469629] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

Note that we need to change the indexes from s8 to s16 as they can
be between -1 and 255.

CVE-2013-2897

Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

A HID device could send a malicious output report that would cause the
logitech-dj HID driver to leak kernel memory contents to the device, or
trigger a NULL dereference during initialization:

[  304.424553] usb 1-1: New USB device found, idVendor=046d, idProduct=c52b
...
[  304.780467] BUG: unable to handle kernel NULL pointer dereference at 0000000000000028
[  304.781409] IP: [<ffffffff815d50aa>] logi_dj_recv_send_report.isra.11+0x1a/0x90

CVE-2013-2895
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

When dealing with usage_index, be sure to properly use unsigned instead of
int to avoid overflows.

When working on report fields, always validate that their report_counts are
in bounds.
Without this, a HID device could report a malicious feature report that
could trick the driver into a heap overflow:

[  634.885003] usb 1-1: New USB device found, idVendor=0596, idProduct=0500
...
[  676.469629] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

CVE-2013-2897

Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Acked-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

A HID device could send a malicious output report that would cause the
lenovo-tpkbd HID driver to write just beyond the output report allocation
during initialization, causing a heap overflow:

[   76.109807] usb 1-1: New USB device found, idVendor=17ef, idProduct=6009
...
[   80.462540] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

CVE-2013-2894
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

A HID device could send a malicious output report that would cause the
lg, lg3, and lg4 HID drivers to write beyond the output report allocation
during an event, causing a heap overflow:

[  325.245240] usb 1-1: New USB device found, idVendor=046d, idProduct=c287
...
[  414.518960] BUG kmalloc-4096 (Not tainted): Redzone overwritten

Additionally, while lg2 did correctly validate the report details, it was
cleaned up and shortened.

CVE-2013-2893
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

A HID device could send a malicious output report that would cause the
steelseries HID driver to write beyond the output report allocation
during initialization, causing a heap overflow:

[  167.981534] usb 1-1: New USB device found, idVendor=1038, idProduct=1410
...
[  182.050547] BUG kmalloc-256 (Tainted: G        W   ): Redzone overwritten

CVE-2013-2891
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

This driver must validate the availability of the HID output report and
its size before it can write LED states via buzz_set_leds(). This stops
a heap overflow that is possible if a device provides a malicious HID
output report:

[  108.171280] usb 1-1: New USB device found, idVendor=054c, idProduct=0002
...
[  117.507877] BUG kmalloc-192 (Not tainted): Redzone overwritten

CVE-2013-2890
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org #3.11
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

The zeroplus HID driver was not checking the size of allocated values
in fields it used. A HID device could send a malicious output report
that would cause the driver to write beyond the output report allocation
during initialization, causing a heap overflow:

[ 1442.728680] usb 1-1: New USB device found, idVendor=0c12, idProduct=0005
...
[ 1466.243173] BUG kmalloc-192 (Tainted: G        W   ): Redzone overwritten

CVE-2013-2889
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Many drivers need to validate the characteristics of their HID report
during initialization to avoid misusing the reports. This adds a common
helper to perform validation of the report exisitng, the field existing,
and the expected number of values within the field.
Signed-off-by: Kees Cook <keescook@chromium.org>
Cc: stable@vger.kernel.org
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

This reverts commits 61e00655, 73f8645d and 8e22ecb6:
  "Input: introduce BTN/ABS bits for drums and guitars"
  "HID: wiimote: add support for Guitar-Hero drums"
  "HID: wiimote: add support for Guitar-Hero guitars"

The extra new ABS_xx values resulted in ABS_MAX no longer being a
power-of-two, which broke the comparison logic.  It also caused the
ioctl numbers to overflow into the next byte, causing problems for that.

We'll try again for 3.13.
Reported-by: Markus Trippelsdorf <markus@trippelsdorf.de>
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Acked-by: David Herrmann <dh.herrmann@gmail.com>
Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Benjamin Tissoires <benjamin.tissoires@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull ARM SoC board updates from Olof Johansson:
 "Board updates for 3.12.  Again, a bit of domain overlap with SoC and
  DT branches, but most of this is around legacy code and board support.
  We've found that platform maintainers have a hard time separating all
  of these out and might move towards fewer branches for next release.

   - Removal of a number of Marvell Kirkwood board files, since contents
     is now common and mostly configured via DT.
   - Device-tree updates for Marvell Dove, including irqchip and
     clocksource setup.
   - Defconfig updates.  Gotta go somewhere.  One new one for Renesas
     Lager.
   - New backlight drivers for backlights used on Renesas shmobile
     platforms.
   - Removal of Renesas leds driver.
   - Shuffling of some of the new Broadcom platforms to give room for
     others in the same mach directory.  More in 3.13"

* tag 'boards-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (67 commits)
  mmc: sdhci-bcm-kona: Staticize sdhci_bcm_kona_card_event
  mmc: sdhci-bcm-kona: Remove unneeded version.h inclusion
  ARM: bcm: Make secure API call optional
  ARM: DT: binding fixup to align with vendor-prefixes.txt (drivers)
  ARM: mmc: fix NONREMOVABLE test in sdhci-bcm-kona
  ARM: bcm: Rename board_bcm
  mmc: sdhci-bcm-kona: make linker-section warning go away
  ARM: tegra: defconfig updates
  ARM: dove: add initial DT file for Globalscale D2Plug
  ARM: dove: add GPIO IR receiver node to SolidRun CuBox
  ARM: dove: add common pinmux functions to DT
  ARM: dove: add cpu device tree node
  ARM: dove: update dove_defconfig with SI5351, PCI, and xHCI
  arch/arm/mach-kirkwood: Avoid using ARRAY_AND_SIZE(e) as a function argument
  ARM: kirkwood: fix DT building and update defconfig
  ARM: kirkwood: Remove all remaining trace of DNS-320/325 platform code
  ARM: configs: disable DEBUG_LL in bcm_defconfig
  ARM: bcm281xx: Board specific reboot code
  ARM bcm281xx: Turn on socket & network support.
  ARM: bcm281xx: Turn on L2 cache.
  ...

Pull ARM SoC platform changes from Olof Johansson:
 "This branch contains mostly additions and changes to platform
  enablement and SoC-level drivers.  Since there's sometimes a
  dependency on device-tree changes, there's also a fair amount of
  those in this branch.

  Pieces worth mentioning are:

   - Mbus driver for Marvell platforms, allowing kernel configuration
     and resource allocation of on-chip peripherals.
   - Enablement of the mbus infrastructure from Marvell PCI-e drivers.
   - Preparation of MSI support for Marvell platforms.
   - Addition of new PCI-e host controller driver for Tegra platforms
   - Some churn caused by sharing of macro names between i.MX 6Q and 6DL
     platforms in the device tree sources and header files.
   - Various suspend/PM updates for Tegra, including LP1 support.
   - Versatile Express support for MCPM, part of big little support.
   - Allwinner platform support for A20 and A31 SoCs (dual and quad
     Cortex-A7)
   - OMAP2+ support for DRA7, a new Cortex-A15-based SoC.

  The code that touches other architectures are patches moving MSI
  arch-specific functions over to weak symbols and removal of
  ARCH_SUPPORTS_MSI, acked by PCI maintainers"

* tag 'soc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (266 commits)
  tegra-cpuidle: provide stub when !CONFIG_CPU_IDLE
  PCI: tegra: replace devm_request_and_ioremap by devm_ioremap_resource
  ARM: tegra: Drop ARCH_SUPPORTS_MSI and sort list
  ARM: dts: vf610-twr: enable i2c0 device
  ARM: dts: i.MX51: Add one more I2C2 pinmux entry
  ARM: dts: i.MX51: Move pins configuration under "iomuxc" label
  ARM: dtsi: imx6qdl-sabresd: Add USB OTG vbus pin to pinctrl_hog
  ARM: dtsi: imx6qdl-sabresd: Add USB host 1 VBUS regulator
  ARM: dts: imx27-phytec-phycore-som: Enable AUDMUX
  ARM: dts: i.MX27: Disable AUDMUX in the template
  ARM: dts: wandboard: Add support for SDIO bcm4329
  ARM: i.MX5 clocks: Remove optional clock setup (CKIH1) from i.MX51 template
  ARM: dts: imx53-qsb: Make USBH1 functional
  ARM i.MX6Q: dts: Enable I2C1 with EEPROM and PMIC on Phytec phyFLEX-i.MX6 Ouad module
  ARM i.MX6Q: dts: Enable SPI NOR flash on Phytec phyFLEX-i.MX6 Ouad module
  ARM: dts: imx6qdl-sabresd: Add touchscreen support
  ARM: imx: add ocram clock for imx53
  ARM: dts: imx: ocram size is different between imx6q and imx6dl
  ARM: dts: imx27-phytec-phycore-som: Fix regulator settings
  ARM: dts: i.MX27: Remove clock name from CPU node
  ...

Pull ARM SoC DT updates from Olof Johansson:
 "Device tree and bindings updates for 3.12.

  General additions of various on-chip and on-board peripherals on
  various platforms as support gets added.  Some of the bigger changes
  are:

   - Addition of (new) PCI-e support on Tegra.
   - More Tegra4 support, including PMC configuration for Dalmore.
   - Addition of a new board for Exynos4 (trats2) and more bindings for
     4x12 IP.
   - Addition of Allwinner A20 and A31 SoC and board files.
   - Move of the ST Ericsson device tree files to now use ste-* prefix.
   - More move of hardware description of shmobile platforms to DT.
   - Two new board dts files for Freescale MXs"

* tag 'dt-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (177 commits)
  dts: Rename DW APB timer compatible strings
  dts: Deprecate ALTR as a vendor prefix
  of: add vendor prefix for Altera Corp.
  ARM: at91/dt: sam9x5ek: add sound configuration
  ARM: at91/dt: sam9x5ek: enable SSC
  ARM: at91/dt: sam9x5ek: add WM8731 codec
  ARM: at91/dt: sam9x5: add SSC DMA parameters
  ARM: at91/dt: add at91rm9200 PQFP package version
  ARM: at91: at91rm9200: set default mmc0 pinctrl-names
  ARM: at91: at91sam9n12: correct pin number of gpio-key
  ARM: at91: at91sam9n12: add qt1070 support
  ARM: at91: at91sam9n12: add pinctrl of TWI
  ARM: at91: Add PMU support for sama5d3
  ARM: at91: at91sam9260: add missing pinctrl-names on mmc
  ARM: tegra: configure power off for Dalmore
  ARM: DT: binding fixup to align with vendor-prefixes.txt (DT)
  ARM: dts: add sdio blocks to bcm28155-ap board
  ARM: dts: align sdio numbers to HW definition
  ARM: sun7i: Add Olimex A20-Olinuxino-Micro support
  ARM: sun7i: Add Allwinner A20 DTSI
  ...

Pull ARM SoC cleanups from Olof Johansson:
 "This branch contains code cleanups, moves and removals for 3.12.

  There's a large number of various cleanups, and a nice net removal of
  13500 lines of code.

  Highlights worth mentioning are:

   - A series of patches from Stephen Boyd removing the ARM local timer
     API.
   - Move of Qualcomm MSM IOMMU code to drivers/iommu.
   - Samsung PWM driver cleanups from Tomasz Figa, removing legacy PWM
     driver and switching over to the drivers/pwm one.
   - Removal of some unusued auto-generated headers for OMAP2+ (PRM/CM).

  There's also a move of a header file out of include/linux/i2c/ to
  platform_data, where it really belongs.  It touches mostly ARM
  platform code for include changes so we took it through our tree"

* tag 'cleanup-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (83 commits)
  ARM: OMAP2+: Add back the define for AM33XX_RST_GLOBAL_WARM_SW_MASK
  gpio: (gpio-pca953x) move header to linux/platform_data/
  arm: zynq: hotplug: Remove unreachable code
  ARM: SAMSUNG: Remove unnecessary exynos4_default_sdhci*()
  tegra: simplify use of devm_ioremap_resource
  ARM: SAMSUNG: Remove plat/regs-timer.h header
  ARM: SAMSUNG: Remove remaining uses of plat/regs-timer.h header
  ARM: SAMSUNG: Remove pwm-clock infrastructure
  ARM: SAMSUNG: Remove old PWM timer platform devices
  pwm: Remove superseded pwm-samsung-legacy driver
  ARM: SAMSUNG: Modify board files to use new PWM platform device
  ARM: SAMSUNG: Rework private data handling in dev-backlight
  pwm: Add new pwm-samsung driver
  ARM: mach-mvebu: remove redundant DT parsing and validation
  ARM: msm: Only compile io.c on platforms that use it
  iommu/msm: Move mach includes to iommu directory
  ARM: msm: Remove devices-iommu.c
  ARM: msm: Move mach/board.h contents to common.h
  ARM: msm: Migrate msm_timer to CLOCKSOURCE_OF_DECLARE
  ARM: msm: Remove TMR and TMR0 static mappings
  ...

Pull ARM SoC low-priority fixes from Olof Johansson:
 "This branch contains a handful of fixes for various platforms that
  weren't serious enough to be included in late 3.11-rc releases.  Most
  of them are for minor cleanups and cosmetic fixes.

  There's also a bit of code removal here, one board file removal for
  clps711x, and removal of some legacy device creation on OMAP2+"

* tag 'fixes-nc-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (25 commits)
  ARM: OMAP2: use 'int' instead of 'unsigned' for variable 'gpmc_irq_start'
  ARM: OMAP2: remove useless variable 'ret'
  ARM: OMAP: dma: fix error return code in omap_system_dma_probe()
  ARM: OMAP2+: fix wrong address when loading PRM_FRAC_INCREMENTOR_DENUMERATOR_RELOAD
  ARM: OMAP2+: am33xx-restart: trigger warm reset on omap2+ boards
  ARM: OMAP2: Use a consistent AM33XX SoC option description
  ARM: OMAP2+: Remove legacy device creation for McPDM and DMIC
  ARM: clps711x: edb7211: Remove extra iotable_init() call
  ARM: clps711x: autcpu12: Remove incorrect config checking
  ARM: clps711x: Drop fortunet board support
  ARM: clps711x: Remove the special name for the syscon driver
  ARM: dts: Fix memory node in skeleton64.dtsi
  ARM: Keystone: Convert device tree file to use IRQ defines
  ARM: keystone: use #include to include skeleton.dtsi
  ARM: keystone: Drop the un-necessary dsb from keystone_cpu_smc()
  ARM: Keystone: No need to preserve r12 across smc call
  ARM: keystone: remove redundant smp_init_cpus definition
  ARM: keystone: drop useless HAVE_SCHED_CLOCK
  ARM: dove: fix missing __init section of dove_mpp_gpio_mode
  ARM: shmobile: armadillo800eva-reference: fix compiler warning
  ...

Pull ia64 fixes from Tony Luck:
 "Couple of small cleanups for ia64"

* tag 'please-pull-misc-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux:
  [IA64] Use asm-generic/bitops/builtin-ffs.h
  [IA64] dmi.h: Make dmi_alloc use kzalloc

Pull Tile arch updates from Chris Metcalf:
 "These changes bring in a bunch of new functionality that has been
  maintained internally at Tilera over the last year, plus other stray
  bits of work that I've taken into the tile tree from other folks.

  The changes include some PCI root complex work, interrupt-driven
  console support, support for performing fast-path unaligned data
  fixups by kernel-based JIT code generation, CONFIG_PREEMPT support,
  vDSO support for gettimeofday(), a serial driver for the tilegx
  on-chip UART, KGDB support, more optimized string routines, support
  for ftrace and kprobes, improved ASLR, and many bug fixes.

  We also remove support for the old TILE64 chip, which is no longer
  buildable"

* git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile: (85 commits)
  tile: refresh tile defconfig files
  tile: rework <asm/cmpxchg.h>
  tile PCI RC: make default consistent DMA mask 32-bit
  tile: add null check for kzalloc in tile/kernel/setup.c
  tile: make __write_once a synonym for __read_mostly
  tile: remove support for TILE64
  tile: use asm-generic/bitops/builtin-*.h
  tile: eliminate no-op "noatomichash" boot argument
  tile: use standard tile_bundle_bits type in traps.c
  tile: simplify code referencing hypervisor API addresses
  tile: change <asm/system.h> to <asm/switch_to.h> in comments
  tile: mark pcibios_init() as __init
  tile: check for correct compiler earlier in asm-offsets.c
  tile: use standard 'generic-y' model for <asm/hw_irq.h>
  tile: use asm-generic version of <asm/local64.h>
  tile PCI RC: add comment about "PCI hole" problem
  tile: remove DEBUG_EXTRA_FLAGS kernel config option
  tile: add virt_to_kpte() API and clean up and document behavior
  tile: support FRAME_POINTER
  tile: support reporting Tilera hypervisor statistics
  ...

Pull ARM64 update from Catalin Marinas:
 - User tagged pointers support (top 8-bit of user pointers
   automatically ignored by the CPU).
 - Kernel mode NEON (no users for arm64 yet but work in progress).
 - arm64 kernel Image header extended to accommodate future EFI stub.
 - Remove BogoMIPS reporting (not relevant, it's just the timer
   frequency).
 - Clean-up (EM_AARCH64/EM_ARM to elf-em.h, ELF notes in read-only
   segment, unused variable).
 - Bug-fixes (RAM boundaries not 2MB aligned, perf, includes).

* tag 'arm64-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux-aarch64:
  Documentation/arm64: clarify requirements for DTB placement
  arm64: mm: permit use of tagged pointers at EL0
  Move the EM_ARM and EM_AARCH64 definitions to uapi/linux/elf-em.h
  arm64: Remove unused cpu_name ascii in arch/arm64/mm/proc.S
  arm64: delay: don't bother reporting bogomips in /proc/cpuinfo
  arm64: Fix mapping of memory banks not ending on a PMD_SIZE boundary
  arm64: move elf notes into readonly segment
  arm64: Enable interrupts in the EL0 undef handler
  arm64: Expand arm64 image header
  ARM64: include: asm: include "asm/types.h" in "pgtable-2level-types.h" and "pgtable-3level-types.h"
  arm64: add support for kernel mode NEON
  arm64: perf: fix ARMv8 EVTYPE_MASK to include NSH bit
  arm64: perf: fix group validation when using enable_on_exec

Pull Microblaze patches from Michal Simek:
 - PCI fixes
 - Selfmod code removing
 - Intc and timer fixes
 - Adding new MB versions
 - Minor fixes

* tag 'microblaze-3.12-rc1' of git://git.monstr.eu/linux-2.6-microblaze:
  microblaze: Show message when reset gpio is not present
  microblaze: Add linux.bin.ub target
  microblaze: Add PVR version string for MB v9.0 and v9.1
  microblaze: timer: Replace microblaze_ prefix by xilinx_
  microblaze: timer: Update header
  microblaze: timer: Remove unused header
  microblaze: timer: Clear driver init function
  microblaze: timer: Use CLKSRC_OF initialization
  microblaze: intc: Remove unused header
  microblaze: intc: Clean driver init function
  microblaze: intc: Using irqchip
  microblaze: intc: Update header
  microblaze: intc: Remove unused headers
  microblaze: Remove selfmodified feature
  of/pci: Use of_pci_range_parser

Pull powerpc updates from Ben Herrenschmidt:
 "Here's the powerpc batch for this merge window.  Some of the
  highlights are:

   - A bunch of endian fixes ! We don't have full LE support yet in that
     release but this contains a lot of fixes all over arch/powerpc to
     use the proper accessors, call the firmware with the right endian
     mode, etc...

   - A few updates to our "powernv" platform (non-virtualized, the one
     to run KVM on), among other, support for bridging the P8 LPC bus
     for UARTs, support and some EEH fixes.

   - Some mpc51xx clock API cleanups in preparation for a clock API
     overhaul

   - A pile of cleanups of our old math emulation code, including better
     support for using it to emulate optional FP instructions on
     embedded chips that otherwise have a HW FPU.

   - Some infrastructure in selftest, for powerpc now, but could be
     generalized, initially used by some tests for our perf instruction
     counting code.

   - A pile of fixes for hotplug on pseries (that was seriously
     bitrotting)

   - The usual slew of freescale embedded updates, new boards, 64-bit
     hiberation support, e6500 core PMU support, etc..."

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc: (146 commits)
  powerpc: Correct FSCR bit definitions
  powerpc/xmon: Fix printing of set of CPUs in xmon
  powerpc/pseries: Move lparcfg.c to platforms/pseries
  powerpc/powernv: Return secondary CPUs to firmware on kexec
  powerpc/btext: Fix CONFIG_PPC_EARLY_DEBUG_BOOTX on ppc32
  powerpc: Cleanup handling of the DSCR bit in the FSCR register
  powerpc/pseries: Child nodes are not detached by dlpar_detach_node
  powerpc/pseries: Add mising of_node_put in delete_dt_node
  powerpc/pseries: Make dlpar_configure_connector parent node aware
  powerpc/pseries: Do all node initialization in dlpar_parse_cc_node
  powerpc/pseries: Fix parsing of initial node path in update_dt_node
  powerpc/pseries: Pack update_props_workarea to map correctly to rtas buffer header
  powerpc/pseries: Fix over writing of rtas return code in update_dt_node
  powerpc/pseries: Fix creation of loop in device node property list
  powerpc: Skip emulating & leave interrupts off for kernel program checks
  powerpc: Add more exception trampolines for hypervisor exceptions
  powerpc: Fix location and rename exception trampolines
  powerpc: Add more trap names to xmon
  powerpc/pseries: Add a warning in the case of cross-cpu VPA registration
  powerpc: Update the 00-Index in Documentation/powerpc
  ...

These are based on the current shipping versions of the config files
from Tilera, as synced up to the tip, so are a better starting point
for folks who want a default configuration.
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>

The macrology in cmpxchg.h was designed to allow arbitrary pointer
and integer values to be passed through the routines.  To support
cmpxchg() on 64-bit values on the 32-bit tilepro architecture, we
used the idiom "(typeof(val))(typeof(val-val))".  This way, in the
"size 8" branch of the switch, when the underlying cmpxchg routine
returns a 64-bit quantity, we cast it first to a typeof(val-val)
quantity (i.e. size_t if "val" is a pointer) with no warnings about
casting between pointers and integers of different sizes, then cast
onwards to typeof(val), again with no warnings.  If val is not a
pointer type, the additional cast is a no-op.  We can't replace the
typeof(val-val) cast with (for example) unsigned long, since then if
"val" is really a 64-bit type, we cast away the high bits.

HOWEVER, this fails with current gcc (through 4.7 at least) if "val"
is a pointer to an incomplete type.  Unfortunately gcc isn't smart
enough to realize that "val - val" will always be a size_t type
even if it's an incomplete type pointer.

Accordingly, I've reworked the way we handle the casting.  We have
given up the ability to use cmpxchg() on 64-bit values on tilepro,
which is OK in the kernel since we should use cmpxchg64() explicitly
on such values anyway.  As a result, I can just use simple "unsigned
long" casts internally.

As I reworked it, I realized it would be cleaner to move the
architecture-specific conditionals for cmpxchg and xchg out of the
atomic.h headers and into cmpxchg, and then use the cmpxchg() and
xchg() primitives directly in atomic.h and elsewhere.  This allowed
the cmpxchg.h header to stand on its own without relying on the
implicit include of it that is performed by <asm/atomic.h>.
It also allowed collapsing the atomic_xchg/atomic_cmpxchg routines
from atomic_{32,64}.h into atomic.h.

I improved the tests that guard the allowed size of the arguments
to the routines to use a __compiletime_error() test.  (By avoiding
the use of BUILD_BUG, I could include cmpxchg.h into bitops.h as
well and use the macros there, which is otherwise impossible due
to include order dependency issues.)

The tilepro _atomic_xxx internal methods were previously set up to
take atomic_t and atomic64_t arguments, which isn't as convenient
with the new model, so I modified them to take int or u64 arguments,
which is consistent with how they used the arguments internally
anyway, so provided some nice simplification there too.
Signed-off-by: Chris Metcalf <cmetcalf@tilera.com>

Pull trivial tree from Jiri Kosina:
 "The usual trivial updates all over the tree -- mostly typo fixes and
  documentation updates"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial: (52 commits)
  doc: Documentation/cputopology.txt fix typo
  treewide: Convert retrun typos to return
  Fix comment typo for init_cma_reserved_pageblock
  Documentation/trace: Correcting and extending tracepoint documentation
  mm/hotplug: fix a typo in Documentation/memory-hotplug.txt
  power: Documentation: Update s2ram link
  doc: fix a typo in Documentation/00-INDEX
  Documentation/printk-formats.txt: No casts needed for u64/s64
  doc: Fix typo "is is" in Documentations
  treewide: Fix printks with 0x%#
  zram: doc fixes
  Documentation/kmemcheck: update kmemcheck documentation
  doc: documentation/hwspinlock.txt fix typo
  PM / Hibernate: add section for resume options
  doc: filesystems : Fix typo in Documentations/filesystems
  scsi/megaraid fixed several typos in comments
  ppc: init_32: Fix error typo "CONFIG_START_KERNEL"
  treewide: Add __GFP_NOWARN to k.alloc calls with v.alloc fallbacks
  page_isolation: Fix a comment typo in test_pages_isolated()
  doc: fix a typo about irq affinity
  ...

Pull HID updates from Jiri Kosina:
 "Highlights:

   - conversion of HID subsystem to use devm-based resource management,
     from Benjamin Tissoires

   - i2c-hid support for DT bindings, from Benjamin Tissoires

   - much improved support for Win8-multitouch devices, from Benjamin
     Tissoires

   - cleanup of core code using common hidinput_input_event(), from
     David Herrmann

   - fix for bug in implement() access to the bit stream (causing oops)
     that has been present in the code for ages, but devices that are
     able to trigger it have started to appear only now, from Jiri
     Kosina

   - fixes for CVE-2013-2899, CVE-2013-2898, CVE-2013-2896,
     CVE-2013-2892, CVE-2013-2888 (all triggerable only by specially
     crafted malicious HW devices plugged into the system), from Kees
     Cook

   - hidraw oops fix, from Manoj Chourasia

   - various smaller fixes here and there, support for a bunch of new
     devices by various contributors"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (53 commits)
  HID: MAINTAINERS: add roccat drivers
  HID: hid-sensor-hub: change kmalloc + memcpy by kmemdup
  HID: hid-sensor-hub: move to devm_kzalloc
  HID: hid-sensor-hub: fix indentation accross the code
  HID: move HID_REPORT_TYPES closer to the report-definitions
  HID: check for NULL field when setting values
  HID: picolcd_core: validate output report details
  HID: sensor-hub: validate feature report details
  HID: ntrig: validate feature report details
  HID: pantherlord: validate output report details
  HID: hid-wiimote: print small buffers via %*phC
  HID: uhid: improve uhid example client
  HID: Correct the USB IDs for the new Macbook Air 6
  HID: wiimote: add support for Guitar-Hero guitars
  HID: wiimote: add support for Guitar-Hero drums
  Input: introduce BTN/ABS bits for drums and guitars
  HID: battery: don't do DMA from stack
  HID: roccat: add support for KonePureOptical v2
  HID: picolcd: Prevent NULL pointer dereference on _remove()
  HID: usbhid: quirk for N-Trig DuoSense Touch Screen
  ...

Pull ext3, reiserfs, udf & isofs fixes from Jan Kara:
 "The contains a bunch of ext3 cleanups and minor improvements, major
  reiserfs locking changes which should hopefully fix deadlocks
  introduced by BKL removal, and udf/isofs changes to refuse mounting fs
  rw instead of mounting it ro automatically which makes eject button
  work as expected for all media (see the changelog for why userspace
  should be ok with this change)"

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  jbd: use a single printk for jbd_debug()
  reiserfs: locking, release lock around quota operations
  reiserfs: locking, handle nested locks properly
  reiserfs: locking, push write lock out of xattr code
  jbd: relocate assert after state lock in journal_commit_transaction()
  udf: Refuse RW mount of the filesystem instead of making it RO
  udf: Standardize return values in mount sequence
  isofs: Refuse RW mount of the filesystem instead of making it RO
  ext3: allow specifying external journal by pathname mount option
  jbd: remove unneeded semicolon

Pull f2fs updates from Jaegeuk Kim:
 "This patch-set includes the following major enhancement patches:
   - support inline xattrs
   - add sysfs support to control GCs explicitly
   - add proc entry to show the current segment usage information
   - improve the GC/SSR performance

  The other bug fixes are as follows:
   - avoid the overflow on status calculation
   - fix some error handling routines
   - fix inconsistent xattr states after power-off-recovery
   - fix incorrect xattr node offset definition
   - fix deadlock condition in fsync
   - fix the fdatasync routine for power-off-recovery"

* tag 'for-f2fs-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (40 commits)
  f2fs: optimize gc for better performance
  f2fs: merge more bios of node block writes
  f2fs: avoid an overflow during utilization calculation
  f2fs: trigger GC when there are prefree segments
  f2fs: use strncasecmp() simplify the string comparison
  f2fs: fix omitting to update inode page
  f2fs: support the inline xattrs
  f2fs: add the truncate_xattr_node function
  f2fs: introduce __find_xattr for readability
  f2fs: reserve the xattr space dynamically
  f2fs: add flags for inline xattrs
  f2fs: fix error return code in init_f2fs_fs()
  f2fs: fix wrong BUG_ON condition
  f2fs: fix memory leak when init f2fs filesystem fail
  f2fs: fix a compound statement label error
  f2fs: avoid writing inode redundantly when creating a file
  f2fs: alloc_page() doesn't return an ERR_PTR
  f2fs: should cover i_xattr_nid with its xattr node page lock
  f2fs: check the free space first in new_node_page
  f2fs: clean up the needless end 'return' of void function
  ...

Conflicts:
	drivers/hid/hid-sensor-hub.c

Merge branches 'for-3.12/devm', 'for-3.12/i2c-hid', 'for-3.12/i2c-hid-dt', 'for-3.12/logitech', 'for-3.12/multitouch-win8', 'for-3.12/trasnport-driver-cleanup', 'for-3.12/uhid', 'for-3.12/upstream' and 'for-3.12/wiimote' into for-linus

Pull ARM updates from Russell King:
 "This set includes adding support for Neon acceleration of RAID6 XOR
  code from Ard Biesheuvel, cache flushing and barrier updates from Will
  Deacon, and a cleanup to the ARM debug code which reduces the amount
  of code by about 500 lines.

  A few other cleanups, such as constifying the machine descriptors
  which already shouldn't be written to, cleaning up the printing of the
  L2 cache size"

* 'for-linus' of git://git.linaro.org/people/rmk/linux-arm: (55 commits)
  ARM: 7826/1: debug: support debug ll on hisilicon soc
  ARM: 7830/1: delay: don't bother reporting bogomips in /proc/cpuinfo
  ARM: 7829/1: Add ".text.unlikely" and ".text.hot" to arm unwind tables
  ARM: 7828/1: ARMv7-M: implement restart routine common to all v7-M machines
  ARM: 7827/1: highbank: fix debug uart virtual address for LPAE
  ARM: 7823/1: errata: workaround Cortex-A15 erratum 773022
  ARM: 7806/1: allow DEBUG_UNCOMPRESS for Tegra
  ARM: 7793/1: debug: use generic option for ep93xx PL10x debug port
  ARM: debug: move SPEAr debug to generic PL01x code
  ARM: debug: move davinci debug to generic 8250 code
  ARM: debug: move keystone debug to generic 8250 code
  ARM: debug: remove DEBUG_ROCKCHIP_UART
  ARM: debug: provide generic option choices for 8250 and PL01x ports
  ARM: debug: move PL01X debug include into arch/arm/include/debug/
  ARM: debug: provide PL01x debug uart phys/virt address configuration options
  ARM: debug: add support for word accesses to debug/8250.S
  ARM: debug: move 8250 debug include into arch/arm/include/debug/
  ARM: debug: provide 8250 debug uart phys/virt address configuration options
  ARM: debug: provide 8250 debug uart register shift configuration option
  ARM: debug: provide 8250 debug uart flow control configuration option
  ...

Merge commit 06c54055 did a bad conflict resolution accidentally
leaving out a closing brace.  Add it back.

This breaks a handful of defconfigs on ARM, so it'd be good to see it
applied pretty quickly.
Signed-off-by: Olof Johansson <olof@lixom.net>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull IDE changes from David Miller:
 "Mostly cleanups, and changes part of tree-wide adjustments, this code
  is in deep freeze so that's pretty much what we expect these days"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/ide:
  ide: sgiioc4: Staticize ioc4_ide_attach_one()
  ide: palm_bk3710: add missing __iomem annotation
  ide: use dev_get_platdata()
  ide-disk_proc: use macro to replace magic number
  ide: replace strict_strtol() with kstrtol()

Pull sparc changes from David Miller:
 "Several bug fixes (from Kirill Tkhai, Geery Uytterhoeven, and Alexey
  Dobriyan) and some support for Fujitsu sparc64x chips (from Allen
  Pais)"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
  sparc64: Export flush_ptrace_access() (needed by lustre)
  sparc: fix PCI device proc file mmap(2)
  sparc64: Remove RWSEM export leftovers
  sparc64: Fix off by one in trampoline TLB mapping installation loop.
  sparc64: Fix ITLB handler of null page
  esp_scsi: Fix tag state corruption when autosensing.
  sparc64: Fix not SRA'ed %o5 in 32-bit traced syscall
  sparc64: cleanup: Rename ret_from_syscall to ret_from_fork
  sparc32: Fix exit flag passed from traced sys_sigreturn
  sparc64: Fix wrong syscall return value passed to trace_sys_exit()
  support sparc64x chip type in cpumap.c
  cpu hw caps support for sparc64x

Pull networking changes from David Miller:
 "Noteworthy changes this time around:

   1) Multicast rejoin support for team driver, from Jiri Pirko.

   2) Centralize and simplify TCP RTT measurement handling in order to
      reduce the impact of bad RTO seeding from SYN/ACKs.  Also, when
      both timestamps and local RTT measurements are available prefer
      the later because there are broken middleware devices which
      scramble the timestamp.

      From Yuchung Cheng.

   3) Add TCP_NOTSENT_LOWAT socket option to limit the amount of kernel
      memory consumed to queue up unsend user data.  From Eric Dumazet.

   4) Add a "physical port ID" abstraction for network devices, from
      Jiri Pirko.

   5) Add a "suppress" operation to influence fib_rules lookups, from
      Stefan Tomanek.

   6) Add a networking development FAQ, from Paul Gortmaker.

   7) Extend the information provided by tcp_probe and add ipv6 support,
      from Daniel Borkmann.

   8) Use RCU locking more extensively in openvswitch data paths, from
      Pravin B Shelar.

   9) Add SCTP support to openvswitch, from Joe Stringer.

  10) Add EF10 chip support to SFC driver, from Ben Hutchings.

  11) Add new SYNPROXY netfilter target, from Patrick McHardy.

  12) Compute a rate approximation for sending in TCP sockets, and use
      this to more intelligently coalesce TSO frames.  Furthermore, add
      a new packet scheduler which takes advantage of this estimate when
      available.  From Eric Dumazet.

  13) Allow AF_PACKET fanouts with random selection, from Daniel
      Borkmann.

  14) Add ipv6 support to vxlan driver, from Cong Wang"

Resolved conflicts as per discussion.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1218 commits)
  openvswitch: Fix alignment of struct sw_flow_key.
  netfilter: Fix build errors with xt_socket.c
  tcp: Add missing braces to do_tcp_setsockopt
  caif: Add missing braces to multiline if in cfctrl_linkup_request
  bnx2x: Add missing braces in bnx2x:bnx2x_link_initialize
  vxlan: Fix kernel panic on device delete.
  net: mvneta: implement ->ndo_do_ioctl() to support PHY ioctls
  net: mvneta: properly disable HW PHY polling and ensure adjust_link() works
  icplus: Use netif_running to determine device state
  ethernet/arc/arc_emac: Fix huge delays in large file copies
  tuntap: orphan frags before trying to set tx timestamp
  tuntap: purge socket error queue on detach
  qlcnic: use standard NAPI weights
  ipv6:introduce function to find route for redirect
  bnx2x: VF RSS support - VF side
  bnx2x: VF RSS support - PF side
  vxlan: Notify drivers for listening UDP port changes
  net: usbnet: update addr_assign_type if appropriate
  driver/net: enic: update enic maintainers and driver
  driver/net: enic: Exposing symbols for Cisco's low latency driver
  ...

sw_flow_key alignment was declared as " __aligned(__alignof__(long))".
However, this breaks on the m68k architecture where long is 32 bit in
size but 16 bit aligned by default. This aligns to the size of a long to
ensure that we can always do comparsions in full long-sized chunks. It
also adds an additional build check to catch any reduction in alignment.

CC: Andy Zhou <azhou@nicira.com>
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Jesse Gross <jesse@nicira.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull cputime fix from Ingo Molnar:
 "This fixes a longer-standing cputime accounting bug that Stanislaw
  Gruszka finally managed to track down"

* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/cputime: Do not scale when utime == 0

Pull x86 fixes from Ingo Molnar:
 "Fix for the annoying paravirt.o build warning under allmodconfig, and
  a MAINTAINERS file update"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86, doc: Add an entry in MAINTAINERS for arch/x86/kernel/cpu/vmware.c
  x86, paravirt: Remove duplicate definition for DEF_NATIVE

ioc4_ide_attach_one() is used only in this file.
Fix the following sparse warnings:

drivers/ide/sgiioc4.c:603:5: warning: symbol 'ioc4_ide_attach_one' was not declared. Should it be static?
Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Added missing __iomem annotation in order to fix the following
sparse warnings:

drivers/ide/palm_bk3710.c:194:31: warning: incorrect type in initializer (different address spaces)
drivers/ide/palm_bk3710.c:194:31:    expected void [noderef] <asn:2>*base
drivers/ide/palm_bk3710.c:194:31:    got void *<noident>
drivers/ide/palm_bk3710.c:212:31: warning: incorrect type in initializer (different address spaces)
drivers/ide/palm_bk3710.c:212:31:    expected void [noderef] <asn:2>*base
drivers/ide/palm_bk3710.c:212:31:    got void *<noident>
Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Use the wrapper function for retrieving the platform data instead of
accessing dev->platform_data directly.
Signed-off-by: Jingoo Han <jg1.han@samsung.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Xinghai Yu <yuxinghai@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>