Pull drm fixes from Dave Airlie:
 "This looks bigger than it is, as one of the nouveau firmware fixes
  ("drm/gf100-/gr: report class data to host on fwmthd failure")
  regenerates a bunch of the firmware files after changing the assembly
  by a few lines, without that, its more of a

    36 files changed, 370 insertions(+), 129 deletions(-)

  It contains some vt.c fixes acked by Greg, for rare hard hangs on i915
  loading, that also fixes hangs on reload and spurious register write
  errors.

  drm core: one fix for uninit memory

  nouveau: displayport rework caused a few regressions, Ben has been
     fixing them as the appear, along with some other fixes

  radeon: pageflipping regression fix, deep color fix, mode validation
     fixes

  i915: fbc disable, vga console kick off, backlight fix, divide-by-zero
     fix"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (33 commits)
  drm: fix uninitialized acquire_ctx fields (v2)
  drm/radeon: Fix radeon_irq_kms_pflip_irq_get/put() imbalance
  Revert "drm/radeon: remove drm_vblank_get|put from pflip handling"
  drm/radeon: improve dvi_mode_valid
  drm/radeon: update mode_valid testing for DP
  drm/radeon: Use dce5/6 hdmi deep color clock setup also on dce8+
  drm/nouveau/disp: fix oops in destructor with headless cards
  drm/gf117/i2c: no aux channels on this chipset
  drm/nouveau/doc: update the thermal documentation
  drm/nouveau/pwr: fix typo in fifo wrap handling
  drm/nv50/disp: fix a potential oops in supervisor handling
  drm/nouveau/disp/dp: don't touch link config after success
  drm/nouveau/kms: reference vblank for crtc during pageflip.
  drm/gk104/fb/ram: fixups from an earlier search+replace
  drm/nv50/gr: remove an unneeded write while initialising PGRAPH
  drm/nv50/gr: fix overlap while zeroing zcull regions
  drm/gf100-/gr: report class data to host on fwmthd failure
  drm/gk104/ibus: increase various random timeouts
  drm/gk104/clk: only touch divider for mode we'll be using
  drm/radeon: Bypass hw lut's for > 8 bpc framebuffer scanout.
  ...

Pull block fixes from Jens Axboe:
 "A smaller collection of fixes for the block core that would be nice to
  have in -rc2.  This pull request contains:

   - Fixes for races in the wait/wakeup logic used in blk-mq from
     Alexander.  No issues have been observed, but it is definitely a
     bit flakey currently.  Alternatively, we may drop the cyclic
     wakeups going forward, but that needs more testing.

   - Some cleanups from Christoph.

   - Fix for an oops in null_blk if queue_mode=1 and softirq completions
     are used.  From me.

   - A fix for a regression caused by the chunk size setting.  It
     inadvertently used max_hw_sectors instead of max_sectors, which is
     incorrect, and causes hangs on btrfs multi-disk setups (where hw
     sectors apparently isn't set).  From me.

   - Removal of WQ_POWER_EFFICIENT in the kblockd creation.  This was a
     recent addition as well, but it actually breaks blk-mq which relies
     on strict scheduling.  If the workqueue power_efficient mode is
     turned on, this breaks blk-mq.  From Matias.

   - null_blk module parameter description fix from Mike"

* 'for-linus' of git://git.kernel.dk/linux-block:
  blk-mq: bitmap tag: fix races in bt_get() function
  blk-mq: bitmap tag: fix race on blk_mq_bitmap_tags::wake_cnt
  blk-mq: bitmap tag: fix races on shared ::wake_index fields
  block: blk_max_size_offset() should check ->max_sectors
  null_blk: fix softirq completions for queue_mode == 1
  blk-mq: merge blk_mq_drain_queue and __blk_mq_drain_queue
  blk-mq: properly drain stopped queues
  block: remove WQ_POWER_EFFICIENT from kblockd
  null_blk: fix name and description of 'queue_mode' module parameter
  block: remove elv_abort_queue and blk_abort_flushes

Pull ARM SoC fixes from Arnd Bergmann:
 "A first set of bug fixes that didn't make it for the merge window, and
  two Kconfig cleanups that still make sense at this point.

  Unfortunately, one of the two cleanups caused an unintended change in
  the original version, so we had to revert one part of it and do some
  more testing to ensure the rest is really fine.  There was also a
  last-minute rebase of the patches to remove another bad commit"

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: use menuconfig for sub-arch menus
  ARM: multi_v7_defconfig: re-enable SDHCI drivers
  ARM: EXYNOS: Fix compilation warning
  ARM: exynos: move sysram info to exynos.c
  ARM: dts: Specify the NAND ECC scheme explicitly on Armada 385 DB board
  ARM: dts: Specify the NAND ECC scheme explicitly on Armada 375 DB board
  ARM: exynos: cleanup kconfig option display
  misc: vexpress: fix error handling vexpress_syscfg_regmap_init()
  ARM: Remove ARCH_HAS_CPUFREQ config option
  ARM: integrator: fix section mismatch problem
  ARM: mvebu: DT: fix OpenBlocks AX3-4 RAM size
  ARM: samsung: make SAMSUNG_DMADEV optional
  remoteproc: da8xx: don't select CMA on no-MMU
  bus/arm-cci: add dependency on OF && CPU_V7
  ARM: keystone requires ARM_PATCH_PHYS_VIRT
  ARM: omap2: fix am43xx dependency on l2x0 cache

Pull security maintainership update from James Morris:
 "Add Serge Hallyn as security subsystem co-maintainer"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  security: add Serge Hallyn as a maintainer

Pull Xen fixes from David Vrabel:
 "Xen regression and PVH fixes for 3.16-rc1

   - fix dom0 PVH memory setup on latest unstable Xen releases
   - fix 64-bit x86 PV guest boot failure on Xen 3.1 and earlier
   - fix resume regression on non-PV (auto-translated physmap) guests"

* tag 'stable/for-linus-3.16-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/grant-table: fix suspend for non-PV guests
  x86/xen: no need to explicitly register an NMI callback
  Revert "xen/pvh: Update E820 to work with PVH (v2)"
  x86/xen: fix memory setup for PVH dom0

Pull arm64 fixes from Catalin Marinas:
 "These are primarily bug fixes with a performance improvement patch for
  the GHASH crypto algorithm (which went in during this merging window)
  and dts/defconfig/Kconfig updates.

   - ftrace_return_addr() macro fix for arm (introduced earlier via the
     arm64 tree)
   - stack alignment exception entry code fix
   - GHASH crypto algorithm fix and performance improvement
   - CMA buffer limited to 32-bit (until a better way to describe the
     system topology in DT)
   - UAPI sigcontext.h build fix
   - __kernel_old_{gid,uid}_t definitions fix (affecting 32-bit LTP)
   - ptrace fixes (kernel fault and 32-bit arm core dump)
   - pte_mknotpresent() fix
   - dts updates (APM SoC)
   - defconfig and Kconfig update"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: mm: remove broken &= operator from pmd_mknotpresent
  arm64: fix build error in sigcontext.h
  arm64: dts: Add more serial port nodes in APM X-Gene device tree
  arm64/dma: Removing ARCH_HAS_DMA_GET_REQUIRED_MASK macro
  arm64: ptrace: fix empty registers set in prstatus of aarch32 process core
  arm64: uid16: fix __kernel_old_{gid,uid}_t definitions
  arm64: ptrace: change fs when passing kernel pointer to regset code
  arm64: Limit the CMA buffer to 32-bit if ZONE_DMA
  arm/ftrace: fix ftrace_return_addr() to ftrace_return_address()
  arm64/crypto: improve performance of GHASH algorithm
  arm64/crypto: fix data corruption bug in GHASH algorithm
  arm64: defconfig update for LTP
  arm64: ftrace: Fix comment typo 'CONFIG_FUNCTION_GRAPH_FP_TEST'
  arm64: add ARCH_HAS_OPP to allow enabling OPP library
  arm64: restore alphabetic order in Kconfig
  arm64: Bug fix in stack alignment exception

Pull sparc fixes from David Miller:
 "Sparc sparse fixes from Sam Ravnborg"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next: (67 commits)
  sparc64: fix sparse warnings in int_64.c
  sparc64: fix sparse warning in ftrace.c
  sparc64: fix sparse warning in kprobes.c
  sparc64: fix sparse warning in kgdb_64.c
  sparc64: fix sparse warnings in compat_audit.c
  sparc64: fix sparse warnings in init_64.c
  sparc64: fix sparse warnings in aes_glue.c
  sparc: fix sparse warnings in smp_32.c + smp_64.c
  sparc64: fix sparse warnings in perf_event.c
  sparc64: fix sparse warnings in kprobes.c
  sparc64: fix sparse warning in tsb.c
  sparc64: clean up compat_sigset_t.seta handling
  sparc64: fix sparse "Should it be static?" warnings in signal32.c
  sparc64: fix sparse warnings in sys_sparc32.c
  sparc64: fix sparse warning in pci.c
  sparc64: fix sparse warnings in smp_64.c
  sparc64: fix sparse warning in prom_64.c
  sparc64: fix sparse warning in btext.c
  sparc64: fix sparse warnings in sys_sparc_64.c + unaligned_64.c
  sparc64: fix sparse warning in process_64.c
  ...

Conflicts:
	arch/sparc/include/asm/pgtable_64.h

First round of fixes for 3.16-rc, mostly cc: stable, and the vt/vgacon
fixes from Daniel [1] to avoid hangs and unclaimed register errors on
module load/reload.

* tag 'drm-intel-fixes-2014-06-17' of git://anongit.freedesktop.org/drm-intel:
  drm/i915/bdw: remove erroneous chv specific workarounds from bdw code
  drm/i915: fix possible refcount leak when resetting forcewake
  drm/i915: Reorder semaphore deadlock check
  drm/i95: Initialize active ring->pid to -1
  drm/i915: set backlight duty cycle after backlight enable for gen4
  drm/i915: Avoid div-by-zero when pixel_multiplier is zero
  drm/i915: Disable FBC by default also on Haswell and later
  drm/i915: Kick out vga console
  drm/i915: Fixup global gtt cleanup
  vt: Don't ignore unbind errors in vt_unbind
  vt: Fix up unregistration of vt drivers
  vt: Fix replacement console check when unbinding

The acquire ctx will typically be declared on the stack, which means we
could have garbage values for any uninitialized field.  In this case, it
was triggering WARN_ON()s because 'contended' had garbage value.

Go ahead and use memset() to be more future-proof.

v2: now with extra brown paper bag
Reported-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Rob Clark <robdclark@gmail.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Tested-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

mode validation, deep color and pageflipping fixes.

* 'drm-fixes-3.16' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: Fix radeon_irq_kms_pflip_irq_get/put() imbalance
  Revert "drm/radeon: remove drm_vblank_get|put from pflip handling"
  drm/radeon: improve dvi_mode_valid
  drm/radeon: update mode_valid testing for DP
  drm/radeon: Use dce5/6 hdmi deep color clock setup also on dce8+

Fixes a regression in 3.16-rc1 compared to 3.15.

The unbalanced calls would presumably result in the page flip interrupts
never getting disabled once they are enabled.
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

This reverts commit 75f36d86.

drm_vblank_get() is necessary to ensure the DRM vblank counter value is
up to date in drm_send_vblank_event().

Seems to fix weston hangs waiting for page flips to complete.
Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

Make sure we have an HDMI monitor before validating modes with
clocks >165 Mhz on single link connections.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

When we have a passive adapter validate the clocks
against the HMDI/DVI limits.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

Need to use the adjusted clock on dce8 as well.

bug:
https://bugs.freedesktop.org/show_bug.cgi?id=80029Signed-off-by: Mario Kleiner <mario.kleiner.de@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

This should be a plain old '&' and could easily lead to undefined
behaviour if the target of a pmd_mknotpresent invocation was the same
as the parameter.

Fixes: 9c7e535f (arm64: mm: Route pmd thp functions through pte equivalents)
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: <stable@vger.kernel.org> # v3.15
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

I'm seeing this build failure for arm64:

    CC [M]  Documentation/filesystems/configfs/configfs_example_macros.o
  In file included from /usr/include/bits/sigcontext.h:27:0,
                   from /usr/include/signal.h:340,
                   from /usr/include/sys/wait.h:30,
                   from Documentation/accounting/getdelays.c:24:
  .../linux/usr/include/asm/sigcontext.h:61:2: error: unknown type name ‘u64’
    u64 esr;
    ^
  make[2]: *** [Documentation/accounting/getdelays] Error 1

This was introduced by commit 15af1942:

  arm64: Expose ESR_EL1 information to user when SIGSEGV/SIGBUS

Using __u64 instead of u64 fixes the problem.
Signed-off-by: Mark Salter <msalter@redhat.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

APM X-Gene Storm SoC supports 4 serial ports. This patch adds device nodes
for serial ports 1 to 3 (a device node for serial port 0 is already present
in the dts file).
This patch also sets the compatible property of serial nodes to "ns16550a".
Signed-off-by: Vinayak Kale <vkale@apm.com>
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Arm64 does not define dma_get_required_mask() function.
Therefore, it should not define the ARCH_HAS_DMA_GET_REQUIRED_MASK.
This causes build errors in some device drivers (e.g. mpt2sas)
Signed-off-by: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: <stable@vger.kernel.org>

Currently core file of aarch32 process prstatus note has empty
registers set. As result aarch32 core files create by V8 kernel are
not very useful.

It happens because compat_gpr_get and compat_gpr_set functions can
copy registers values to/from either kbuf or ubuf. ELF core file
collection function fill_thread_core_info calls compat_gpr_get
with kbuf set and ubuf set to 0. But current compat_gpr_get and
compat_gpr_set function handle copy to/from only ubuf case.

Fix is to handle kbuf and ubuf as two separate cases in similar
way as other functions like user_regset_copyout, user_regset_copyin do.
Signed-off-by: Victor Kamensky <victor.kamensky@linaro.org>
Acked-by: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Whilst native arm64 applications don't have the 16-bit UID/GID syscalls
wired up, compat tasks can still access them. The 16-bit wrappers for
these syscalls use __kernel_old_uid_t and __kernel_old_gid_t, which must
be 16-bit data types to maintain compatibility with the 16-bit UIDs used
by compat applications.

This patch defines 16-bit __kernel_old_{gid,uid}_t types for arm64
instead of using the 32-bit types provided by asm-generic.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Our compat PTRACE_POKEUSR implementation simply passes the user data to
regset_copy_from_user after some simple range checking. Unfortunately,
the data in question has already been copied to the kernel stack by this
point, so the subsequent access_ok check fails and the ptrace request
returns -EFAULT. This causes problems tracing fork() with older versions
of strace.

This patch briefly changes the fs to KERNEL_DS, so that the access_ok
check passes even with a kernel address.
Signed-off-by: Will Deacon <will.deacon@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

When the CMA buffer is allocated, it is too early to know whether
devices will require ZONE_DMA memory. This patch limits the CMA buffer
to (DMA_BIT_MASK(32) + 1) if CONFIG_ZONE_DMA is enabled.

In addition, it computes the dma_to_phys(DMA_BIT_MASK(32)) before the
increment (no current functional change).
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

The clean up of CALLER_ADDR*() functions required the archs to either
use the default __builtin_return_address(X) (where X > 0) or override
it with something the arch can use. To override it, the arch would
define ftrace_return_address(x).

The arm architecture requires this to be redefined but instead of
defining ftrace_return_address(x) it defined ftrace_return_addr(x).

Fixes: eed542d6 (ftrace: Make CALLER_ADDRx macros more generic)
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

This patches modifies the GHASH secure hash implementation to switch to a
faster, polynomial multiplication based reduction instead of one that uses
shifts and rotates.
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

This fixes a bug in the GHASH algorithm resulting in the calculated hash to be
incorrect if the input is presented in chunks whose size is not a multiple of
16 bytes.
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Fixes: fdd23894 ("arm64/crypto: GHASH secure hash using ARMv8 Crypto Extensions")
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

This patch adds several defconfig options required primarily by the LTP
test suite.
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Signed-off-by: Paul Bolle <pebolle@tiscali.nl>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

The Operating Performance Point (OPP) Layer library is a generic
library used by CPUFREQ and DEVFREQ. It can be enabled only on the
platforms that specify ARCH_HAS_OPP option.

This patch selects that option in order to allow ARM64 based platforms
to use OPP library.
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

The value of ESR has been stored into x1, and should be directly pass to
do_sp_pc_abort function, "MOV x1, x25" is an extra operation and do_sp_pc_abort
will get the wrong value of ESR.
Signed-off-by: ChiaHao <andy.jhshiu@gmail.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: <stable@vger.kernel.org>

Commit aa8532c3 (xen: refactor suspend
pre/post hooks) broke resuming PVHVM (auto-translated physmap) guests.

The gnttab_suspend() would clear the mapping for the grant table
frames, but the ->unmap_frames() call is only applicable to PV guests.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reported-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

Remove xen_enable_nmi() to fix a 64-bit guest crash when registering
the NMI callback on Xen 3.1 and earlier.

It's not needed since the NMI callback is set by a set_trap_table
hypercall (in xen_load_idt() or xen_write_idt_entry()).

It's also broken since it only set the current VCPU's callback.
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Reported-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Tested-by: Vitaly Kuznetsov <vkuznets@redhat.com>

Add Serge E. Hallyn <serge@hallyn.com> as a co-maintainer of the
security subsystem, to avoid having a single point of failure
in the development process.
Signed-off-by: James Morris <james.l.morris@oracle.com>

Merge branch 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-next

couple more DP regression fixes.
* 'drm-nouveau-next' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
  drm/nouveau/disp: fix oops in destructor with headless cards
  drm/gf117/i2c: no aux channels on this chipset

If init doesn't run then disp->outp might not be initialized, resulting
in an oops.
Signed-off-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

Reported-by: Maarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>

This update fixes few issues in bt_get() function:

- list_empty(&wait.task_list) check is not protected;

- was_empty check is always true which results in *every* thread
  entering the loop resets bt_wait_state::wait_cnt counter rather
  than every bt->wake_cnt'th thread;

- 'bt_wait_state::wait_cnt' counter update is redundant, since
  it also gets reset in bt_clear_tag() function;

Cc: Christoph Hellwig <hch@infradead.org>
Cc: Ming Lei <tom.leiming@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Alexander Gordeev <agordeev@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>

This piece of code in bt_clear_tag() function is racy:

	bs = bt_wake_ptr(bt);
	if (bs && atomic_dec_and_test(&bs->wait_cnt)) {
		atomic_set(&bs->wait_cnt, bt->wake_cnt);
 		wake_up(&bs->wait);
	}

Since nothing prevents bt_wake_ptr() from returning the very
same 'bs' address on multiple CPUs, the following scenario is
possible:

    CPU1                                CPU2
    ----                                ----

0.  bs = bt_wake_ptr(bt);               bs = bt_wake_ptr(bt);
1.  atomic_dec_and_test(&bs->wait_cnt)
2.                                      atomic_dec_and_test(&bs->wait_cnt)
3.  atomic_set(&bs->wait_cnt, bt->wake_cnt);

If the decrement in [1] yields zero then for some amount of time
the decrement in [2] results in a negative/overflow value, which
is not expected. The follow-up assignment in [3] overwrites the
invalid value with the batch value (and likely prevents the issue
from being severe) which is still incorrect and should be a lesser.

Cc: Ming Lei <tom.leiming@gmail.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Alexander Gordeev <agordeev@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>

Fix racy updates of shared blk_mq_bitmap_tags::wake_index
and blk_mq_hw_ctx::wake_index fields.

Cc: Ming Lei <tom.leiming@gmail.com>
Signed-off-by: Alexander Gordeev <agordeev@redhat.com>
Signed-off-by: Jens Axboe <axboe@fb.com>