Recent changes in the clock framework have caused a behavioural change
in that clocks that have not had their rate set explicitly will now be
reset to their initial rate (or 0) when the clock is released. This is
triggered in the deferred probing path, resulting in the clock running
at a wrong frequency after the successful probe.

This can be easily fixed by setting the rate explicitly rather than by
relying on the implicit rate inherited by the parent.

Tested-by: Tomeu Vizoso <[email protected]>
Signed-off-by: Thierry Reding <[email protected]>

Commit eab3bbe ("drm/atomic: Add drm_crtc_state->active") added the
field to track the DPMS state. However, the Tegra driver was in modified
in parallel and subclasses the CRTC atomic state, so needed to duplicate
the code in the atomic helpers. After the addition of the active_changed
field it became out of sync and doesn't reset it when duplicating state.

This causes a full modeset on things like page-flips, which will in turn
cause warnings due to the VBLANK machinery being disabled when it really
should remain on.

Tested-by: Tomeu Vizoso <[email protected]>
Signed-off-by: Thierry Reding <[email protected]>

Store a pointer to the CRTC in its atomic state to make it easy for
state handling code to get at the CRTC.

Tested-by: Tomeu Vizoso <[email protected]>
Signed-off-by: Thierry Reding <[email protected]>

The code in tegra_crtc_prepare() really belongs in tegra_dc_init(), or
at least most of it. This fixes an issue with VBLANK handling because
tegra_crtc_prepare() would overwrite the interrupt mask register that
tegra_crtc_enable_vblank() had written to to enable VBLANK interrupts.

Tested-by: Tomeu Vizoso <[email protected]>
Signed-off-by: Thierry Reding <[email protected]>

This patch fixes a bug in the initialization of the pipelines. The
init_pipelines() function was called with a constant value of 0 in the
first_pipe argument. This is an error because amdkfd doesn't handle pipe 0.

The correct way is to pass the value that get_first_pipe() returns as the
argument for first_pipe.

This bug appeared in 3.19 (first version with amdkfd) and it causes around 15%
drop in CPU performance of Kaveri (A10-7850).

v2: Don't set get_first_pipe() as inline because it calls BUG_ON()

Signed-off-by: Oded Gabbay <[email protected]>
Cc: [email protected]
Tested-by: Michel Dänzer <[email protected]>

get_pipes_num() calls BUG_ON so we can't set it as inline because it produces a
warning as BUG_ON() uses static variables when it is expanded.

Signed-off-by: Oded Gabbay <[email protected]>

ftrace_enable_ftrace_graph_caller and ftrace_disable_ftrace_graph_caller
should replace B(jmp) instruction and not BL(call) instruction.

Commit 9f1ae75("arm64: Correct ftrace calls to
aarch64_insn_gen_branch_imm()") had a typo and used
AARCH64_INSN_BRANCH_LINK instead of AARCH64_INSN_BRANCH_NOLINK.

Either instruction will work, as the link register is saved/restored
across the branch but this better matches the intention of the code.

Signed-off-by: Pratyush Anand <[email protected]>
Signed-off-by: Will Deacon <[email protected]>

Fix cbz/cbnz having the mask offset by a bit, and add encodings for
tbz/tbnz so that all branch forms are represented.

Signed-off-by: Robin Murphy <[email protected]>
Acked-by: Will Deacon <[email protected]>
Acked-by: Zi Shen Lim <[email protected]>
Signed-off-by: Will Deacon <[email protected]>

asm/assembler.h lacks the usual guard against multiple inclusion,
leading to a compilation failure if it is accidentally included
twice.

Using the classic #ifndef/#define/#endif construct solves the issue.

Signed-off-by: Marc Zyngier <[email protected]>
Signed-off-by: Will Deacon <[email protected]>

When reviewing patch that fixes VGA on BDW Halo Jani noticed that
we also had other ULT IDs that weren't listed there.

So this follow-up patch add these pci-ids as halo and fix comments
on i915_pciids.h

Cc: Jani Nikula <[email protected]>
Cc: [email protected]
Signed-off-by: Rodrigo Vivi <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>

For filesystems without separate project quota inode field in the
superblock we just reuse project quota file for group quotas (and vice
versa) if project quota file is allocated and we need group quota file.
When we reuse the file, quota structures on disk suddenly have wrong
type stored in d_flags though. Nobody really cares about this (although
structure type reported to userspace was wrong as well) except
that after commit 14bf61f (quota: Switch ->get_dqblk() and
->set_dqblk() to use bytes as space units) assertion in
xfs_qm_scall_getquota() started to trigger on xfs/106 test (apparently I
was testing without XFS_DEBUG so I didn't notice when submitting the
above commit).

Fix the problem by properly resetting ddq->d_flags when running quotacheck
for a quota file.

CC: [email protected]
Reported-by: Al Viro <[email protected]>
Signed-off-by: Jan Kara <[email protected]>
Reviewed-by: Dave Chinner <[email protected]>
Signed-off-by: Dave Chinner <[email protected]>

A new fsync vs power fail test in xfstests indicated that XFS can
have unreliable data consistency when doing extending truncates that
require block zeroing. The blocks beyond EOF get zeroed in memory,
but we never force those changes to disk before we run the
transaction that extends the file size and exposes those blocks to
userspace. This can result in the blocks not being correctly zeroed
after a crash.

Because in-memory behaviour is correct, tools like fsx don't pick up
any coherency problems - it's not until the filesystem is shutdown
or the system crashes after writing the truncate transaction to the
journal but before the zeroed data in the page cache is flushed that
the issue is exposed.

Fix this by also flushing the dirty data in memory region between
the old size and new size when we've found blocks that need zeroing
in the truncate process.

Reported-by: Liu Bo <[email protected]>
cc: <[email protected]>
Signed-off-by: Dave Chinner <[email protected]>
Reviewed-by: Brian Foster <[email protected]>
Signed-off-by: Dave Chinner <[email protected]>

skylake_update_primary_plane() did not handle all pixel formats returned
by skl_format_to_fourcc(). Handle alpha similar to skl_update_plane().

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=89052
Reviewed-by: Damien Lespiau <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>

Add quirk for Dell Chromebook 11 backlight.

Reported-and-tested-by: Owen Garland <[email protected]>
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=93451
Acked-by: Damien Lespiau <[email protected]>
Cc: [email protected]
Signed-off-by: Jani Nikula <[email protected]>

Need to define and use appropriate functions for when BLK_DEV_INTEGRITY
is not set.

Reported-by: Fengguang Wu <[email protected]>
Signed-off-by: Keith Busch <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>

mapping->host can be NULL and shouldn't be dereferenced before being checked.

[ 1295.741844] GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] SMP KASAN
[ 1295.746387] Dumping ftrace buffer:
[ 1295.748217]    (ftrace buffer empty)
[ 1295.749527] Modules linked in:
[ 1295.750268] CPU: 62 PID: 23410 Comm: trinity-c70 Not tainted 3.19.0-next-20150219-sasha-00045-g9130270f #1939
[ 1295.750268] task: ffff8803a49db000 ti: ffff8803a4dc8000 task.ti: ffff8803a4dc8000
[ 1295.750268] RIP: shmem_mapping (mm/shmem.c:1458)
[ 1295.750268] RSP: 0000:ffff8803a4dcfbf8  EFLAGS: 00010206
[ 1295.750268] RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 00000000000f2804
[ 1295.750268] RDX: 0000000000000005 RSI: 0400000000000794 RDI: 0000000000000028
[ 1295.750268] RBP: ffff8803a4dcfc08 R08: 0000000000000000 R09: 00000000031de000
[ 1295.750268] R10: dffffc0000000000 R11: 00000000031c1000 R12: 0400000000000794
[ 1295.750268] R13: 00000000031c2000 R14: 00000000031de000 R15: ffff880e3bdc1000
[ 1295.750268] FS:  00007f8703c7e700(0000) GS:ffff881164800000(0000) knlGS:0000000000000000
[ 1295.750268] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1295.750268] CR2: 0000000004e58000 CR3: 00000003a9f3c000 CR4: 00000000000007a0
[ 1295.750268] DR0: ffffffff81000000 DR1: 0000009494949494 DR2: 0000000000000000
[ 1295.750268] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 00000000000d0602
[ 1295.750268] Stack:
[ 1295.750268]  ffff8803a4dcfec8 ffffffffbb1dc770 ffff8803a4dcfc38 ffffffffad6f230b
[ 1295.750268]  ffffffffad6f2b0d 0000014100000000 ffff88001e17c08b ffff880d9453fe08
[ 1295.750268]  ffff8803a4dcfd18 ffffffffad6f2ce2 ffff8803a49dbcd8 ffff8803a49dbce0
[ 1295.750268] Call Trace:
[ 1295.750268] mincore_page (mm/mincore.c:61)
[ 1295.750268] ? mincore_pte_range (include/linux/spinlock.h:312 mm/mincore.c:131)
[ 1295.750268] mincore_pte_range (mm/mincore.c:151)
[ 1295.750268] ? mincore_unmapped_range (mm/mincore.c:113)
[ 1295.750268] __walk_page_range (mm/pagewalk.c:51 mm/pagewalk.c:90 mm/pagewalk.c:116 mm/pagewalk.c:204)
[ 1295.750268] walk_page_range (mm/pagewalk.c:275)
[ 1295.750268] SyS_mincore (mm/mincore.c:191 mm/mincore.c:253 mm/mincore.c:220)
[ 1295.750268] ? mincore_pte_range (mm/mincore.c:220)
[ 1295.750268] ? mincore_unmapped_range (mm/mincore.c:113)
[ 1295.750268] ? __mincore_unmapped_range (mm/mincore.c:105)
[ 1295.750268] ? ptlock_free (mm/mincore.c:24)
[ 1295.750268] ? syscall_trace_enter (arch/x86/kernel/ptrace.c:1610)
[ 1295.750268] ia32_do_call (arch/x86/ia32/ia32entry.S:446)
[ 1295.750268] Code: e5 48 c1 ea 03 53 48 89 fb 48 83 ec 08 80 3c 02 00 75 4f 48 b8 00 00 00 00 00 fc ff df 48 8b 1b 48 8d 7b 28 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 3f 48 b8 00 00 00 00 00 fc ff df 48 8b 5b 28 48

All code
========
   0:	e5 48                	in     $0x48,%eax
   2:	c1 ea 03             	shr    $0x3,%edx
   5:	53                   	push   %rbx
   6:	48 89 fb             	mov    %rdi,%rbx
   9:	48 83 ec 08          	sub    $0x8,%rsp
   d:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
  11:	75 4f                	jne    0x62
  13:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1a:	fc ff df
  1d:	48 8b 1b             	mov    (%rbx),%rbx
  20:	48 8d 7b 28          	lea    0x28(%rbx),%rdi
  24:	48 89 fa             	mov    %rdi,%rdx
  27:	48 c1 ea 03          	shr    $0x3,%rdx
  2b:*	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)		<-- trapping instruction
  2f:	75 3f                	jne    0x70
  31:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  38:	fc ff df
  3b:	48 8b 5b 28          	mov    0x28(%rbx),%rbx
  3f:	48                   	rex.W
	...

Code starting with the faulting instruction
===========================================
   0:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
   4:	75 3f                	jne    0x45
   6:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
   d:	fc ff df
  10:	48 8b 5b 28          	mov    0x28(%rbx),%rbx
  14:	48                   	rex.W
	...
[ 1295.750268] RIP shmem_mapping (mm/shmem.c:1458)
[ 1295.750268]  RSP <ffff8803a4dcfbf8>

Fixes: 97b713b ("fs: kill BDI_CAP_SWAP_BACKED")
Signed-off-by: Sasha Levin <[email protected]>
Reviewed-by: Christoph Hellwig <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>

If the default PM domain using PM_CLK is used for PM runtime, the real PM
domain(s) cannot be registered from DT later.

Hence do not enable it when running a multi-platform kernel with genpd
support on an r8a7740. The R-Mobile PM domain driver will take care of
PM runtime management of the module clocks.

The default PM domain is still needed for:
  - platforms without genpd support,
  - the legacy (non-DT) case, where genpd may take over later, except
    for the C5 "always on" PM domain.

Signed-off-by: Geert Uytterhoeven <[email protected]>
Signed-off-by: Simon Horman <[email protected]>

We shouldn't get here with RENAME_EXCHANGE set and no
target_ip, but let's be defensive, because xfs_cross_rename()
will dereference it.

Spotted by Coverity.

Signed-off-by: Eric Sandeen <[email protected]>
Reviewed-by: Christoph Hellwig <[email protected]>
Signed-off-by: Dave Chinner <[email protected]>

If xfs_trans_reserve fails we don't cancel the transaction,
and we'll leak the allocated transaction pointer.

Spotted by Coverity.

Signed-off-by: Eric Sandeen <[email protected]>
Reviewed-by: Christoph Hellwig <[email protected]>
Signed-off-by: Dave Chinner <[email protected]>

In commit ccfc086
Author: Rob Clark <[email protected]>
Date:   Thu Dec 18 16:01:48 2014 -0500

    drm: tweak getconnector locking

We need to extend the locking to cover connector->state reading for
atomic drivers, but the above commit was a bit too eager and also
included the fill_modes callback. Which on i915 on old platforms using
load detection needs to acquire modeset locks, resulting in a deadlock
on output probing.

Reported-by: Marc Finet <[email protected]>
Cc: Marc Finet <[email protected]>
Cc: [email protected]
Signed-off-by: Daniel Vetter <[email protected]>
Reviewed-by: Rob Clark <[email protected]>
Signed-off-by: Dave Airlie <[email protected]>

….org/tegra/linux into drm-fixes

drm/tegra: Fixes for v3.20-rc1

This fixes a bit of fallout that was caused by the atomic modesetting
driver conversion and some last-minute changes in the DRM atomic core.
It also fixes a bug exposed by recent changes in the clock framework
which results in non-working HDMI.

* tag 'drm/tegra/for-3.20-rc1-fixes' of git://anongit.freedesktop.org/tegra/linux:
  drm/tegra: dc: Move more code into ->init()
  drm/tegra: dc: Wire up CRTC parent of atomic state
  drm/tegra: dc: Reset state's active_changed field
  drm/tegra: hdmi: Explicitly set clock rate

…rg/~gabbayo/linux into drm-fixes

- Fix a bug that caused 15% CPU performance drop in Kaveri. This was caused
  because we overwritten the initialization of the first pipe (out of eight),
  which is dedicated to radeon operation. The fix was tested by Michel Dänzer.
  This bug was introduced by a patch I prepared (yeah, my bad) and was merged
  to 3.19-rc6. Therefore, I also marked it as Cc:stable.

- Fix sparse warning
* tag 'drm-amdkfd-fixes-2015-02-23' of git://people.freedesktop.org/~gabbayo/linux:
  drm/amdkfd: don't set get_pipes_num() as inline
  drm/amdkfd: Initialize only amdkfd's assigned pipelines

The A2Q (Add To Queue) and UPDATE bits are left in their previous state
when resetting the layer.
This lead to weird behavior when enabling the plane again: the framebuffer
previously queued is dequeued and we end up with access to an old memory
region.

Reset those bits when resetting the channel.

Signed-off-by: Boris Brezillon <[email protected]>

Remove a useless pm_runtime_put_sync leading to unbalanced
usage_count.

Signed-off-by: Boris Brezillon <[email protected]>
Reported-by: Sylvain Rochet <[email protected]>

When converting from implicitly tracked execlist queue items to ref counted
requests, not all frees of requests were replaced with unrefs, and extraneous
refs/unrefs of contexts were added.
Correct the unbalanced refcount & replace the frees.
Remove a noisy warning when hitting the request creation path.

drm_i915_gem_request and intel_context are both kref reference counted
structures. Upon allocation, drm_i915_gem_request's ref count should be
bumped using kref_init. When a context is assigned to the request,
the context's reference count should be bumped using i915_gem_context_reference.
i915_gem_request_reference will reduce the context reference count when
the request is freed.

Problem introduced in
commit 6d3d827
Author:     Nick Hoath <[email protected]>
AuthorDate: Thu Jan 15 13:10:39 2015 +0000

     drm/i915: Subsume intel_ctx_submit_request in to drm_i915_gem_request

v2: Added comments explaining how the ctx pointer and the request object should
be ref-counted. Removed noisy warning.

v3: Cleaned up the language used in the commit & the header
description (Thanks David Gordon)

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=88652
Signed-off-by: Nick Hoath <[email protected]>
Reviewed-by: Thomas Daniel <[email protected]>
Reviewed-by: Daniel Vetter <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>

When we walk the list of vma, or even for protecting against concurrent
framebuffer creation, we must hold the struct_mutex or else a second
thread can corrupt the list as we walk it.

Fixes regression from
commit d7f46fc
Author: Ben Widawsky <[email protected]>
Date:   Fri Dec 6 14:10:55 2013 -0800

    drm/i915: Make pin count per VMA

References: https://bugs.freedesktop.org/show_bug.cgi?id=89085
Signed-off-by: Chris Wilson <[email protected]>
Reviewed-by: Daniel Vetter <[email protected]>
Cc: [email protected]
Signed-off-by: Jani Nikula <[email protected]>

…ates

Atm, it's possible that the interrupt handler is called when the device
is in D3 or some other low-power state. It can be due to another device
that is still in D0 state and shares the interrupt line with i915, or on
some platforms there could be spurious interrupts even without sharing
the interrupt line. The latter case was reported by Klaus Ethgen using a
Lenovo x61p machine (gen 4). He noticed this issue via a system
suspend/resume hang and bisected it to the following commit:

commit e11aa36
Author: Jesse Barnes <[email protected]>
Date:   Wed Jun 18 09:52:55 2014 -0700

    drm/i915: use runtime irq suspend/resume in freeze/thaw

This is a problem, since in low-power states IIR will always read
0xffffffff resulting in an endless IRQ servicing loop.

Fix this by handling interrupts only when the driver explicitly enables
them and so it's guaranteed that the interrupt registers return a valid
value.

Note that this issue existed even before the above commit, since during
runtime suspend/resume we never unregistered the handler.

v2:
- clarify the purpose of smp_mb() vs. synchronize_irq() in the
  code comment (Chris)

v3:
- no need for an explicit smp_mb(), we can assume that synchronize_irq()
  and the mmio read/writes in the install hooks provide for this (Daniel)
- remove code comment as the remaining synchronize_irq() is self
  explanatory (Daniel)

v4:
- drm_irq_uninstall() implies synchronize_irq(), so no need to call it
  explicitly (Daniel)

Reference: https://lkml.org/lkml/2015/2/11/205
Reported-and-bisected-by: Klaus Ethgen <[email protected]>
Cc: [email protected]
Signed-off-by: Imre Deak <[email protected]>
Reviewed-by: Daniel Vetter <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>

Some bios really like to joke and start the planes at an offset ...
hooray!

Align start and end to fix this.

v2: Fixup calculation of size, spotted by Chris Wilson.

v3: Fix serious fumble I've just spotted.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=86883
Cc: [email protected]
Cc: Johannes W <[email protected]>
Cc: Chris Wilson <[email protected]>
Cc: Jani Nikula <[email protected]>
Reported-and-tested-by: Johannes W <[email protected]>
Signed-off-by: Daniel Vetter <[email protected]>
[Jani: split WARN_ONs, rebase on v4.0-rc1]
Signed-off-by: Jani Nikula <[email protected]>

The sata_ref_clk is a reference clock to the SATA phy.
This fixes SATA malfunction across suspend/resume or when
SATA driver is used as a module.

Signed-off-by: Roger Quadros <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

The sata_ref_clk is a reference clock to the SATA phy.
This fixes SATA malfunction across suspend/resume or when
SATA driver is used as a module.

Signed-off-by: Roger Quadros <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

Commit 7800064 ("ARM: dts: Add basic dm816x device tree
configuration") added basic devices for dm816x, but I was not able
to test the USB completely because of an unconfigured USB phy, and
I only tested it to make sure the Mentor chips are detected and
clocked without a phy.

After testing the USB with actual devices I noticed a few issues
that should be fixed to avoid confusion:

- The USB id pin on dm8168-evm is hardwired and can be changed
  only by software. As there are two USB-A type connectors, let's
  start both in host mode instead of otg.

- The Mentor core is configured in such a way on dm8168-evm that
  it's not capable of multipoint at least on revision c board
  that I have.

- We need ranges for the syscon to properly set up the phy as
  children of the SCM syscon area.

- Let's not disable the second interface, the board specific
  dts files can do that if really needed. Most boards should
  just keep it enabled to ensure the device is idled properly.

Note that also a phy and several musb fixes are still needed to
make the USB to work properly in addition to this fix.

Cc: Brian Hutchinson <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

With legacy boot i2c buses on Nokia N900 are numbered i2c1, i2c2 and i2c3.
Commit 20b8094 ("ARM: dts: OMAP3+: Add i2c aliases") fixed the
numbering with DT boot, but introduced a regression on N900 - aliases
become i2c0, i2c1 and i2c2. Fix that by providing the correct aliases in
the board dts.

Signed-off-by: Ivaylo Dimitrov <[email protected]>
Tested-by: Pali Rohár <[email protected]>
Acked-by: Nishanth Menon <[email protected]>
[[email protected]: this is needed for legacy user space to work]
Signed-off-by: Tony Lindgren <[email protected]>

Offset for smc91x must be zero otherwise smc91x linux kernel driver does not
detect smc91x ethernet hardware in qemu N900 machine.

The 0x300 offset was used to supress a warning the smsc911x
driver produces about non-standard offset as 0x300 seems to
be the EEPROM default. As only three address lines are
connected both 0 and 0x300 will work just fine with 0 being
correct. The warning about the non-standard offset can be
fixed by writing to EEPROM as that's needed in any case to
set the MAC address.

Signed-off-by: Pali Rohár <[email protected]>
[[email protected]: updated comments, just use 0 instead of 0x0]
Signed-off-by: Tony Lindgren <[email protected]>

As it turns out, tps62362 is actually on I2C bus0,
not bus1. This has gone unnoticed because Linux
doesn't use (as of now) that regulator at all, it's
setup by the bootloader and left as is.

While at that, also add missing reg property for
our regulator.

Signed-off-by: Felipe Balbi <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

This regulator is used on AM437x Industrial Development Kit.

Signed-off-by: Felipe Balbi <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

we have i2c0 sleep pinctrl state but were passing
default state anyhow. Fix that.

Signed-off-by: Felipe Balbi <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

According to the Documentation/devicetree/bindings/dma/dma.txt the
dma-channels and dma-requests property should not have '#'.

Signed-off-by: Peter Ujfalusi <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

According to the Documentation/devicetree/bindings/dma/dma.txt the
dma-channels and dma-requests property should not have '#'.

Signed-off-by: Peter Ujfalusi <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

According to the Documentation/devicetree/bindings/dma/dma.txt the
dma-channels and dma-requests property should not have '#'.

Signed-off-by: Peter Ujfalusi <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

According to the Documentation/devicetree/bindings/dma/dma.txt the
dma-channels and dma-requests property should not have '#'.

Signed-off-by: Peter Ujfalusi <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

According to the Documentation/devicetree/bindings/dma/dma.txt the
dma-channels and dma-requests property should not have '#'.

Signed-off-by: Peter Ujfalusi <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

Without this NAND doesn't work on most EVMs.

Signed-off-by: Roger Quadros <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

SATA operation depends on PIPE3 PHY and if we want
to boot from SATA drives, we have to have the PIPE3 PHY
driver built-in.

Signed-off-by: Roger Quadros <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

In commit 87517d2 ("ARM: dts: dra7-evm: Add extcon nodes for USB")
we enabled Extcon USB gpio to tackle the USB ID pin and get
peripheral mode to work.

But the extcon-gpio-usb driver [1] didn't make it into v4.0
and this makes the USB driver defer probe indefinitely breaking
USB Host functionality.

As a temporary fix we remove the extcon handle from the
USB controller and add it back when the extcon driver
merges in v4.1.

[1] - https://lkml.org/lkml/2015/2/2/187

Signed-off-by: Roger Quadros <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

Fixes: http://bugs.elinux.org/issues/127

the bb.org community was seeing random reboots before this change.

Signed-off-by: Robert Nelson <[email protected]>
Reviewed-by: Felipe Balbi <[email protected]>
Acked-by: Felipe Balbi <[email protected]>
Signed-off-by: Tony Lindgren <[email protected]>

This return 0 without setting atomic bits on fb == crtc->cursor->fb
where causing frontbuffer false positives.

According to Daniel:

The original regression seems to have been introduced in the original
check/commit split:

commit 757f9a3
Author: Gustavo Padovan <[email protected]>
Date:   Wed Sep 24 14:20:24 2014 -0300

    drm/i915: move check of intel_crtc_cursor_set_obj() out

Which already cause other trouble, resulting in the check getting moved in

commit e391ea8
Author: Gustavo Padovan <[email protected]>
Date:   Wed Sep 24 14:20:25 2014 -0300

    drm/i915: Fix not checking cursor and object sizes

The frontbuffer tracking itself only was broken when we shifted it into
the check/commit logic with:

commit 32b7eee
Author: Matt Roper <[email protected]>
Date:   Wed Dec 24 07:59:06 2014 -0800

    drm/i915: Refactor work that can sleep out of commit (v7)

v2: When putting more debug prints I notice the solution was simpler
than I thought. AMS design is solid, just this return was wrong.
Sorry for the noise.

v3: Remove the entire chunck that would probably
    be removed by gcc anyway. (by Daniel)

Cc: Jani Nikula <[email protected]>
Cc: Gustavo Padovan <[email protected]>
Cc: Matt Roper <[email protected]>
Signed-off-by: Rodrigo Vivi <[email protected]>
Reviewed-by: Matt Roper <[email protected]>
Reviewed-by: Daniel Vetter <[email protected]>
Signed-off-by: Jani Nikula <[email protected]>

Commit 5d425c1 ("arm64: kernel: add support for cpu cache
information") adds cacheinfo support for ARM64. Since there's no
architectural way of detecting the cpus that share particular cache,
device tree can be used and the core cacheinfo already supports the
same.

This patch adds the L2 cache topology on Juno board, FVP/RTSM and
foundation models.

Signed-off-by: Sudeep Holla <[email protected]>
Cc: Mark Rutland <[email protected]>
Cc: Liviu Dudau <[email protected]>
Cc: Lorenzo Pieralisi <[email protected]>
Signed-off-by: Arnd Bergmann <[email protected]>

…el/git/tmlind/linux-omap into fixes

Fixes for various omap devices. It's all dts and defconfig
changes for this set:

- Fix wrong DMA properties for dma to avoid them getting
  copied wrong again before we start actually using them

- USB fixes to revert the extcon changes as the driver did not
  get merged yet and cause issues

- Omap5 and dra7 fixes to boot from sata

- Fix few am437x issues for i2c and pinctrl

- Fix beaglebone for hardwared USB configuration

- Defconfig changes for NAND, SATA and TPS62362

- Fix n900 i2c numbering for legacy user space and smc91x
  register offset so it works also for qemu

- Fix incomplete USB configuration for dm816x

* tag 'fixes-v4.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: dts: am335x-bone*: usb0 is hardwired for peripheral
  ARM: dts: dra7x-evm: beagle-x15: Fix USB Host
  ARM: omap2plus_defconfig: Fix SATA boot
  ARM: omap2plus_defconfig: Enable OMAP NAND BCH driver
  ARM: dts: dra7: Correct the dma controller's property names
  ARM: dts: omap5: Correct the dma controller's property names
  ARM: dts: omap4: Correct the dma controller's property names
  ARM: dts: omap3: Correct the dma controller's property names
  ARM: dts: omap2: Correct the dma controller's property names
  ARM: dts: am437x-idk: fix sleep pinctrl state
  ARM: omap2plus_defconfig: enable TPS62362 regulator
  ARM: dts: am437x-idk: fix TPS62362 i2c bus
  ARM: dts: n900: Fix offset for smc91x ethernet
  ARM: dts: n900: fix i2c bus numbering
  ARM: dts: Fix USB dts configuration for dm816x
  ARM: dts: OMAP5: Fix SATA PHY node
  ARM: dts: DRA7: Fix SATA PHY node

Commit b7bc596 ("drm/radeon: disable native
backlight control on pre-r6xx asics (v2)") accidently
broke backlight control on old mac laptops that use the
on-GPU backlight controller.

Signed-off-by: Nathan-J. Hirschauer <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]

Just in case it hasn't been calculated for the mode.

Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]

These tend to be problematic even if the vblank period is
long enough.  This needs more investigation across a wider
range of displays.  Disable for now.

bugs:
https://bugs.freedesktop.org/show_bug.cgi?id=87796
https://bugs.freedesktop.org/show_bug.cgi?id=89198

Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]

Dump the whole IB if we run into an invalid packet.
This makes things much easier to debug.

bug:
https://bugs.freedesktop.org/show_bug.cgi?id=89148

Signed-off-by: Alex Deucher <[email protected]>

v2: disable it on suspend

Signed-off-by: Christian König <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>

Signed-off-by: Christian König <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>

Signed-off-by: Christian König <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>

The logic was reversed from what the hw actually exposed.
Fixes graphics corruption in certain harvest configurations.

Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]

The atom aux param interface only supports 4 bits for
the total write transfer size (header + payload).  This
limits us to 12 bytes of payload rather than 16.  Add a
check for this. Reads are not affected.

v2: switch to WARN_ON_ONCE

Reviewed-by: Michel Dänzer <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>

We were enabling DP secondary streams even if the monitor
didn't support them.  Fixes display problems on some DP
monitors.

Tested-by: Jim Boz <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>

Remove this configuration bit in crtc driver as the rising edge clock is widely
used.

Signed-off-by: Boris Brezillon <[email protected]>
Signed-off-by: Nicolas Ferre <[email protected]>

Enable support for shmobile platforms that became multi-platform aware.
Several non-critical drivers and subsystems are built as modules, to keep
kernel size reasonable.

Tested on:
  - r8a73a4/ape6evm:
      - U-Boot fails with "Error: unrecognized/unsupported machine ID",
      - kexec works.
  - r8a7740/armadillo:
      - Hermit boot loader fails (larger image, more memory corruption),
      - kexec works.
  - r8a7791/koelsch,
  - sh73a0/kzm9g:
      - zImage+DTB from U-Boot needs CONFIG_ARM_ATAG_DTB_COMPAT=n,
      - kexec works.
  - am335x/boneblack.

Signed-off-by: Geert Uytterhoeven <[email protected]>
Acked-by: Simon Horman <[email protected]>
Signed-off-by: Arnd Bergmann <[email protected]>

The vdso implementation of clock_getres currently returns 0 (success)
whenever a null timespec is provided by the caller, regardless of the
clock id supplied.

This behavior is incorrect.  It should fall back to syscall when an
unrecognized clock id is passed, even when the timespec argument is
null.  This ensures that clock_getres always returns an error for
invalid clock ids.

Signed-off-by: Nathan Lynch <[email protected]>
Acked-by: Will Deacon <[email protected]>
Signed-off-by: Catalin Marinas <[email protected]>

An arm64 allmodconfig fails to build with GCC 5 due to __asmeq
assertions in the PSCI firmware calling code firing due to mcount
preambles breaking our assumptions about register allocation of function
arguments:

  /tmp/ccDqJsJ6.s: Assembler messages:
  /tmp/ccDqJsJ6.s:60: Error: .err encountered
  /tmp/ccDqJsJ6.s:61: Error: .err encountered
  /tmp/ccDqJsJ6.s:62: Error: .err encountered
  /tmp/ccDqJsJ6.s:99: Error: .err encountered
  /tmp/ccDqJsJ6.s:100: Error: .err encountered
  /tmp/ccDqJsJ6.s:101: Error: .err encountered

This patch fixes the issue by moving the PSCI calls out-of-line into
their own assembly files, which are safe from the compiler's meddling
fingers.

Reported-by: Andy Whitcroft <[email protected]>
Signed-off-by: Will Deacon <[email protected]>
Signed-off-by: Catalin Marinas <[email protected]>

The functions __cpu_flush_user_tlb_range and __cpu_flush_kern_tlb_range
were removed in commit fa48e6f 'arm64: mm: Optimise tlb flush logic
where we have >4K granule'. Global variable cpu_tlb was never used in
arm64.

Remove them.

Signed-off-by: Yingjoe Chen <[email protected]>
Acked-by: Will Deacon <[email protected]>
Signed-off-by: Catalin Marinas <[email protected]>

Caught during Trinity testing. The pte_modify does not allow
modification for PTE type bit. This cause the test to hang
the system. It is found that the PTE can't transit from an
inaccessible page (b00) to a valid page (b11) because the mask
does not allow it. This happens when a big block of mmaped
memory is set the PROT_NONE, then the a small piece is broken
off and set to PROT_WRITE | PROT_READ cause a huge page split.

Signed-off-by: Feng Kan <[email protected]>
Signed-off-by: Catalin Marinas <[email protected]>

This patch increases the interleave factor for parallel AES modes
to 4x. This improves performance on Cortex-A57 by ~35%. This is
due to the 3-cycle latency of AES instructions on the A57's
relatively deep pipeline (compared to Cortex-A53 where the AES
instruction latency is only 2 cycles).

At the same time, disable inline expansion of the core AES functions,
as the performance benefit of this feature is negligible.

  Measured on AMD Seattle (using tcrypt.ko mode=500 sec=1):

  Baseline (2x interleave, inline expansion)
  ------------------------------------------
  testing speed of async cbc(aes) (cbc-aes-ce) decryption
  test 4 (128 bit key, 8192 byte blocks): 95545 operations in 1 seconds
  test 14 (256 bit key, 8192 byte blocks): 68496 operations in 1 seconds

  This patch (4x interleave, no inline expansion)
  -----------------------------------------------
  testing speed of async cbc(aes) (cbc-aes-ce) decryption
  test 4 (128 bit key, 8192 byte blocks): 124735 operations in 1 seconds
  test 14 (256 bit key, 8192 byte blocks): 92328 operations in 1 seconds

Signed-off-by: Ard Biesheuvel <[email protected]>
Signed-off-by: Catalin Marinas <[email protected]>

Patch 2f896d5 ("arm64: use fixmap for text patching") changed
the way we patch the kernel text, using a fixmap when the kernel or
modules are flagged as read only.

Unfortunately, a flaw in the logic makes it fall over when patching
modules without CONFIG_DEBUG_SET_MODULE_RONX enabled:

[...]
[   32.032636] Call trace:
[   32.032716] [<fffffe00003da0dc>] __copy_to_user+0x2c/0x60
[   32.032837] [<fffffe0000099f08>] __aarch64_insn_write+0x94/0xf8
[   32.033027] [<fffffe000009a0a0>] aarch64_insn_patch_text_nosync+0x18/0x58
[   32.033200] [<fffffe000009c3ec>] ftrace_modify_code+0x58/0x84
[   32.033363] [<fffffe000009c4e4>] ftrace_make_nop+0x3c/0x58
[   32.033532] [<fffffe0000164420>] ftrace_process_locs+0x3d0/0x5c8
[   32.033709] [<fffffe00001661cc>] ftrace_module_init+0x28/0x34
[   32.033882] [<fffffe0000135148>] load_module+0xbb8/0xfc4
[   32.034044] [<fffffe0000135714>] SyS_finit_module+0x94/0xc4
[...]

This is triggered by the use of virt_to_page() on a module address,
which ends to pointing to Nowhereland if you're lucky, or corrupt
your precious data if not.

This patch fixes the logic by mimicking what is done on arm:
- If we're patching a module and CONFIG_DEBUG_SET_MODULE_RONX is set,
  use vmalloc_to_page().
- If we're patching the kernel and CONFIG_DEBUG_RODATA is set,
  use virt_to_page().
- Otherwise, use the provided address, as we can write to it directly.

Tested on 4.0-rc1 as a KVM guest.

Reported-by: Richard W.M. Jones <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Acked-by: Mark Rutland <[email protected]>
Acked-by: Laura Abbott <[email protected]>
Tested-by: Richard W.M. Jones <[email protected]>
Cc: Will Deacon <[email protected]>
Signed-off-by: Marc Zyngier <[email protected]>
Signed-off-by: Catalin Marinas <[email protected]>

…inux into drm-fixes

misc radeon fixes.

* 'drm-fixes-4.0' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: only enable DP audio if the monitor supports it
  drm/radeon: fix atom aux payload size check for writes (v2)
  drm/radeon: fix 1 RB harvest config setup for TN/RL
  drm/radeon: enable SRBM timeout interrupt on EG/NI
  drm/radeon: enable SRBM timeout interrupt on SI
  drm/radeon: enable SRBM timeout interrupt on CIK v2
  drm/radeon: dump full IB if we hit a packet error
  drm/radeon: disable mclk switching with 120hz+ monitors
  drm/radeon: use drm_mode_vrefresh() rather than mode->vrefresh
  drm/radeon: enable native backlight control on old macs

…rg/drm-intel into drm-fixes

First batch of fixes for v4.0-rc, plenty of cc: stable material.

* tag 'drm-intel-fixes-2015-02-26' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: Fix frontbuffer false positve.
  drm/i915: Align initial plane backing objects correctly
  drm/i915: avoid processing spurious/shared interrupts in low-power states
  drm/i915: Check obj->vma_list under the struct_mutex
  drm/i915: Fix a use after free, and unbalanced refcounting
  drm/i915: Dell Chromebook 11 has PWM backlight
  drm/i915/skl: handle all pixel formats in skylake_update_primary_plane()
  drm/i915/bdw: PCI IDs ending in 0xb are ULT.

…inux-at91 into drm-fixes

minor atmel hclcdc fixes.

* 'drm-atmel-hlcdc-fixes' of git://github.com/bbrezillon/linux-at91:
  drm: atmel-hlcdc: remove clock polarity from crtc driver
  drm: atmel-hlcdc: remove useless pm_runtime_put_sync in probe
  drm: atmel-hlcdc: reset layer A2Q and UPDATE bits when disabling it

With commit 3690951 (arm64: Use swiotlb late initialisation), the
swiotlb buffer size is limited to MAX_ORDER_NR_PAGES. However, there are
platforms with 32-bit only devices that require bounce buffering via
swiotlb. This patch changes the swiotlb initialisation to an early 64MB
memblock allocation. In order to get the swiotlb buffer correctly
allocated (via memblock_virt_alloc_low_nopanic), this patch also defines
ARCH_LOW_ADDRESS_LIMIT to the maximum physical address capable of 32-bit
DMA.

Reported-by: Kefeng Wang <[email protected]>
Tested-by: Kefeng Wang <[email protected]>
Signed-off-by: Catalin Marinas <[email protected]>

The native (64-bit) sigval_t union contains sival_int (32-bit) and
sival_ptr (64-bit). When a compat application invokes a syscall that
takes a sigval_t value (as part of a larger structure, e.g.
compat_sys_mq_notify, compat_sys_timer_create), the compat_sigval_t
union is converted to the native sigval_t with sival_int overlapping
with either the least or the most significant half of sival_ptr,
depending on endianness. When the corresponding signal is delivered to a
compat application, on big endian the current (compat_uptr_t)sival_ptr
cast always returns 0 since sival_int corresponds to the top part of
sival_ptr. This patch fixes copy_siginfo_to_user32() so that sival_int
is copied to the compat_siginfo_t structure.

Cc: <[email protected]>
Reported-by: Bamvor Jian Zhang <[email protected]>
Tested-by: Bamvor Jian Zhang <[email protected]>
Signed-off-by: Catalin Marinas <[email protected]>

ARM64 CPUidle driver requires the cpu_do_idle function so that it can
be used to enter the shallowest idle state, and it is declared in
asm/proc-fns.h.

The current ARM64 CPUidle driver does not include asm/proc-fns.h
explicitly and it has so far relied on implicit inclusion from other
header files.

Owing to some header dependencies reshuffling this currently triggers
build failures when CONFIG_ARM64_64K_PAGES=y:

drivers/cpuidle/cpuidle-arm64.c: In function "arm64_enter_idle_state"
drivers/cpuidle/cpuidle-arm64.c:42:3: error: implicit declaration of
function "cpu_do_idle" [-Werror=implicit-function-declaration]
   cpu_do_idle();
   ^

This patch adds the explicit inclusion of the asm/proc-fns.h header file
in the arm64 asm/cpuidle.h header file, so that the build breakage is fixed
and the required header inclusion is added to the appropriate arch back-end
CPUidle header, already included by the CPUidle arm64 driver, where
CPUidle arch related function declarations belong.

Reported-by: Laura Abbott <[email protected]>
Signed-off-by: Lorenzo Pieralisi <[email protected]>
Acked-by: Will Deacon <[email protected]>
Tested-by: Mark Rutland <[email protected]>
Signed-off-by: Catalin Marinas <[email protected]>

…cm/linux/kernel/git/horms/renesas

Pull SH driver fix from Simon Horman:
 "Disable PM runtime for multi-platform r8a7740 with genpd"

* tag 'renesas-sh-drivers-for-v4.0' of git://git.kernel.org/pub/scm/linux/kernel/git/horms/renesas:
  drivers: sh: Disable PM runtime for multi-platform r8a7740 with genpd

…git/arm64/linux

Pull arm64 fixes from Catalin Marinas:
 "Various arm64 fixes:
   - ftrace branch generation fix
   - branch instruction encoding fix
   - include files, guards and unused prototypes clean-up
   - minor VDSO ABI fix (clock_getres)
   - PSCI functions moved to .S to avoid compilation error with gcc 5
   - pte_modify fix to not ignore the mapping type
   - crypto: AES interleaved increased to 4x (for performance reasons)
   - text patching fix for modules
   - swiotlb increased back to 64MB
   - copy_siginfo_to_user32() fix for big endian"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: cpuidle: add asm/proc-fns.h inclusion
  arm64: compat Fix siginfo_t -> compat_siginfo_t conversion on big endian
  arm64: Increase the swiotlb buffer size 64MB
  arm64: Fix text patching logic when using fixmap
  arm64: crypto: increase AES interleave to 4x
  arm64: enable PTE type bit in the mask for pte_modify
  arm64: mm: remove unused functions and variable protoypes
  arm64: psci: move psci firmware calls out of line
  arm64: vdso: minor ABI fix for clock_getres
  arm64: guard asm/assembler.h against multiple inclusions
  arm64: insn: fix compare-and-branch encodings
  arm64: ftrace: fix ftrace_modify_graph_caller for branch replace

…nel/git/arm/arm-soc

Pull ARM SoC fixes from Arnd Bergmann:
 "The arm-soc bug fixes this time around are mostly for the omap
  platform, coming from a pull request from Tony Lindgren and are almost
  entirely fixing dts files.

  The other two changes enable support for the shmobile platform in
  generic armv7 kernels and change some properties in the ARM64
  reference board dts files"

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: multi_v7_defconfig: Enable shmobile platforms
  arm64: Add L2 cache topology to ARM Ltd boards/models
  ARM: dts: am335x-bone*: usb0 is hardwired for peripheral
  ARM: dts: dra7x-evm: beagle-x15: Fix USB Host
  ARM: omap2plus_defconfig: Fix SATA boot
  ARM: omap2plus_defconfig: Enable OMAP NAND BCH driver
  ARM: dts: dra7: Correct the dma controller's property names
  ARM: dts: omap5: Correct the dma controller's property names
  ARM: dts: omap4: Correct the dma controller's property names
  ARM: dts: omap3: Correct the dma controller's property names
  ARM: dts: omap2: Correct the dma controller's property names
  ARM: dts: am437x-idk: fix sleep pinctrl state
  ARM: omap2plus_defconfig: enable TPS62362 regulator
  ARM: dts: am437x-idk: fix TPS62362 i2c bus
  ARM: dts: n900: Fix offset for smc91x ethernet
  ARM: dts: n900: fix i2c bus numbering
  ARM: dts: Fix USB dts configuration for dm816x
  ARM: dts: OMAP5: Fix SATA PHY node
  ARM: dts: DRA7: Fix SATA PHY node

We (the Ocfs2 project) recently moved the location of our ocfs2-tools
git tree and project web page.  The pertinent discussion can be seen
here:

  https://oss.oracle.com/pipermail/ocfs2-devel/2015-February/010579.html

The following patch updates the Ocfs2 documentation in MAINTAINERS,
ocfs2.txt, and dlmfs.txt.  I added our new official web page, changed
the location of our tools git tree and removed the link to Joel's
ancient kernel git tree - Andrew has handled our patches for a while
now.

Signed-off-by: Mark Fasheh <[email protected]>
Cc: Joel Becker <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Maxime reported the following memory leak regression due to commit
dbc8358 ("mm/nommu: use alloc_pages_exact() rather than its own
implementation").

On v3.19, I am facing a memory leak.  Each time I run a command one page
is lost.  Here an example with busybox's free command:

  / # free
               total       used       free     shared    buffers     cached
  Mem:          7928       1972       5956          0          0        492
  -/+ buffers/cache:       1480       6448
  / # free
               total       used       free     shared    buffers     cached
  Mem:          7928       1976       5952          0          0        492
  -/+ buffers/cache:       1484       6444
  / # free
               total       used       free     shared    buffers     cached
  Mem:          7928       1980       5948          0          0        492
  -/+ buffers/cache:       1488       6440
  / # free
               total       used       free     shared    buffers     cached
  Mem:          7928       1984       5944          0          0        492
  -/+ buffers/cache:       1492       6436
  / # free
               total       used       free     shared    buffers     cached
  Mem:          7928       1988       5940          0          0        492
  -/+ buffers/cache:       1496       6432

At some point, the system fails to sastisfy 256KB allocations:

  free: page allocation failure: order:6, mode:0xd0
  CPU: 0 PID: 67 Comm: free Not tainted 3.19.0-05389-gacf2cf1-dirty #64
  Hardware name: STM32 (Device Tree Support)
    show_stack+0xb/0xc
    warn_alloc_failed+0x97/0xbc
    __alloc_pages_nodemask+0x295/0x35c
    __get_free_pages+0xb/0x24
    alloc_pages_exact+0x19/0x24
    do_mmap_pgoff+0x423/0x658
    vm_mmap_pgoff+0x3f/0x4e
    load_flat_file+0x20d/0x4f8
    load_flat_binary+0x3f/0x26c
    search_binary_handler+0x51/0xe4
    do_execveat_common+0x271/0x35c
    do_execve+0x19/0x1c
    ret_fast_syscall+0x1/0x4a
  Mem-info:
  Normal per-cpu:
  CPU    0: hi:    0, btch:   1 usd:   0
  active_anon:0 inactive_anon:0 isolated_anon:0
   active_file:0 inactive_file:0 isolated_file:0
   unevictable:123 dirty:0 writeback:0 unstable:0
   free:1515 slab_reclaimable:17 slab_unreclaimable:139
   mapped:0 shmem:0 pagetables:0 bounce:0
   free_cma:0
  Normal free:6060kB min:352kB low:440kB high:528kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:492kB isolated(anon):0ks
  lowmem_reserve[]: 0 0
  Normal: 23*4kB (U) 22*8kB (U) 24*16kB (U) 23*32kB (U) 23*64kB (U) 23*128kB (U) 1*256kB (U) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 6060kB
  123 total pagecache pages
  2048 pages of RAM
  1538 free pages
  66 reserved pages
  109 slab pages
  -46 pages shared
  0 pages swap cached
  nommu: Allocation of length 221184 from process 67 (free) failed
  Normal per-cpu:
  CPU    0: hi:    0, btch:   1 usd:   0
  active_anon:0 inactive_anon:0 isolated_anon:0
   active_file:0 inactive_file:0 isolated_file:0
   unevictable:123 dirty:0 writeback:0 unstable:0
   free:1515 slab_reclaimable:17 slab_unreclaimable:139
   mapped:0 shmem:0 pagetables:0 bounce:0
   free_cma:0
  Normal free:6060kB min:352kB low:440kB high:528kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:492kB isolated(anon):0ks
  lowmem_reserve[]: 0 0
  Normal: 23*4kB (U) 22*8kB (U) 24*16kB (U) 23*32kB (U) 23*64kB (U) 23*128kB (U) 1*256kB (U) 0*512kB 0*1024kB 0*2048kB 0*4096kB = 6060kB
  123 total pagecache pages
  Unable to allocate RAM for process text/data, errno 12 SEGV

This problem happens because we allocate ordered page through
__get_free_pages() in do_mmap_private() in some cases and we try to free
individual pages rather than ordered page in free_page_series().  In
this case, freeing pages whose refcount is not 0 won't be freed to the
page allocator so memory leak happens.

To fix the problem, this patch changes __get_free_pages() to
alloc_pages_exact() since alloc_pages_exact() returns
physically-contiguous pages but each pages are refcounted.

Fixes: dbc8358 ("mm/nommu: use alloc_pages_exact() rather than its own implementation").
Reported-by: Maxime Coquelin <[email protected]>
Tested-by: Maxime Coquelin <[email protected]>
Signed-off-by: Joonsoo Kim <[email protected]>
Cc: <[email protected]>	[3.19]
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

A memcg is considered low limited even when the current usage is equal to
the low limit.  This leads to interesting side effects e.g.
groups/hierarchies with no memory accounted are considered protected and
so the reclaim will emit MEMCG_LOW event when encountering them.

Another and much bigger issue was reported by Joonsoo Kim.  He has hit a
NULL ptr dereference with the legacy cgroup API which even doesn't have
low limit exposed.  The limit is 0 by default but the initial check fails
for memcg with 0 consumption and parent_mem_cgroup() would return NULL if
use_hierarchy is 0 and so page_counter_read would try to dereference NULL.

I suppose that the current implementation is just an overlook because the
documentation in Documentation/cgroups/unified-hierarchy.txt says:

  "The memory.low boundary on the other hand is a top-down allocated
  reserve.  A cgroup enjoys reclaim protection when it and all its
  ancestors are below their low boundaries"

Fix the usage and the low limit comparision in mem_cgroup_low accordingly.

Fixes: 241994e (mm: memcontrol: default hierarchy interface for memory)
Reported-by: Joonsoo Kim <[email protected]>
Signed-off-by: Michal Hocko <[email protected]>
Acked-by: Johannes Weiner <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

The newly added ds1685 driver causes a build error when enabled without
CONFIG_RTC_INTF_DEV:

  drivers/rtc/rtc-ds1685.c:919:22: error: 'ds1685_rtc_alarm_irq_enable' undeclared here (not in a function)
    .alarm_irq_enable = ds1685_rtc_alarm_irq_enable,

Apparently the driver was incorrectly changed to reflect the interface
change from 16380c1 ("RTC: Convert rtc drivers to use the
alarm_irq_enable method"), which removed the respective #ifdef from all
other rtc drivers.

This does the same change that was merged for the other drivers before and
removes the #ifdef, allowing the interrupts to be enabled through the
in-kernel rtc interface independent of the existence of /dev/rtc.

Fixes: aaaf5fb ("rtc: add driver for DS1685 family of real time clocks")
Signed-off-by: Arnd Bergmann <[email protected]>
Acked-by: Joshua Kinard <[email protected]>
Cc: Ralf Baechle <[email protected]>
Cc: Alessandro Zummo <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

drivers/rtc/rtc-ds1685.c: In function `ds1685_rtc_read_alarm':
drivers/rtc/rtc-ds1685.c:402: warning: comparison is always true due to limited range of data type
drivers/rtc/rtc-ds1685.c:409: warning: comparison is always true due to limited range of data type
drivers/rtc/rtc-ds1685.c:416: warning: comparison is always true due to limited range of data type
drivers/rtc/rtc-ds1685.c: In function `ds1685_rtc_set_alarm':
drivers/rtc/rtc-ds1685.c:475: warning: comparison is always true due to limited range of data type
drivers/rtc/rtc-ds1685.c:478: warning: comparison is always true due to limited range of data type
drivers/rtc/rtc-ds1685.c:481: warning: comparison is always true due to limited range of data type

u8 cannot contain a value larger than 0xff, hence drop the checks.
Wrapping the checks in unlikely() indicated some sense of humor, though ;-)

Signed-off-by: Geert Uytterhoeven <[email protected]>
Acked-by: Joshua Kinard <[email protected]>
Cc: Alessandro Zummo <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

This got lost during the initial merge process: Python requires an
__init__.py script, even if empty, in order to accept a directory as
package.  Add it, this time as a non-empty file.

Signed-off-by: Jan Kiszka <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Each inode of nilfs2 stores a root node of a b-tree, and it turned out to
have a memory overrun issue:

Each b-tree node of nilfs2 stores a set of key-value pairs and the number
of them (in "bn_nchildren" member of nilfs_btree_node struct), as well as
a few other "bn_*" members.

Since the value of "bn_nchildren" is used for operations on the key-values
within the b-tree node, it can cause memory access overrun if a large
number is incorrectly set to "bn_nchildren".

For instance, nilfs_btree_node_lookup() function determines the range of
binary search with it, and too large "bn_nchildren" leads
nilfs_btree_node_get_key() in that function to overrun.

As for intermediate b-tree nodes, this is prevented by a sanity check
performed when each node is read from a drive, however, no sanity check
has been done for root nodes stored in inodes.

This patch fixes the issue by adding missing sanity check against b-tree
root nodes so that it's called when on-memory inodes are read from ifile,
inode metadata file.

Signed-off-by: Ryusuke Konishi <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

…gs_{show,store}

Fix a conditional statement checking for NULL in both
ds1685_rtc_sysfs_time_regs_show and ds1685_rtc_sysfs_time_regs_store
that was using a logical AND when it should be using a logical OR so
that we fail out of the function properly if the condition ever
evaluates to true.

Fixes: aaaf5fb ("rtc: add driver for DS1685 family of real time clocks")
Signed-off-by: Joshua Kinard <[email protected]>
Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

max_used_pages is defined as atomic_long_t so we need to use unsigned
long to keep temporary value for it rather than int which is smaller
than unsigned long in a 64 bit system.

Signed-off-by: Joonsoo Kim <[email protected]>
Cc: Minchan Kim <[email protected]>
Cc: Jerome Marchand <[email protected]>
Cc: Nitin Gupta <[email protected]>
Cc: Sergey Senozhatsky <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

The memcg control knobs indicate the highest possible value using the
symbolic name "infinity", which is long and awkward to type.

Switch to the string "max", which is just as descriptive but shorter and
sweeter.

This changes a user interface, so do it before the release and before
the development flag is dropped from the default hierarchy.

Signed-off-by: Johannes Weiner <[email protected]>
Cc: Michal Hocko <[email protected]>
Cc: Tejun Heo <[email protected]>
Cc: Vladimir Davydov <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

There's a uname workaround for broken userspace which can't handle kernel
versions of 3.x.  Update it for 4.x.

Signed-off-by: Jon DeVree <[email protected]>
Cc: Andi Kleen <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Historically, !__GFP_FS allocations were not allowed to invoke the OOM
killer once reclaim had failed, but nevertheless kept looping in the
allocator.

Commit 9879de7 ("mm: page_alloc: embed OOM killing naturally into
allocation slowpath"), which should have been a simple cleanup patch,
accidentally changed the behavior to aborting the allocation at that
point.  This creates problems with filesystem callers (?) that currently
rely on the allocator waiting for other tasks to intervene.

Revert the behavior as it shouldn't have been changed as part of a
cleanup patch.

Fixes: 9879de7 ("mm: page_alloc: embed OOM killing naturally into allocation slowpath")
Signed-off-by: Johannes Weiner <[email protected]>
Acked-by: Michal Hocko <[email protected]>
Reported-by: Tetsuo Handa <[email protected]>
Cc: Theodore Ts'o <[email protected]>
Cc: Dave Chinner <[email protected]>
Acked-by: David Rientjes <[email protected]>
Cc: Oleg Nesterov <[email protected]>
Cc: Mel Gorman <[email protected]>
Cc: <[email protected]>	[3.19.x]
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Core mm expects __PAGETABLE_{PUD,PMD}_FOLDED to be defined if these page
table levels folded.  Usually, these defines are provided by
<asm-generic/pgtable-nopmd.h> and <asm-generic/pgtable-nopud.h>.

But some architectures fold page table levels in a custom way.  They
need to define these macros themself.  This patch adds missing defines.

The patch fixes mm->nr_pmds underflow and eliminates dead __pmd_alloc()
and __pud_alloc() on architectures without these page table levels.

Signed-off-by: Kirill A. Shutemov <[email protected]>
Cc: Aaro Koskinen <[email protected]>
Cc: David Howells <[email protected]>
Cc: Geert Uytterhoeven <[email protected]>
Cc: Heiko Carstens <[email protected]>
Cc: Helge Deller <[email protected]>
Cc: "James E.J. Bottomley" <[email protected]>
Cc: Koichi Yasutake <[email protected]>
Cc: Martin Schwidefsky <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

Merge misc fixes from Andrew Morton:
 "13 fixes"

* emailed patches from Andrew Morton <[email protected]>:
  mm: add missing __PAGETABLE_{PUD,PMD}_FOLDED defines
  mm: page_alloc: revert inadvertent !__GFP_FS retry behavior change
  kernel/sys.c: fix UNAME26 for 4.0
  mm: memcontrol: use "max" instead of "infinity" in control knobs
  zram: use proper type to update max_used_pages
  drivers/rtc/rtc-ds1685.c: fix conditional in ds1685_rtc_sysfs_time_regs_{show,store}
  nilfs2: fix potential memory overrun on inode
  scripts/gdb: add empty package initialization script
  rtc: ds1685: remove superfluous checks for out-of-range u8 values
  rtc: ds1685: fix ds1685_rtc_alarm_irq_enable build error
  memcg: fix low limit calculation
  mm/nommu: fix memory leak
  ocfs2: update web page + git tree in documentation

…ux/kernel/git/dgc/linux-xfs

Pull xfs fixes from Dave Chinner:
 "These are fixes for regressions/bugs introduced in the 4.0 merge cycle
  and problems discovered during the merge window that need to be pushed
  back to stable kernels ASAP.

  This contains:
   - ensure quota type is reset in on-disk dquots
   - fix missing partial EOF block data flush on truncate extension
   - fix transaction leak in error handling for new pnfs block layout
     support
   - add missing target_ip check to RENAME_EXCHANGE"

* tag 'xfs-for-linus-4.0-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs:
  xfs: cancel failed transaction in xfs_fs_commit_blocks()
  xfs: Ensure we have target_ip for RENAME_EXCHANGE
  xfs: ensure truncate forces zeroed blocks to disk
  xfs: Fix quota type in quota structures when reusing quota file

Pull block layer fixes from Jens Axboe:
 "Two smaller fixes for this cycle:

   - A fixup from Keith so that NVMe compiles without BLK_INTEGRITY,
     basically just moving the code around appropriately.

   - A fixup for shm, fixing an oops in shmem_mapping() for mapping with
     no inode.  From Sasha"

[ The shmem fix doesn't look block-layer-related, but fixes a bug that
  happened due to the backing_dev_info removal..  - Linus ]

* 'for-linus' of git://git.kernel.dk/linux-block:
  mm: shmem: check for mapping owner before dereferencing
  NVMe: Fix for BLK_DEV_INTEGRITY not set

Pull drm fixes from Dave Airlie:
 "Just general fixes: radeon, i915, atmel, tegra, amdkfd and one core
  fix"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (28 commits)
  drm: atmel-hlcdc: remove clock polarity from crtc driver
  drm/radeon: only enable DP audio if the monitor supports it
  drm/radeon: fix atom aux payload size check for writes (v2)
  drm/radeon: fix 1 RB harvest config setup for TN/RL
  drm/radeon: enable SRBM timeout interrupt on EG/NI
  drm/radeon: enable SRBM timeout interrupt on SI
  drm/radeon: enable SRBM timeout interrupt on CIK v2
  drm/radeon: dump full IB if we hit a packet error
  drm/radeon: disable mclk switching with 120hz+ monitors
  drm/radeon: use drm_mode_vrefresh() rather than mode->vrefresh
  drm/radeon: enable native backlight control on old macs
  drm/i915: Fix frontbuffer false positve.
  drm/i915: Align initial plane backing objects correctly
  drm/i915: avoid processing spurious/shared interrupts in low-power states
  drm/i915: Check obj->vma_list under the struct_mutex
  drm/i915: Fix a use after free, and unbalanced refcounting
  drm: atmel-hlcdc: remove useless pm_runtime_put_sync in probe
  drm: atmel-hlcdc: reset layer A2Q and UPDATE bits when disabling it
  drm: Fix deadlock due to getconnector locking changes
  drm/i915: Dell Chromebook 11 has PWM backlight
  ...