mm: thp: refix false positive BUG in page_move_anon_rmap()

The VM_BUG_ON_PAGE in page_move_anon_rmap() is more trouble than it's
worth: the syzkaller fuzzer hit it again.  It's still wrong for some THP
cases, because linear_page_index() was never intended to apply to
addresses before the start of a vma.

That's easily fixed with a signed long cast inside linear_page_index();
and Dmitry has tested such a patch, to verify the false positive.  But
why extend linear_page_index() just for this case? when the avoidance in
page_move_anon_rmap() has already grown ugly, and there's no reason for
the check at all (nothing else there is using address or index).

Remove address arg from page_move_anon_rmap(), remove VM_BUG_ON_PAGE,
remove CONFIG_DEBUG_VM PageTransHuge adjustment.

And one more thing: should the compound_head(page) be done inside or
outside page_move_anon_rmap()? It's usually pushed down to the lowest
level nowadays (and mm/memory.c shows no other explicit use of it), so I
think it's better done in page_move_anon_rmap() than by caller.

Fixes: 0798d3c022dc ("mm: thp: avoid false positive VM_BUG_ON_PAGE in page_move_anon_rmap()")
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Hugh Dickins <[email protected]>
Reported-by: Dmitry Vyukov <[email protected]>
Acked-by: Kirill A. Shutemov <[email protected]>
Cc: Mika Westerberg <[email protected]>
Cc: Andrea Arcangeli <[email protected]>
Cc: Rik van Riel <[email protected]>
Cc: <[email protected]> [4.5+]
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

mm: rmap: call page_check_address() with sync enabled to avoid racy check

The previous patch addresses the race between split_huge_pmd_address()
and someone changing the pmd.  The fix is only for splitting of normal
thp (i.e.  pmd-mapped thp,) and for splitting of pte-mapped thp there
still is the similar race.

For splitting pte-mapped thp, the pte's conversion is done by
try_to_unmap_one(TTU_MIGRATION).  This function checks
page_check_address() to get the target pte, but it can return NULL under
some race, leading to VM_BUG_ON() in freeze_page().  Fortunately,
page_check_address() already has an argument to decide whether we do a
quick/racy check or not, so let's flip it when called from
freeze_page().

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Naoya Horiguchi <[email protected]>
Cc: Kirill A. Shutemov <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

mm: thp: move pmd check inside ptl for freeze_page()

I found a race condition triggering VM_BUG_ON() in freeze_page(), when
running a testcase with 3 processes:
  - process 1: keep writing thp,
  - process 2: keep clearing soft-dirty bits from virtual address of process 1
  - process 3: call migratepages for process 1,

The kernel message is like this:

  kernel BUG at /src/linux-dev/mm/huge_memory.c:3096!
  invalid opcode: 0000 [#1] SMP
  Modules linked in: cfg80211 rfkill crc32c_intel ppdev serio_raw pcspkr virtio_balloon virtio_console parport_pc parport pvpanic acpi_cpufreq tpm_tis tpm i2c_piix4 virtio_blk virtio_net ata_generic pata_acpi floppy virtio_pci virtio_ring virtio
  CPU: 0 PID: 28863 Comm: migratepages Not tainted 4.6.0-v4.6-160602-0827-+ #2
  Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
  task: ffff880037320000 ti: ffff88007cdd0000 task.ti: ffff88007cdd0000
  RIP: 0010:[<ffffffff811f8e06>]  [<ffffffff811f8e06>] split_huge_page_to_list+0x496/0x590
  RSP: 0018:ffff88007cdd3b70  EFLAGS: 00010202
  RAX: 0000000000000001 RBX: ffff88007c7b88c0 RCX: 0000000000000000
  RDX: 0000000000000000 RSI: 0000000700000200 RDI: ffffea0003188000
  RBP: ffff88007cdd3bb8 R08: 0000000000000001 R09: 00003ffffffff000
  R10: ffff880000000000 R11: ffffc000001fffff R12: ffffea0003188000
  R13: ffffea0003188000 R14: 0000000000000000 R15: 0400000000000080
  FS:  00007f8ec241d740(0000) GS:ffff88007dc00000(0000) knlGS:0000000000000000             CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 00007f8ec1f3ed20 CR3: 000000003707b000 CR4: 00000000000006f0
  Call Trace:
    ? list_del+0xd/0x30
    queue_pages_pte_range+0x4d1/0x590
    __walk_page_range+0x204/0x4e0
    walk_page_range+0x71/0xf0
    queue_pages_range+0x75/0x90
    ? queue_pages_hugetlb+0x190/0x190
    ? new_node_page+0xc0/0xc0
    ? change_prot_numa+0x40/0x40
    migrate_to_node+0x71/0xd0
    do_migrate_pages+0x1c3/0x210
    SyS_migrate_pages+0x261/0x290
    entry_SYSCALL_64_fastpath+0x1a/0xa4
  Code: e8 b0 87 fb ff 0f 0b 48 c7 c6 30 32 9f 81 e8 a2 87 fb ff 0f 0b 48 c7 c6 b8 46 9f 81 e8 94 87 fb ff 0f 0b 85 c0 0f 84 3e fd ff ff <0f> 0b 85 c0 0f 85 a6 00 00 00 48 8b 75 c0 4c 89 f7 41 be f0 ff
  RIP   split_huge_page_to_list+0x496/0x590

I'm not sure of the full scenario of the reproduction, but my debug
showed that split_huge_pmd_address(freeze=true) returned without running
main code of pmd splitting because pmd_present(*pmd) in precheck somehow
returned 0.  If this happens, the subsequent try_to_unmap() fails and
returns non-zero (because page_mapcount() still > 0), and finally
VM_BUG_ON() fires.  This patch tries to fix it by prechecking pmd state
inside ptl.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Naoya Horiguchi <[email protected]>
Signed-off-by: Kirill A. Shutemov <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

vmlinux.lds: account for destructor sections

If CONFIG_KASAN is enabled and gcc is configured with
--disable-initfini-array and/or gold linker is used, gcc emits
.ctors/.dtors and .text.startup/.text.exit sections instead of
.init_array/.fini_array.  .dtors section is not explicitly accounted in
the linker script and messes vvar/percpu layout.

We want:
  ffffffff822bfd80 D _edata
  ffffffff822c0000 D __vvar_beginning_hack
  ffffffff822c0000 A __vvar_page
  ffffffff822c0080 0000000000000098 D vsyscall_gtod_data
  ffffffff822c1000 A __init_begin
  ffffffff822c1000 D init_per_cpu__irq_stack_union
  ffffffff822c1000 A __per_cpu_load
  ffffffff822d3000 D init_per_cpu__gdt_page

We got:
  ffffffff8279a600 D _edata
  ffffffff8279b000 A __vvar_page
  ffffffff8279c000 A __init_begin
  ffffffff8279c000 D init_per_cpu__irq_stack_union
  ffffffff8279c000 A __per_cpu_load
  ffffffff8279e000 D __vvar_beginning_hack
  ffffffff8279e080 0000000000000098 D vsyscall_gtod_data
  ffffffff827ae000 D init_per_cpu__gdt_page

This happens because __vvar_page and .vvar get different addresses in
arch/x86/kernel/vmlinux.lds.S:

. = ALIGN(PAGE_SIZE);
__vvar_page = .;

.vvar : AT(ADDR(.vvar) - LOAD_OFFSET) {
/* work around gold bug 13023 */
__vvar_beginning_hack = .;

Discard .dtors/.fini_array/.text.exit, since we don't call dtors.
Merge .text.startup into init text.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Dmitry Vyukov <[email protected]>
Reviewed-by: Andrey Ryabinin <[email protected]>
Cc: <[email protected]> [4.0+]
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

gcov: add support for gcc version >= 6

Link: http://lkml.kernel.org/r/20160701130914.GA23225@styxhp
Signed-off-by: Florian Meier <[email protected]>
Reviewed-by: Peter Oberparleiter <[email protected]>
Tested-by: Peter Oberparleiter <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

mm, meminit: ensure node is online before checking whether pages are uninitialised

early_page_uninitialised looks up an arbitrary PFN.  While a machine
without node 0 will boot with "mm, page_alloc: Always return a valid
node from early_pfn_to_nid", it works because it assumes that nodes are
always in PFN order.  This is not guaranteed so this patch adds
robustness by always checking if the node being checked is online.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Mel Gorman <[email protected]>
Acked-by: David Rientjes <[email protected]>
Cc: <[email protected]> [4.2+]
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

mm, meminit: always return a valid node from early_pfn_to_nid

early_pfn_to_nid can return node 0 if a PFN is invalid on machines that
has no node 0.  A machine with only node 1 was observed to crash with
the following message:

   BUG: unable to handle kernel paging request at 000000000002a3c8
   PGD 0
   Modules linked in:
   Hardware name: Supermicro H8DSP-8/H8DSP-8, BIOS 080011  06/30/2006
   task: ffffffff81c0d500 ti: ffffffff81c00000 task.ti: ffffffff81c00000
   RIP: reserve_bootmem_region+0x6a/0xef
   CR2: 000000000002a3c8 CR3: 0000000001c06000 CR4: 00000000000006b0
   Call Trace:
      free_all_bootmem+0x4b/0x12a
      mem_init+0x70/0xa3
      start_kernel+0x25b/0x49b

The problem is that early_page_uninitialised uses the early_pfn_to_nid
helper which returns node 0 for invalid PFNs.  No caller of
early_pfn_to_nid cares except early_page_uninitialised.  This patch has
early_pfn_to_nid always return a valid node.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Mel Gorman <[email protected]>
Acked-by: David Rientjes <[email protected]>
Cc: <[email protected]> [4.2+]
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

kasan/quarantine: fix bugs on qlist_move_cache()

There are two bugs on qlist_move_cache().  One is that qlist's tail
isn't set properly.  curr->next can be NULL since it is singly linked
list and NULL value on tail is invalid if there is one item on qlist.
Another one is that if cache is matched, qlist_put() is called and it
will set curr->next to NULL.  It would cause to stop the loop
prematurely.

These problems come from complicated implementation so I'd like to
re-implement it completely.  Implementation in this patch is really
simple.  Iterate all qlist_nodes and put them to appropriate list.

Unfortunately, I got this bug sometime ago and lose oops message.  But,
the bug looks trivial and no need to attach oops.

Fixes: 55834c59098d ("mm: kasan: initial memory quarantine implementation")
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Joonsoo Kim <[email protected]>
Reviewed-by: Dmitry Vyukov <[email protected]>
Acked-by: Andrey Ryabinin <[email protected]>
Acked-by: Alexander Potapenko <[email protected]>
Cc: Kuthonuzo Luruo <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

uapi: export lirc.h header

This header contains the userspace API for lirc.

This is a fixup for commit b7be755733dc ("[media] bz#75751: Move
internal header file lirc.h to uapi/").  It moved the header to the
right place, but it forgot to add it at Kbuild.  So, despite being at
uapi, it is not copied to the right place.

Fixes: b7be755733dc44c72 ("[media] bz#75751: Move internal header file lirc.h to uapi/")
Link: http://lkml.kernel.org/r/320c765d32bfc82c582e336d52ffe1026c73c644.1468439021.git.mchehab@s-opensource.com
Signed-off-by: Mauro Carvalho Chehab <[email protected]>
Cc: Alec Leamas <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

madvise_free, thp: fix madvise_free_huge_pmd return value after splitting

madvise_free_huge_pmd should return 0 if the fallback PTE operations are
required.  In madvise_free_huge_pmd, if part pages of THP are discarded,
the THP will be split and fallback PTE operations should be used if
splitting succeeds.  But the original code will make fallback PTE
operations skipped, after splitting succeeds.  Fix that via make
madvise_free_huge_pmd return 0 after splitting successfully, so that the
fallback PTE operations will be done.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: "Huang, Ying" <[email protected]>
Acked-by: Minchan Kim <[email protected]>
Cc: "Kirill A. Shutemov" <[email protected]>
Cc: Vlastimil Babka <[email protected]>
Cc: Jerome Marchand <[email protected]>
Cc: Andrea Arcangeli <[email protected]>
Cc: Ebru Akagunduz <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Revert "scripts/gdb: add documentation example for radix tree"

This reverts commit 9b5580359a84 ("scripts/gdb: add documentation
example for radix tree")

The python implementation of radix tree was merged at the same time as a
refactoring of the radix tree implementation and doesn't work.  The
feature is being reverted, thus we revert the documentation as well.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Kieran Bingham <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Revert "scripts/gdb: add a Radix Tree Parser"

This reverts commit e127a73d41ac ("scripts/gdb: add a Radix Tree
Parser")

The python implementation of radix-tree was merged at the same time as
the radix-tree system was heavily reworked from commit e9256efcc8e3
("radix-tree: introduce radix_tree_empty") to 3bcadd6fa6c4 ("radix-tree:
free up the bottom bit of exceptional entries for reuse") and no longer
functions, but also prevents other gdb scripts from loading.

This functionality has not yet hit a release, so simply remove it for
now

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Kieran Bingham <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

scripts/gdb: Perform path expansion to lx-symbol's arguments

Python doesn't do automatic expansion of paths.  In case one passes path
of the from ~/foo/bar the gdb scripts won't automatically expand that
and as a result the symbols files won't be loaded.

Fix this by explicitly expanding all paths which begin with "~"

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Nikolay Borisov <[email protected]>
Signed-off-by: Kieran Bingham <[email protected]>
Reviewed-by: Jan Kiszka <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

scripts/gdb: add constants.py to .gitignore

Since scripts/gdb/linux/constants.py is autogenerated, this should have
been added to .gitignore when it was introduced.

Fixes: f197d75fcad1 ("scripts/gdb: provide linux constants")
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Omar Sandoval <[email protected]>
Signed-off-by: Kieran Bingham <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

scripts/gdb: rebuild constants.py on dependancy change

The autogenerated constants.py file was only being built on the initial
call, and if the constants.py.in file changed.  As we are utilising the
CPP hooks, we can successfully use the call if_changed_dep rules to
determine when to rebuild the file based on it's inclusions.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Kieran Bingham <[email protected]>
Reported-by: Jan Kiszka <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

scripts/gdb: silence 'nothing to do' message

The constants.py generation, involves a rule to link into the main
makefile.  This rule has no command and generates a spurious warning
message in the build logs when CONFIG_SCRIPTS_GDB is enabled.

Fix simply by giving a no-op action

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Kieran Bingham <[email protected]>
Reported-by: Jan Kiszka <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

kasan: add newline to messages

Currently GPF messages with KASAN look as follows:

  kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN

Add newlines.

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Dmitry Vyukov <[email protected]>
Acked-by: Andrey Ryabinin <[email protected]>
Cc: Alexander Potapenko <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

mm, compaction: prevent VM_BUG_ON when terminating freeing scanner

It's possible to isolate some freepages in a pageblock and then fail
split_free_page() due to the low watermark check.  In this case, we hit
VM_BUG_ON() because the freeing scanner terminated early without a
contended lock or enough freepages.

This should never have been a VM_BUG_ON() since it's not a fatal
condition.  It should have been a VM_WARN_ON() at best, or even handled
gracefully.

Regardless, we need to terminate anytime the full pageblock scan was not
done.  The logic belongs in isolate_freepages_block(), so handle its
state gracefully by terminating the pageblock loop and making a note to
restart at the same pageblock next time since it was not possible to
complete the scan this time.

[[email protected]: don't rescan pages in a pageblock]
Link: http://lkml.kernel.org/r/[email protected]
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: David Rientjes <[email protected]>
Reported-by: Minchan Kim <[email protected]>
Tested-by: Minchan Kim <[email protected]>
Cc: Joonsoo Kim <[email protected]>
Cc: Hugh Dickins <[email protected]>
Cc: Mel Gorman <[email protected]>
Cc: Vlastimil Babka <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Merge branch 'exynos-drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos into drm-next

   This pull request adds to the rework patch series for IOMMU
   integration to support ARM64bit architecture with DMA-IOMMU
   glue code.

   With this patch series, Exynos DRM works well on Exynos5433 SoC
   with IOMMU enabled.

* 'exynos-drm-next' of git://git.kernel.org/pub/scm/linux/kernel/git/daeinki/drm-exynos:
  drm/exynos: iommu: add support for ARM64 specific code for IOMMU glue
  drm/exynos: iommu: move ARM specific code to exynos_drm_iommu.h
  drm/exynos: iommu: remove unused entries from exynos_drm_private strcuture
  drm/exynos: iommu: add a check if all sub-devices have iommu controller
  drm/exynos: iommu: move dma_params configuration code to separate functions

Merge tag 'drm-vc4-next-2016-07-12' of https://github.com/anholt/linux into drm-next

This pull request brings in new vc4 plane formats for Android, precise
vblank timestamping, and a couple of small cleanups.

* tag 'drm-vc4-next-2016-07-12' of https://github.com/anholt/linux:
  drm/vc4: remove redundant ret status check
  drm/vc4: Implement precise vblank timestamping.
  drm/vc4: Bind the HVS before we bind the individual CRTCs.
  gpu: drm: vc4_hdmi: add missing of_node_put after calling of_parse_phandle
  drm: vc4: enable XBGR8888 and ABGR8888 pixel formats
  drm/vc4: clean up error exit path on failed dpi_connector allocation

Merge branch 'drm-vmwgfx-fixes' of git://people.freedesktop.org/~syeh/repos_linux into drm-fixes

A bunch of vmwgfx fixes that fix a black screen issue on latest distros/hw combos.

* 'drm-vmwgfx-fixes' of git://people.freedesktop.org/~syeh/repos_linux:
  drm/vmwgfx: Fix error paths when mapping framebuffer
  drm/vmwgfx: Fix corner case screen target management
  drm/vmwgfx: Delay pinning fbdev framebuffer until after mode set
  drm/vmwgfx: Check pin count before attempting to move a buffer
  drm/ttm: Make ttm_bo_mem_compat available
  drm/vmwgfx: Add an option to change assumed FB bpp
  drm/vmwgfx: Work around mode set failure in 2D VMs
  drm/vmwgfx: Add a check to handle host message failure

Merge tag 'drm-intel-next-2016-07-11' of git://anongit.freedesktop.org/drm-intel into drm-next

- select igt testing depencies for CONFIG_DRM_I915_DEBUG (Chris)
- track outputs in crtc state and clean up all our ad-hoc connector/encoder
  walking in modest code (Ville)
- demidlayer drm_device/drm_i915_private (Chris Wilson)
- thundering herd fix from Chris Wilson, with lots of help from Tvrtko Ursulin
- piles of assorted clean and fallout from the thundering herd fix
- documentation and more tuning for waitboosting (Chris)
- pooled EU support on bxt (Arun Siluvery)
- bxt support is no longer considered prelimary!
- ring/engine vfunc cleanup from Tvrtko
- introduce intel_wait_for_register helper (Chris)
- opregion updates (Jani Nukla)
- tuning and fixes for wait_for macros (Tvrkto&Imre)
- more kabylake pci ids (Rodrigo)
- pps cleanup and fixes for bxt (Imre)
- move sink crc support over to atomic state (Maarten)
- fix up async fbdev init ordering (Chris)
- fbc fixes from Paulo and Chris

* tag 'drm-intel-next-2016-07-11' of git://anongit.freedesktop.org/drm-intel: (223 commits)
  drm/i915: Update DRIVER_DATE to 20160711
  drm/i915: Select DRM_VGEM for igt
  drm/i915: Select X86_MSR for igt
  drm/i915: Fill unused GGTT with scratch pages for VT-d
  drm/i915: Introduce Kabypoint PCH for Kabylake H/DT.
  drm/i915:gen9: implement WaMediaPoolStateCmdInWABB
  drm/i915: Check for invalid cloning earlier during modeset
  drm/i915: Simplify hdmi_12bpc_possible()
  drm/i915: Kill has_dsi_encoder
  drm/i915: s/INTEL_OUTPUT_DISPLAYPORT/INTEL_OUTPUT_DP/
  drm/i915: Replace some open coded intel_crtc_has_dp_encoder()s
  drm/i915: Kill has_dp_encoder from pipe_config
  drm/i915: Replace manual lvds and sdvo/hdmi counting with intel_crtc_has_type()
  drm/i915: Unify intel_pipe_has_type() and intel_pipe_will_have_type()
  drm/i915: Add output_types bitmask into the crtc state
  drm/i915: Remove encoder type checks from MST suspend/resume
  drm/i915: Don't mark eDP encoders as MST capable
  drm/i915: avoid wait_for_atomic() in non-atomic host2guc_action()
  drm/i915: Group the irq breadcrumb variables into the same cacheline
  drm/i915: Wake up the bottom-half if we steal their interrupt
  ...

Merge tag 'topic/drm-misc-2016-07-14' of git://anongit.freedesktop.org/drm-intel into drm-next

I recovered dri-devel backlog from my vacation, more misc stuff:
- of_put_node fixes from Peter Chen (not all yet)
- more patches from Gustavo to use kms-native drm_crtc_vblank_* funcs
- docs sphinxification from Lukas Wunner
- bunch of fixes all over from Dan Carpenter
- more follow up work from Chris register/unregister rework in various
  places
- vgem dma-buf export (for writing testcases)
- small things all over from tons of different people

* tag 'topic/drm-misc-2016-07-14' of git://anongit.freedesktop.org/drm-intel: (52 commits)
  drm: Don't overwrite user ioctl arg unless requested
  dma-buf/sync_file: improve Kconfig description for Sync Files
  MAINTAINERS: add entry for the Sync File Framework
  drm: Resurrect atomic rmfb code
  drm/vgem: Use PAGE_KERNEL in place of x86-specific PAGE_KERNEL_IO
  qxl: silence uninitialized variable warning
  qxl: check for kmap failures
  vga_switcheroo: Sphinxify docs
  drm: Restore double clflush on the last partial cacheline
  gpu: drm: rockchip_drm_drv: add missing of_node_put after calling of_parse_phandle
  gpu: drm: sti_vtg: add missing of_node_put after calling of_parse_phandle
  gpu: drm: sti_hqvdp: add missing of_node_put after calling of_parse_phandle
  gpu: drm: sti_vdo: add missing of_node_put after calling of_parse_phandle
  gpu: drm: sti_compositor: add missing of_node_put after calling of_parse_phandle
  drm/tilcdc: use drm_crtc_handle_vblank()
  drm/rcar-du: use drm_crtc_handle_vblank()
  drm/nouveau: use drm_crtc_handle_vblank()
  drm/atmel: use drm_crtc_handle_vblank()
  drm/armada: use drm_crtc_handle_vblank()
  drm: make drm_vblank_count_and_time() static
  ...

Merge tag 'drm-intel-fixes-2016-07-14' of git://anongit.freedesktop.org/drm-intel into drm-fixes

I've also realized that a pile of hang fixes for kbl landed in next, and
no one thought of backporting it to 4.7 - kbl has lost prelim_hw_support
tagging in 4.7-rc1 already. Mika is prepping a topic branch for those,
will send you a separate pull request since it's quite a bit (but should
be all well restricted to kbl code, so similar to polaris in amdgpu).

* tag 'drm-intel-fixes-2016-07-14' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: Ignore panel type from OpRegion on SKL
  drm/i915: Update ifdeffery for mutex->owner

bonding: set carrier off for devices created through netlink

Commit e826eafa65c6 ("bonding: Call netif_carrier_off after
register_netdevice") moved netif_carrier_off() from bond_init() to
bond_create(), but the latter is called only for initial default
devices and ones created through sysfs:

 $ modprobe bonding
 $ echo +bond1 > /sys/class/net/bonding_masters
 $ ip link add bond2 type bond
 $ grep "MII Status" /proc/net/bonding/*
 /proc/net/bonding/bond0:MII Status: down
 /proc/net/bonding/bond1:MII Status: down
 /proc/net/bonding/bond2:MII Status: up

Ensure that carrier is initially off also for devices created through
netlink.

Signed-off-by: Beniamino Galvani <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

Merge branch 'drm-fixes-4.7' of git://people.freedesktop.org/~agd5f/linux into drm-fixes

Two more polaris fixes.
* 'drm-fixes-4.7' of git://people.freedesktop.org/~agd5f/linux:
  drm/amdgpu: fix power distribution issue for Polaris10 XT
  drm/amdgpu: Add a missing register to Polaris golden setting

drm/amdgpu: fix power distribution issue for Polaris10 XT

Signed-off-by: Ken Wang <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>

drm/amdgpu: Add a missing register to Polaris golden setting

Signed-off-by: Ken Wang <[email protected]>
Reviewed-by: Alex Deucher <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>

Input: synaptics-rmi4 - use of_get_child_by_name() to fix refcount

Calling of_find_node_by_name() assumes that the caller has incremented
the refcount of the of_node being passed in. Currently, the caller is
not incrementing the refcount of the of_node which results in the node
being prematurely freed when of_find_node_by_name() calls of_node_put()
on it. Instead use of_get_child_by_name() which does not call put on the
of_node.

Signed-off-by: Andrew Duggan <[email protected]>
Signed-off-by: Dmitry Torokhov <[email protected]>

Revert "Input: wacom_w8001 - drop use of ABS_MT_TOOL_TYPE"

This reverts commit 5f7e5445a2de848c66d2d80ba5479197e8287c33 because
removal of input_mt_report_slot_state() means we no longer generate
tracking IDs for the reported contacts.

Cc: [email protected]
Acked-by: Peter Hutterer <[email protected]>
Acked-by: Ping Cheng <[email protected]>

mtd: nand: omap2: Add check for old elm binding

commit c9711ec5250b ("mtd: nand: omap: Clean up device tree support")
removes the check for the old elm phandle binding.
Add it again to keep backward compatibility.

Fixes: commit c9711ec5250b ("mtd: nand: omap: Clean up device tree support")
Signed-off-by: Teresa Remmet <[email protected]>
Signed-off-by: Brian Norris <[email protected]>

nvme: Remove RCU namespace protection

We can't sleep with RCU read lock held, but we need to do potentially
blocking stuff to namespace queues when iterating the list. This patch
removes the RCU locking and holds a mutex instead.

To prevent deadlocks, this patch removes holding the mutex during
namespace scanning and removal. The unlocked namespace scanning is made
safe by holding a reference to the namespace being scanned.

List iteration that does IO has to be unlocked to allow error recovery.
The caller must ensure the list can not be manipulated during such an
event, so this patch adds a comment explaining this requirement to the
only function that iterates an unlocked list. All callers currently
meet this requirement, so no further changes required.

List iterations that do not do IO can safely use the lock since it couldn't
block recovery from missing forced IO completions.

Reported-by: Ming Lin <mlin at kernel.org>
[fixes 0bf77e9 nvme: switch to RCU freeing the namespace]
Signed-off-by: Keith Busch <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>

drm/vc4: Move validation's current/max ip into the validation struct.

Reduces the argument count for some of the functions, and will be used
more with the upcoming looping support.

Signed-off-by: Eric Anholt <[email protected]>

drm/vc4: Add a getparam ioctl for getting the V3D identity regs.

As I extend the driver to support different V3D revisions, userspace
needs to know what version it's targeting.  This is most easily
detected using the V3D identity registers.

v2: Make sure V3D is runtime PM on when reading the registers.
v3: Switch to a 64-bit param value (suggested by Rob Clark in review)

Signed-off-by: Eric Anholt <[email protected]>
Acked-by: Daniel Vetter <[email protected]> (v2)
Reviewed-by: Rob Clark <[email protected]> (v3, over irc)

drm/i915: Ignore panel type from OpRegion on SKL

Dell XPS 13 9350 apparently doesn't like it when we use the panel type
from OpRegion. The OpRegion panel type (0) tells us to use use low
vswing for eDP, whereas the VBT panel type (2) tells us to use normal
vswing. The problem is that low vswing results in some display flickers.
Since no one seems to know how this stuff is supposed to be handled,
let's just ignore the OpRegion panel type on SKL for now.

v2: Print the panel type correctly in the debug output

Reported-by: James Bottomley <[email protected]>
Cc: James Bottomley <[email protected]>
Cc: [email protected]
References: https://lists.freedesktop.org/archives/intel-gfx/2016-June/098826.html
Fixes: a05628195a0d ("drm/i915: Get panel_type from OpRegion panel details")
Signed-off-by: Ville Syrjälä <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
Reviewed-by: Daniel Vetter <[email protected]>
Tested-by: James Bottomley <[email protected]>
Signed-off-by: Ville Syrjälä <[email protected]>
(cherry picked from commit bb10d4ec3be4b069bfb61c60ca4f708f58f440f1)
[danvet: Fix up cherry-pick conflict with an s/dev_priv/dev/.]
Signed-off-by: Daniel Vetter <[email protected]>

drm/i915: Update ifdeffery for mutex->owner

In commit 7608a43d8f2e ("locking/mutexes: Use MUTEX_SPIN_ON_OWNER when
appropriate") the owner field in the mutex was updated from being
dependent upon CONFIG_SMP to using optimistic spin. Update our peek
function to suite.

Fixes:7608a43d8f2e ("locking/mutexes: Use MUTEX_SPIN_ON_OWNER...")
Reported-by: Hong Liu <[email protected]>
Signed-off-by: Chris Wilson <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]
Reviewed-by: Matthew Auld <[email protected]>
(cherry picked from commit 4f074a5393431a7d2cc0de7fcfe2f61d24854628)
Cc: [email protected]
Signed-off-by: Daniel Vetter <[email protected]>

drm/tegra: sor: Reject HDMI 2.0 modes

Enabling HDMI 2.0 modes requires extra programming and will not work
with the current driver, so reject all those modes.

Signed-off-by: Thierry Reding <[email protected]>

drm/tegra: sor: Prepare for generic PM domain support

The SOR driver for Tegra requires the SOR power partition to be enabled.
Now that Tegra supports the generic PM domain framework we manage the
SOR power partition via this framework. However, the sequence for
gating/ungating the SOR power partition requires that the SOR reset is
asserted/de-asserted at the time the SOR power partition is
gated/ungated, respectively. Now that the reset control core assumes
that resets are exclusive, the Tegra generic PM domain code and the SOR
driver cannot request the same reset unless we mark the reset as shared.
Sharing resets will not work in this case because we cannot guarantee
that the reset will be asserted/de-asserted at the appropriate time.
Therefore, given that the Tegra generic PM domain code will handle the
resets, do not request the reset in the SOR driver if the SOR device has
a PM domain associated.

Signed-off-by: Jon Hunter <[email protected]>
Signed-off-by: Thierry Reding <[email protected]>

drm/tegra: dsi: Prepare for generic PM domain support

The DSI driver for Tegra requires the SOR power partition to be enabled.
Now that Tegra supports the generic PM domain framework we manage the
SOR power partition via this framework. However, the sequence for
gating/ungating the SOR power partition requires that the DSI reset is
asserted/de-asserted at the time the SOR power partition is
gated/ungated, respectively. Now that the reset control core assumes
that resets are exclusive, the Tegra generic PM domain code and the DSI
driver cannot request the same reset unless we mark the reset as shared.
Sharing resets will not work in this case because we cannot guarantee
that the reset will be asserted/de-asserted at the appropriate time.
Therefore, given that the Tegra generic PM domain code will handle the
resets, do not request the reset in the DSI driver if the DSI device has
a PM domain associated.

Signed-off-by: Jon Hunter <[email protected]>
Signed-off-by: Thierry Reding <[email protected]>

drm/tegra: sor: Make XBAR configurable per SoC

Provide a per-SoC mapping of lanes which can be used to configure the
XBAR.

Signed-off-by: Thierry Reding <[email protected]>

drm/tegra: sor: Use sor1_src clock to set parent for HDMI

When running in HDMI mode, the sor1 IP block needs to use the sor1_src
as parent clock, and in turn configure the sor1_src to use pll_d2_out0
as its parent.

Signed-off-by: Thierry Reding <[email protected]>

dt-bindings: display: tegra: Add source clock for SOR

The SOR clock can have various sources, with the most commonly used
being the sor_safe, pll_d2_out0, pll_dp and sor_brick clocks. These
are configured using a three level mux, of which the first 2 levels
can be treated as one. The direct parents of the SOR clock are the
sor_safe, sor_brick and sor_src clocks, whereas the pll_d2_out0 and
pll_dp clocks can be selected as parents of the sor_src clock via a
second mux.

Previous generations of Tegra have only supported eDP and LVDS with
the SOR, where LVDS was never used on publicly available hardware.
Clocking for this only ever required the first level mux (to select
between sor_safe and sor_brick).

Tegra210 has a new revision of the SOR that supports HDMI and hence
needs to support the second level mux to allow selecting pll_d2_out0
as the SOR clock's parent. This second mux is knows as sor_src, and
operating system software needs a reference to it in order to select
the proper parent.

Signed-off-by: Thierry Reding <[email protected]>

drm/tegra: sor: Implement sor1_brick clock

sor1_brick is a clock that can be used as a source for the sor1 clock.
The registers to control the clock output are part of the sor1 IP block
and hence the sor driver is the best place to implement it.

Signed-off-by: Thierry Reding <[email protected]>

drm/imx: parallel-display: add bridge support

Add support for bridge chips connected externally to the i.MX
DISP0/DISP1 DPI interfaces.

Signed-off-by: Philipp Zabel <[email protected]>

drm: Don't overwrite user ioctl arg unless requested

Currently, we completely ignore the user when it comes to the in/out
direction of the ioctl argument, as we simply cannot trust userspace.
(For example, they might request a copy of the modified ioctl argument
when the driver is not expecting such and so leak kernel stack.)
However, blindly copying over the target address may also lead to a
spurious EFAULT, and a failure after the ioctl was completed
successfully. This is important in order to avoid an ABI break when
extending an ioctl from IOR to IORW. Similar to how we only copy the
intersection of the kernel arg size and the user arg size, we only want
to copy back the kernel arg data iff both the kernel and userspace
request the copy.

Signed-off-by: Chris Wilson <[email protected]>
Reviewed-by: Christian König <[email protected]>
Signed-off-by: Daniel Vetter <[email protected]>
Link: http://patchwork.freedesktop.org/patch/msgid/[email protected]

Merge branch 'linux-4.8' of git://github.com/skeggsb/linux into drm-next

Here's an initial drm-next pull for nouveau 4.8, highlights:
- GK20A/GM20B volt and clock improvements.
- Initial support for GP100/GP104 GPUs, GP104 will not yet support
acceleration due to NVIDIA having not released firmware for them as of yet.

* 'linux-4.8' of git://github.com/skeggsb/linux: (97 commits)
  drm/nouveau/bus: remove cpu_coherent flag
  drm/nouveau/ttm: remove special handling of coherent objects
  drm/nouveau: check for supported chipset before booting fbdev off the hw
  drm/nouveau/ce/gp104: initial support
  drm/nouveau/fifo/gp104: initial support
  drm/nouveau/disp/gp104: initial support
  drm/nouveau/dma/gp104: initial support
  drm/nouveau/ltc/gp104: initial support
  drm/nouveau/ibus/gp104: initial support
  drm/nouveau/i2c/gp104: initial support
  drm/nouveau/gpio/gp104: initial support
  drm/nouveau/fuse/gp104: initial support
  drm/nouveau/bus/gp104: initial support
  drm/nouveau/bar/gp104: initial support
  drm/nouveau/mmu/gp104: initial support
  drm/nouveau/fb/gp104: initial support
  drm/nouveau/imem/gp104: initial support
  drm/nouveau/devinit/gp104: initial support
  drm/nouveau/bios/gp104: initial support
  drm/nouveau/tmr/gp104: initial support
  ...

drm/nouveau/bus: remove cpu_coherent flag

This flag's only remaining function is to ignore the uncached flag for
BOs on coherent architectures.

However the reason for allocating an object uncache on a non-coherent
architecture (namely because the cost of doing explicit flushes/
invalidations is higher than the benefit of caching the data because
accesses are few and far between) should also apply on architectures for
which coherency is maintained implicitly. Thus allocate coherent objects
as uncached on all architectures.

Signed-off-by: Alexandre Courbot <[email protected]>
Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/ttm: remove special handling of coherent objects

TTM-allocated coherent objects were populated using the DMA API and
accessed using the mapping it returned to workaround coherency
issues. These issues seem to have been solved, thus remove this extra
case to handle and use the regular kernel mapping functions.

Signed-off-by: Alexandre Courbot <[email protected]>
Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau: check for supported chipset before booting fbdev off the hw

Signed-off-by: Ben Skeggs <[email protected]>
Cc: [email protected]

drm/nouveau/ce/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/fifo/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/disp/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/dma/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/ltc/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/ibus/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/i2c/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/gpio/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/fuse/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/bus/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/bar/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/mmu/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/fb/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/imem/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/devinit/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/bios/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/tmr/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/pci/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/mc/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/top/gp104: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/core: recognise GP104 chipset

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/sw/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/gr/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/ce/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/fifo/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/disp/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/dma/gp100: initial implementation

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/secboot/gm200: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/ltc/gp100: initial support

Due to the GPU preventing us from touching NV_PLTCG_LTCS_LTSS_CBC_BASE,
we cannot provide CBC/ZBC support without signed PMU firmware to handle
the task for us...

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/ibus/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/i2c/gm204: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/gpio/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/fuse/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/bus/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/bar/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/mmu/gp100: initial support

GP100 still supports the previous generations' page table layout, which
we will temporarily make use of here.

Proper support for the new MMU layout requires some rework to the common
MMU code, which is in progress.

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/fb/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/imem/gp100: initial implementation

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/devinit/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/bios/rammap: 32-bit bios pointers

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/bios/pll: initial support for BIT 'C' version 2

Just enough to get at the PLL table.

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/bios/dp: initial support for 4.2

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/bios/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/tmr/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/pci/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/mc/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/top/gp100: initial support

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/core: recognise GP100 chipset

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/core: increase maximum nvenc instances to 3

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/core: increase maximum ce instances to 6

Signed-off-by: Ben Skeggs <[email protected]>

drm/nouveau/fb/gf100-: allow selection of an alternate big page size

GFxxx/GM1xx support the selection of 64/128KiB big pages globally.

GM2xx supports the same, as well as another mode where the page size
can be selected per-instance.

We default to 128KiB pages (With per-instance for GM200, but the current
code selects 128KiB there already) as the MMU code isn't currently able
to handle otherwise.

Signed-off-by: Ben Skeggs <[email protected]>