I was chasing down a bug of random validity intercepts on s390.
(guest prefix page not mapped in the host virtual aspace). Turns out
that the problem was a wrong address space control element. The
cause was quite complex:

During paging activity a DAT protection during SIE caused a program
interrupt. Normally, the sie retry loop tries to catch all
interrupts during and shortly before sie to rerun the setup. The
problem is now that protection causes a suppressing program interrupt,
causing the PSW to point to the instruction AFTER SIE in case of DAT
protection. This confused the logic of the retry loop to not trigger,
instead we jumped directly back to SIE after return from
the program  interrupt. (the protection fault handler itself did
a rewind of the psw). This usually works quite well, but:

If now the protection fault handler has to wait, another program
might be scheduled in. Later on the sie process will be schedules
in again. In that case the content of CR1 (primary address space)
will be wrong because switch_to will put the user space ASCE into CR1
and not the guest ASCE.

In addition the program parameter is also wrong for every protection
fault of a guest, since we dont issue the SPP instruction.

So lets also check for PSW == instruction after SIE in the program
check handler. Instead of expensively checking all program
interruption codes that might be suppressing we assume that a program
interrupt pointing after SIE was always a program interrupt in SIE.
(Otherwise we have a kernel bug anyway).

We also have to compensate the rewinding, since the C-level handlers
will do that. Therefore we need to add a nop with the same length
as SIE before the sie_loop.
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
CC: stable@vger.kernel.org
CC: Heiko Carstens <heiko.carstens@de.ibm.com>

The current single step code is racy in regard to concurrent delivery
of signals. If a signal is delivered after a PER program check occurred
but before the TIF_PER_TRAP bit has been checked in entry[64].S the code
clears TIF_PER_TRAP and then calls do_signal. This is wrong, if the
instruction completed (or has been suppressed) a SIGTRAP should be
delivered to the debugger in any case. Only if the instruction has been
nullified the SIGTRAP may not be send.

The new logic always sets TIF_PER_TRAP if the program check indicates PER
tracing but removes it again for all program checks that are nullifying.
The effect is that for each change in the PSW address we now get a
single SIGTRAP.
Reported-by: Andreas Arnez <arnez@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>

Allow to generate code that only runs on zEC12 machines.

Also add a check which prevents the kernel to run on machines which
do not have any of the following new facilities installed:

- (48) decimal-floating-point zoned-conversion
- (49) execution-hint
- (49) load-and-trap
- (49) miscellaneous-instruction-extensions
- (49) processor-assist
- (50) constrained transactional-execution
- (73) transactional-execution

48, 49, 50 and 73 are the bit numbers of the facility indications for
each of the required facilities.

Note that we assume that user-space gets compiled with the same
compiler options, therefore we also test for a dfp facility even
if the kernel doesn't make use of it.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>

Mainly merge all different per-cpu arrays into a single array which
holds all topology information per logical cpu.
Also fix the broken core vs socket variable naming and simplify the
locking a bit.
When running in environments without topology information also
invent book, socket and core ids, so that not all ids are zero.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Keep related functions together and move to appropriate file.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Move and rename init_storage_keys() to pageattr.c, so it can also be
used from the sclp memory hotplug code in order to initialize
storage keys.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

The message request handling (type50 - clear key) for RSA operations
(in CRT format) are now handled correctly with respect to the crb
format container.
Signed-off-by: Ingo Tuchscherer <ingo.tuchscherer@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Just convert fault_init() to an early initcall. That's still early
enough since it only needs be called before user space processes get
executed. No reason to externalize it.
Also add the function to the init section and move the store_indication
variable to the read_mostly section.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Let the dasd driver and qdio use ccw_device_get_schid and
get rid of other similar functions.
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

This will be needed by the new virtio-ccw transport.
Signed-off-by: Cornelia Huck <cornelia.huck@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Remove the BUG_ON's that check for failure or incomplete
results of the s390 hardware crypto instructions.
Rather report the errors as -EIO to the crypto layer.
Signed-off-by: Jan Glauber <jang@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Remove or replace BUG/BUG_ON where possible and convert WARN_ON
to WARN_ON_ONCE if they can occur freqeuently as pointed out by:
https://lkml.org/lkml/2012/9/27/461

Checks have been removed if:
- the error condition leads to a hardware error which gets logged
  and in most cases stops the device
- the error condition is a null pointer access
- the error condition is just pointless or already handled at
  another location
Signed-off-by: Jan Glauber <jang@linux.vnet.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Do not use more than one KERN_<level> per printk.
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Acked-by: Stefan Haberland <stefan.haberland@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Preinitialize the program check table, so we can put it into the
read-only data section.
Also use only four byte entries for the table, since each program
check handler resides within the first 2GB. Therefore this reduces
the size of the table by 50% on 64 bit builds.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Use 1MB frames for vmemmap if EDAT1 is available in order to
reduce TLB pressure
Always use a 1MB frame even if its only partially needed for
struct pages. Otherwise we would end up with a mix of large
frame and page mappings, because vmemmap_populate gets called
for each section (256MB -> 3.5MB memmap) separately.
Worst case is that we would waste 512KB.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Use 2GB frames for indentity mapping if EDAT2 is
available to reduce TLB pressure.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Pull input updates from Dmitry Torokhov:
 "This fixes recent regression where /dev/input/mice got assigned wrong
  device node which messed up setups with static /dev, and a regression
  in ads7846 GPIO debounce setup."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  ARM - OMAP: ads7846: fix pendown debounce setting
  Input: ads7846 - enable pendown GPIO debounce time setting
  Input: mousedev - move /dev/input/mice to the correct minor
  Input: MT - document new 'flags' argument of input_mt_init_slots()

Pull ARM SoC fixes from Olof Johansson:
 "A few more fixes for final 3.7.  Two dealing with pinmux setup on
  OMAP, and one dealing with TV output on DaVinci.  And one small
  MAINTAINER update."

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: davinci: dm644x: fix out range signal for ED
  ARM: OMAP4: TWL: mux sys_drm_msecure as output for PMIC
  ARM: OMAP3: igep0020: Set WIFI/BT GPIO pins in correct mux mode
  ARM: OMAP: Add maintainer entry for IGEP machines

Pull PARISC fixes from James Bottomley:
 "This is two bug fixes: one fixes a loophole where rt_sigprocmask()
  with the wrong values panics the box (Denial of Service) and the other
  fixes an aliasing problem with get_shared_area() which could cause
  data corruption.

  Signed-off-by: James Bottomley <JBottomley@Parallels.com>"

* tag 'parisc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/parisc-2.6:
  [PARISC] fix user-triggerable panic on parisc
  [PARISC] fix virtual aliasing issue in get_shared_area()

Pull SCSI fixes from James Bottomley:
 "This is a set of four bug fixes.

  The isci one is an obvious thinko (using request buffer instead of
  response buffer) which causes a command to fail.

  The three others are DIF/DIX updates which are required because
  they're part of a series of ten patches, the other seven of which went
  into the block layer during the merge window meaning our current
  DIF/DIX implementation is broken without these three.

  Signed-off-by: James Bottomley <JBottomley@Parallels.com>"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  [SCSI] sd: Implement support for WRITE SAME
  [SCSI] sd: Permit merged discard requests
  [SCSI] Add a report opcode helper
  [SCSI] isci: copy fis 0x34 response into proper buffer

Pull drm fixes from Dave Airlie.

Small fixes for (mostly Nouveau, some radeon) regressions.

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/nouveau: use the correct fence implementation for nv50
  drm/radeon: add new SI pci id
  radeon: add AGPMode 1 quirk for RV250
  drm/radeon: properly track the crtc not_enabled case evergreen_mc_stop()
  drm/nouveau/bios: fix DCB v1.5 parsing
  drm/nouveau: add missing pll_calc calls
  drm/nouveau: fix crash with noaccel=1
  drm/nv40: allocate ctxprog with kmalloc
  drm/nvc0/disp: fix thinko in vblank regression fix..

int sys32_rt_sigprocmask(int how, compat_sigset_t __user *set, compat_sigset_t __user *oset,
                                    unsigned int sigsetsize)
{
        sigset_t old_set, new_set;
        int ret;

        if (set && get_sigset32(set, &new_set, sigsetsize))

...
static int
get_sigset32(compat_sigset_t __user *up, sigset_t *set, size_t sz)
{
        compat_sigset_t s;
        int r;

        if (sz != sizeof *set) panic("put_sigset32()");

In other words, rt_sigprocmask(69, (void *)69, 69) done by 32bit process
will promptly panic the box.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Cc: <stable@vger.kernel.org>
Signed-off-by: James Bottomley <JBottomley@Parallels.com>

Alex writes:
A couple more small fixes for 3.7:
- another evergreen_mc fix
- add an AGP quirk for an old RV250
- new pci id.

* 'drm-fixes-3.7' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: add new SI pci id
  radeon: add AGPMode 1 quirk for RV250
  drm/radeon: properly track the crtc not_enabled case evergreen_mc_stop()

Merge branch 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes

nouveau: one more regression fix.

* 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
  drm/nouveau: use the correct fence implementation for nv50

Merge branch 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes

Some more misc fallout from nouveau rework.

* 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
  drm/nouveau/bios: fix DCB v1.5 parsing
  drm/nouveau: add missing pll_calc calls
  drm/nouveau: fix crash with noaccel=1
  drm/nv40: allocate ctxprog with kmalloc
  drm/nvc0/disp: fix thinko in vblank regression fix..

Only compile time tested, noticed nv50_fence_create was never used,
so fix this. This will probably fix vblank on nv50 cards.

Hopefully this is still in time for 3.7 final release.
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

There have been some 3.7-rc reports of vm issues, including some kswapd
bugs and, more importantly, some memory "leaks":

	http://www.spinics.net/lists/linux-mm/msg46187.html
	https://bugzilla.kernel.org/show_bug.cgi?id=50181

Commit 1fb3f8ca ("mm: compaction: capture a suitable high-order page
immediately when it is made available") took split_free_page() and
reused it for the compaction code.  It does something curious with
capture_free_page() (previously known as split_free_page()):

  int capture_free_page(struct page *page, int alloc_order,
  ...
          __mod_zone_page_state(zone, NR_FREE_PAGES, -(1UL << order));

  -       /* Split into individual pages */
  -       set_page_refcounted(page);
  -       split_page(page, order);
  +       if (alloc_order != order)
  +               expand(zone, page, alloc_order, order,
  +                       &zone->free_area[order], migratetype);

Note that expand() puts the pages _back_ in the allocator, but it does
not bump NR_FREE_PAGES.  We "return" 'alloc_order' worth of pages, but
we accounted for removing 'order' in the __mod_zone_page_state() call.

For the old split_page()-style use (order==alloc_order) the bug will not
trigger.  But, when called from the compaction code where we
occasionally get a larger page out of the buddy allocator than we need,
we will run in to this.

This patch simply changes the NR_FREE_PAGES manipulation to the correct
'alloc_order' instead of 'order'.

I've been able to repeatedly trigger this in my testing environment.
The amount "leaked" very closely tracks the imbalance I see in buddy
pages vs.  NR_FREE_PAGES.  I have confirmed that this patch fixes the
imbalance
Signed-off-by: Dave Hansen <dave@linux.vnet.ibm.com>
Acked-by: Mel Gorman <mgorman@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull networking updates from David Miller:

 1) inet6_csk_update_pmtu() must return NULL or non-NULL, so translate
    ERR_PTR to NULL, as needed.  Fix from Eric Dumazet.

 2) Fix copy&paste error in IRDA sir_dev ->set_speed method invocation,
    it was testing the NULL'ness of a different method to guard the
    call.  Fix from Alexander Shiyan.

 3) Fix build regression of xilinx driver, from Jeff Mahoney.

 4) Make XEN netfront (like XEN netback) handle compound pages in SKBs
    properly.  From Ian Campbell.

 5) Fix inverted logic of team_dev_queue_xmit() return value checks,
    from Jiri Pirko and Dan Carpenter.

 6) dma_poll_create() no longer allows a NULL device argument, breaking
    both ixp4xx drivers.  Fix from Xi Wang.

 7) ne2000 driver doesn't hook up the parent device properly, breaking
    udev matching.  Fix from Alan Cox.

 8) Locking and memory leak fixes in Near Field Communications layer.
    From Thierry Escande, Szymon Janc, and Waldemar Rymarkiewicz.

 9) sis900 resume regression, sis900_set_mode() is being called with the
    iomem pointer instead of the expected device private.  Fix from
    Francois Romieu.

10) Fix IBSS regression caused by uninitializing the ibss-internals
    before performing an emptyness check, from Simon WUnderlich.

11) Fix SNIFFER mode regression in iwlwifi driver, from Johannes Berg.

12) Fix task wedges in mwifiex_cmd_timeout_func(), from Bing Zhao.

13) Add back wireless sysfs directory, too much stuff depends upon it
    being there (actually I'd say it never should have been removed to
    begin with).  From Johannes Berg.

14) Fix hang introduced by suspend/resume changes in ath9k.  Fix from
    Sujith Manoharan.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (24 commits)
  team: bcast: convert return value of team_dev_queue_xmit() to bool correctly
  bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices.
  xen/netfront: handle compound page fragments on transmit
  net: fix build failure in xilinx
  irda: sir_dev: Fix copy/paste typo
  ipv6: fix inet6_csk_update_pmtu() return value
  ixp4xx_hss: avoid calling dma_pool_create() with NULL dev
  ixp4xx_eth: avoid calling dma_pool_create() with NULL dev
  ne2000: add the right platform device
  of/net/mdio-gpio: Fix pdev->id issue when using devicetrees.
  NFC: Fix pn533 target mode memory leak
  NFC: pn533: Fix mem leak in pn533_in_dep_link_up
  NFC: pn533: Fix use after free
  NFC: pn533: Fix missing lock while operating on commands list
  NFC: Fix nfc_llcp_local chained list insertion
  ath9k_hw: Fix regression in device reset
  sis900: fix sis900_set_mode call parameters.
  iwlwifi: don't WARN when a non empty queue is disabled
  wireless: add back sysfs directory
  mwifiex: report error to MMC core if we cannot suspend
  ...

Merge tag 'omap-for-v3.7-rc5/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes

From Tony Lindgren:
Few more regression fixes related to u-boot only muxing
essential pins.

* tag 'omap-for-v3.7-rc5/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: OMAP4: TWL: mux sys_drm_msecure as output for PMIC
  ARM: OMAP3: igep0020: Set WIFI/BT GPIO pins in correct mux mode
  ARM: OMAP: Add maintainer entry for IGEP machines

Commit 97ee9f01 (ARM: OMAP: fix the ads7846 init code) have enabled the
pendown GPIO debounce time setting by the below sequence:

  gpio_request_one()
  gpio_set_debounce()
  gpio_free()

It also revealed a bug in the OMAP GPIO handling code which prevented
the GPIO debounce clock to be disabled and CORE transition to low power
states.

Commit c9c55d92 (gpio/omap: fix off-mode bug: clear debounce settings on
free/reset) fixes the OMAP GPIO handling code by making sure that the
GPIO debounce clock gets disabled if no GPIO is requested from current
bank.

While fixing the OMAP GPIO handling code (in the right way), the above
commit makes the gpio_request->set_debounce->free sequence invalid as
after freeing the GPIO, the debounce settings are lost.

Fix the debounce settings by moving the debounce initialization to the
actual GPIO requesting code - the ads7846 driver.
Signed-off-by: Igor Grinberg <grinberg@compulab.co.il>
Acked-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

Some platforms need the pendown GPIO debounce time setting programmed.
Since the pendown GPIO is handled by the driver, the debounce time
should also be handled along with the pendown GPIO request.
Signed-off-by: Igor Grinberg <grinberg@compulab.co.il>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

The thing is that team_dev_queue_xmit() returns NET_XMIT_* or -E*.
bc_trasmit() should return true in case all went well. So use ! to get
correct retval from team_dev_queue_xmit() result.
This bug caused iface statistics to be badly computed.

This bug was introduced by:
team: add broadcast mode (5fc88991)
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge tag 'pinctrl-for-v3.7-late' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pinctrl fix from Linus Walleij:
 "A simple pinctrl Kconfig oneliner arriving late.

  Final (hopefully) oneliner for the pinctrl subsystem targeted at v3.7"

* tag 'pinctrl-for-v3.7-late' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl/samsung: don't allow enabling pinctrl-samsung standalone

Pull selinux RCU fixlet from James Morris.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  selinux: fix sel_netnode_insert() suspicious rcu dereference

There have the following warning message when running modules install
for sign ko files:

  # make modules_install
  ...
    INSTALL drivers/input/touchscreen/pcap_ts.ko
  Found = in conditional, should be == at scripts/sign-file line 164.
  Found = in conditional, should be == at scripts/sign-file line 161.
  Found = in conditional, should be == at scripts/sign-file line 159.

This patch change replace '=' by '==' in elsif conditions for avoid the
above warning messages.
Signed-off-by: Chun-Yi Lee <jlee@suse.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Patch sets the lowest gso_max_size and gso_max_segs values of the slave devices during enslave and detach.
Signed-off-by: Sarveshwar Bandi <sarveshwar.bandi@emulex.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

An SKB paged fragment can consist of a compound page with order > 0.
However the netchannel protocol deals only in PAGE_SIZE frames.

Handle this in xennet_make_frags by iterating over the frames which
make up the page.

This is the netfront equivalent to 6a8ed462 for netback.
Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
Cc: netdev@vger.kernel.org
Cc: xen-devel@lists.xen.org
Cc: Eric Dumazet <edumazet@google.com>
Cc: Konrad Rzeszutek Wilk <konrad@kernel.org>
Cc: ANNIE LI <annie.li@oracle.com>
Cc: Sander Eikelenboom <linux@eikelenboom.it>
Cc: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

John W. Linville says:

====================
This is a batch of fixes intended for 3.7...

Included are two pulls.  Regarding the mac80211 tree, Johannes says:

"Please pull my mac80211.git tree (see below) to get two more fixes for
3.7. Both fix regressions introduced *before* this cycle that weren't
noticed until now, one for IBSS not cleaning up properly and the other
to add back the "wireless" sysfs directory for Fedora's startup scripts."

Regarding the iwlwifi tree, Johannes says:

"Please also pull my iwlwifi.git tree, I have two fixes: one to remove a
spurious warning that can actually trigger in legitimate situations, and
the other to fix a regression from when monitor mode was changed to use
the "sniffer" firmware mode."

Also included is an nfc tree pull.  Samuel says:

"We mostly have pn533 fixes here, 2 memory leaks and an early unlocking fix.
Moreover, we also have an LLCP adapter linked list insertion fix."

On top of that, a few more bits...  Albert Pool adds a USB ID
to rtlwifi.  Bing Zhao provides two mwifiex fixes -- one to fix
a system hang during a command timeout, and the other to properly
report a suspend error to the MMC core.  Finally, Sujith Manoharan
fixes a thinko that would trigger an ath9k hang during device reset.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>