[ I'm currently running my tests on it now, and so far, after a few
 hours it has yet to blow up. I'll run it for 24 hours which it never
 succeeded in the past. ]

The tracing code has a way to make directories within the debugfs file
system as well as deleting them using mkdir/rmdir in the instance
directory. This is very limited in functionality, such as there is
no renames, and the parent directory "instance" can not be modified.
The tracing code creates the instance directory from the debugfs code
and then replaces the dentry->d_inode->i_op with its own to allow
for mkdir/rmdir to work.

When these are called, the d_entry and inode locks need to be released
to call the instance creation and deletion code. That code has its own
accounting and locking to serialize everything to prevent multiple
users from causing harm. As the parent "instance" directory can not
be modified this simplifies things.

I created a stress test that creates several threads that randomly
creates and deletes directories thousands of times a second. The code
stood up to this test and I submitted it a while ago.

Recently I added a new test that adds readers to the mix. While the
instance directories were being added and deleted, readers would read
from these directories and even enable tracing within them. This test
was able to trigger a bug:

 general protection fault: 0000 [#1] PREEMPT SMP
 Modules linked in: ...
 CPU: 3 PID: 17789 Comm: rmdir Tainted: G        W     3.15.0-rc2-test+ #41
 Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./To be filled by O.E.M., BIOS SDBLI944.86P 05/08/2007
 task: ffff88003786ca60 ti: ffff880077018000 task.ti: ffff880077018000
 RIP: 0010:[<ffffffff811ed5eb>]  [<ffffffff811ed5eb>] debugfs_remove_recursive+0x1bd/0x367
 RSP: 0018:ffff880077019df8  EFLAGS: 00010246
 RAX: 0000000000000002 RBX: ffff88006f0fe490 RCX: 0000000000000000
 RDX: dead000000100058 RSI: 0000000000000246 RDI: ffff88003786d454
 RBP: ffff88006f0fe640 R08: 0000000000000628 R09: 0000000000000000
 R10: 0000000000000628 R11: ffff8800795110a0 R12: ffff88006f0fe640
 R13: ffff88006f0fe640 R14: ffffffff81817d0b R15: ffffffff818188b7
 FS:  00007ff13ae24700(0000) GS:ffff88007d580000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
 CR2: 0000003054ec7be0 CR3: 0000000076d51000 CR4: 00000000000007e0
 Stack:
  ffff88007a41ebe0 dead000000100058 00000000fffffffe ffff88006f0fe640
  0000000000000000 ffff88006f0fe678 ffff88007a41ebe0 ffff88003793a000
  00000000fffffffe ffffffff810bde82 ffff88006f0fe640 ffff88007a41eb28
 Call Trace:
  [<ffffffff810bde82>] ? instance_rmdir+0x15b/0x1de
  [<ffffffff81132e2d>] ? vfs_rmdir+0x80/0xd3
  [<ffffffff81132f51>] ? do_rmdir+0xd1/0x139
  [<ffffffff8124ad9e>] ? trace_hardirqs_on_thunk+0x3a/0x3c
  [<ffffffff814fea62>] ? system_call_fastpath+0x16/0x1b
 Code: fe ff ff 48 8d 75 30 48 89 df e8 c9 fd ff ff 85 c0 75 13 48 c7 c6 b8 cc d2 81 48 c7 c7 b0 cc d2 81 e8 8c 7a f5 ff 48 8b 54 24 08 <48> 8b 82 a8 00 00 00 48 89 d3 48 2d a8 00 00 00 48 89 44 24 08
 RIP  [<ffffffff811ed5eb>] debugfs_remove_recursive+0x1bd/0x367
  RSP <ffff880077019df8>

It took a while, but every time it triggered, it was always in the
same place:

	list_for_each_entry_safe(child, next, &parent->d_subdirs, d_u.d_child) {

Where the child->d_u.d_child seemed to be corrupted.  I added lots of
trace_printk()s to see what was wrong, and sure enough, it was always
the child's d_u.d_child field. I looked around to see what touches
it and noticed that in __dentry_kill() which calls dentry_free():

static void dentry_free(struct dentry *dentry)
{
	/* if dentry was never visible to RCU, immediate free is OK */
	if (!(dentry->d_flags & DCACHE_RCUACCESS))
		__d_free(&dentry->d_u.d_rcu);
	else
		call_rcu(&dentry->d_u.d_rcu, __d_free);
}

I also noticed that __dentry_kill() unlinks the child->d_u.child
under the parent->d_lock spin_lock.

Looking back at the loop in debugfs_remove_recursive() it never takes the
parent->d_lock to do the list walk. Adding more tracing, I was able to
prove this was the issue:

 ftrace-t-15385   1.... 246662024us : dentry_kill <ffffffff81138b91>: free ffff88006d573600
    rmdir-15409   2.... 246662024us : debugfs_remove_recursive <ffffffff811ec7e5>: child=ffff88006d573600 next=dead000000100058

The dentry_kill freed ffff88006d573600 just as the remove recursive was walking
it.

In order to fix this, the list walk needs to be modified a bit to take
the parent->d_lock. The safe version is no longer necessary, as every
time we remove a child, the parent->d_lock must be released and the
list walk must start over. Each time a child is removed, even though it
may still be on the list, it should be skipped by the first check
in the loop:

		if (!debugfs_positive(child))
			continue;

Cc: stable@vger.kernel.org
Signed-off-by: NSteven Rostedt <rostedt@goodmis.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Stable_kernel_rules should point submitters of network stable patches to the
netdev_FAQ.txt as requests for stable network patches should go to netdev
first.
Signed-off-by: NDave Chiluk <chiluk@canonical.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Needed by platform device drivers, such as the upcoming
vfio-platform driver, in order to bypass the existing OF, ACPI,
id_table and name string matches, and successfully be able to be
bound to any device, like so:

echo vfio-platform > /sys/bus/platform/devices/fff51000.ethernet/driver_override
echo fff51000.ethernet > /sys/bus/platform/devices/fff51000.ethernet/driver/unbind
echo fff51000.ethernet > /sys/bus/platform/drivers_probe

This mimics "PCI: Introduce new device binding path using
pci_dev.driver_override", which is an interface enhancement
for more deterministic PCI device binding, e.g., when in the
presence of hotplug.
Reviewed-by: NAlex Williamson <alex.williamson@redhat.com>
Reviewed-by: NAlexander Graf <agraf@suse.de>
Reviewed-by: NStuart Yoder <stuart.yoder@freescale.com>
Signed-off-by: NKim Phillips <kim.phillips@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Up to 7 bytes are wasted at the end of struct platform_object
in the form of padding after name field: unfortunately this
padding is not used when allocating the memory to hold the
name.

This patch converts name array from name[1] to C99 flexible
array name[] (equivalent to name[0]) so that no padding is
required by the presence of this field. Memory allocation
is updated to take care of allocating an additional byte for
the NUL terminating character.

Built on Fedora 20, using GCC 4.8, for ARM, i386, SPARC64 and
x86_64 architectures, the data structure layout can be reported
with following command:

  $ pahole drivers/base/platform.o \
           --recursive             \
           --class_name device,pdev_archdata,platform_device,platform_object

Please find below some comparisons of structure layout for arm,
i386, sparc64 and x86_64 architecture before and after the patch.

  --- obj-arm/drivers/base/platform.o.pahole.v3.15-rc7-79-gfe45736f	2014-05-30 10:32:06.290960701 +0200
  +++ obj-arm/drivers/base/platform.o.pahole.v3.15-rc7-80-g2cdb06858d71	2014-05-30 11:26:20.851988347 +0200
  @@ -81,10 +81,9 @@
     /* XXX last struct has 4 bytes of padding */

  	/* --- cacheline 6 boundary (384 bytes) was 8 bytes ago --- */
  -	char                       name[1];              /*   392     1 */
  +	char                       name[0];              /*   392     0 */

  -	/* size: 400, cachelines: 7, members: 2 */
  -	/* padding: 7 */
  +	/* size: 392, cachelines: 7, members: 2 */
   	/* paddings: 1, sum paddings: 4 */
  -	/* last cacheline: 16 bytes */
  +	/* last cacheline: 8 bytes */
   };

  --- obj-i386/drivers/base/platform.o.pahole.v3.15-rc7-79-gfe45736f 2014-05-30 10:32:06.305960691 +0200
  +++ obj-i386/drivers/base/platform.o.pahole.v3.15-rc7-80-g2cdb06858d71 2014-05-30 11:26:20.875988332 +0200
  @@ -73,9 +73,8 @@
   struct platform_object {
   	struct platform_device     pdev;                 /*     0   396 */
   	/* --- cacheline 6 boundary (384 bytes) was 12 bytes ago --- */
  -	char                       name[1];              /*   396     1 */
  +	char                       name[0];              /*   396     0 */

  -	/* size: 400, cachelines: 7, members: 2 */
  -	/* padding: 3 */
  -	/* last cacheline: 16 bytes */
  +	/* size: 396, cachelines: 7, members: 2 */
  +	/* last cacheline: 12 bytes */
   };

  --- obj-sparc64/drivers/base/platform.o.pahole.v3.15-rc7-79-gfe45736f 2014-05-30 10:32:06.406960625 +0200
  +++ obj-sparc64/drivers/base/platform.o.pahole.v3.15-rc7-80-g2cdb06858d71 2014-05-30 11:26:20.971988269 +0200
  @@ -94,9 +94,8 @@
   struct platform_object {
   	struct platform_device     pdev;                 /*     0  2208 */
   	/* --- cacheline 34 boundary (2176 bytes) was 32 bytes ago --- */
  -	char                       name[1];              /*  2208     1 */
  +	char                       name[0];              /*  2208     0 */

  -	/* size: 2216, cachelines: 35, members: 2 */
  -	/* padding: 7 */
  -	/* last cacheline: 40 bytes */
  +	/* size: 2208, cachelines: 35, members: 2 */
  +	/* last cacheline: 32 bytes */
   };

  --- obj-x86_64/drivers/base/platform.o.pahole.v3.15-rc7-79-gfe45736f 2014-05-30 10:32:06.432960608 +0200
  +++ obj-x86_64/drivers/base/platform.o.pahole.v3.15-rc7-80-g2cdb06858d71 2014-05-30 11:26:21.000988250 +0200
  @@ -84,9 +84,8 @@
   struct platform_object {
   	struct platform_device     pdev;                 /*     0   720 */
   	/* --- cacheline 11 boundary (704 bytes) was 16 bytes ago --- */
  -	char                       name[1];              /*   720     1 */
  +	char                       name[0];              /*   720     0 */

  -	/* size: 728, cachelines: 12, members: 2 */
  -	/* padding: 7 */
  -	/* last cacheline: 24 bytes */
  +	/* size: 720, cachelines: 12, members: 2 */
  +	/* last cacheline: 16 bytes */
   };

Changes from v5 [1]:
- dropped dma_mask allocation changes and only kept padding
  removal changes (name array length set to 0).

Changes from v4 [2]:
[by Emil Goode <emilgoode@gmail.com>:]
- Split v4 of the patch into two separate patches.
- Generated new object file size and data structure layout info.
- Updated the changelog message.

Changes from v3 [3]:
- fixed commit message so that git am doesn't fail.

Changes from v2 [4]:
- move 'dma_mask' to platform_object so that it's always
  allocated and won't leak on release; remove all previously
  added support functions.
- use C99 flexible array member for 'name' to remove padding
  at the end of platform_object.

Changes from v1 [5]:
- remove unneeded kfree() from error path
- add reference to author/commit adding allocation of dmamask

Changes from v0 [6]:
- small rewrite to squeeze the patch to a bare minimal

[1] http://lkml.kernel.org/r/1401122483-31603-2-git-send-email-emilgoode@gmail.com
    http://lkml.kernel.org/r/1401122483-31603-1-git-send-email-emilgoode@gmail.com
    http://lkml.kernel.org/r/1401122483-31603-3-git-send-email-emilgoode@gmail.com

[2] http://lkml.kernel.org/r/1390817152-30898-1-git-send-email-ydroneaud@opteya.com
    https://patchwork.kernel.org/patch/3541871/

[3] http://lkml.kernel.org/r/1390771138-28348-1-git-send-email-ydroneaud@opteya.com
    https://patchwork.kernel.org/patch/3540081/

[4] http://lkml.kernel.org/r/1389683909-17495-1-git-send-email-ydroneaud@opteya.com
    https://patchwork.kernel.org/patch/3484411/

[5] http://lkml.kernel.org/r/1389649085-7365-1-git-send-email-ydroneaud@opteya.com
    https://patchwork.kernel.org/patch/3480961/

[6] http://lkml.kernel.org/r/1386886207-2735-1-git-send-email-ydroneaud@opteya.com

Cc: Emil Goode <emilgoode@gmail.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Shawn Guo <shawn.guo@freescale.com>
Cc: Sascha Hauer <kernel@pengutronix.de>
Cc: Russell King <linux@arm.linux.org.uk>
Cc: Olof Johansson <olof@lixom.net>
Cc: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: NYann Droneaud <ydroneaud@opteya.com>
Acked-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Now that the udev firmware loader is optional request_firmware()
will not provide any information on the kernel ring buffer if
direct firmware loading failed and udev firmware loading is disabled.
If no information is needed request_firmware_direct() should be used
for optional firmware, at which point drivers can take on the onus
over informing of any failures, if udev firmware loading is disabled
though we should at the very least provide some sort of information
as when the udev loader was enabled by default back in the days.

With this change with a simple firmware load test module [0]:

Example output without FW_LOADER_USER_HELPER_FALLBACK

platform fake-dev.0: Direct firmware load for fake.bin failed
with error -2

Example with FW_LOADER_USER_HELPER_FALLBACK

platform fake-dev.0: Direct firmware load for fake.bin failed with error -2
platform fake-dev.0: Falling back to user helper

Without this change without FW_LOADER_USER_HELPER_FALLBACK we
get no output logged upon failure.

Cc: Tom Gundersen <teg@jklm.no>
Cc: Ming Lei <ming.lei@canonical.com>
Cc: Abhay Salunke <Abhay_Salunke@dell.com>
Cc: Stefan Roese <sr@denx.de>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Kay Sievers <kay@vrfy.org>
Signed-off-by: NLuis R. Rodriguez <mcgrof@suse.com>
Reviewed-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

use mm.h definition

Cc: Ming Lei <ming.lei@canonical.com>
Signed-off-by: NFabian Frederick <fabf@skynet.be>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

There is no need to read attr because inode structure contains size
of the file. Use i_size_read() instead.
Signed-off-by: NDmitry Kasatkin <d.kasatkin@samsung.com>
Acked-by: NMing Lei <ming.lei@canonical.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

[The patch was originally proposed by Tom Gundersen, and rewritten
 afterwards by me; most of changelogs below borrowed from Tom's
 original patch -- tiwai]

Currently (at least) the dell-rbu driver selects FW_LOADER_USER_HELPER,
which means that distros can't really stop loading firmware through
udev without breaking other users (though some have).

Ideally we would remove/disable the udev firmware helper in both the
kernel and in udev, but if we were to disable it in udev and not the
kernel, the result would be (seemingly) hung kernels as no one would
be around to cancel firmware requests.

This patch allows udev firmware loading to be disabled while still
allowing non-udev firmware loading, as done by the dell-rbu driver, to
continue working. This is achieved by only using the fallback
mechanism when the uevent is suppressed.

The patch renames the user-selectable Kconfig from FW_LOADER_USER_HELPER
to FW_LOADER_USER_HELPER_FALLBACK, and the former is reverse-selected
by the latter or the drivers that need userhelper like dell-rbu.

Also, the "default y" is removed together with this change, since it's
been deprecated in udev upstream, thus rather better to disable it
nowadays.

Tested with
    FW_LOADER_USER_HELPER=n
    LATTICE_ECP3_CONFIG=y
    DELL_RBU=y
and udev without the firmware loading support, but I don't have the
hardware to test the lattice/dell drivers, so additional testing would
be appreciated.
Reviewed-by: NTom Gundersen <teg@jklm.no>
Cc: Ming Lei <ming.lei@canonical.com>
Cc: Abhay Salunke <Abhay_Salunke@dell.com>
Cc: Stefan Roese <sr@denx.de>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Kay Sievers <kay@vrfy.org>
Tested-by: NBalaji Singh <B_B_Singh@DELL.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This adds some extra functions to deal with rcu.

reservation_object_get_fences_rcu() will obtain the list of shared
and exclusive fences without obtaining the ww_mutex.

reservation_object_wait_timeout_rcu() will wait on all fences of the
reservation_object, without obtaining the ww_mutex.

reservation_object_test_signaled_rcu() will test if all fences of the
reservation_object are signaled without using the ww_mutex.

reservation_object_get_excl and reservation_object_get_list require
the reservation object to be held, updating requires
write_seqcount_begin/end. If only the exclusive fence is needed,
rcu_dereference followed by fence_get_rcu can be used, if the shared
fences are needed it's recommended to use the supplied functions.
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Acked-by: NSumit Semwal <sumit.semwal@linaro.org>
Acked-by: NDaniel Vetter <daniel@ffwll.ch>
Reviewed-By: NThomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Move the list of shared fences to a struct, and return it in
reservation_object_get_list().
Add reservation_object_get_excl to get the exclusive fence.

Add reservation_object_reserve_shared(), which reserves space
in the reservation_object for 1 more shared fence.

reservation_object_add_shared_fence() and
reservation_object_add_excl_fence() are used to assign a new
fence to a reservation_object pointer, to complete a reservation.

Changes since v1:
- Add reservation_object_get_excl, reorder code a bit.
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Acked-by: NSumit Semwal <sumit.semwal@linaro.org>
Acked-by: NDaniel Vetter <daniel@ffwll.ch>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Thanks to Fengguang Wu for spotting a missing static cast.

v2:
- Kill unused variable need_shared.
v3:
- Clarify the BUG() in dma_buf_release some more. (Rob Clark)
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Acked-by: NSumit Semwal <sumit.semwal@linaro.org>
Acked-by: NDaniel Vetter <daniel@ffwll.ch>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Acked-by: NSumit Semwal <sumit.semwal@linaro.org>
Acked-by: NDaniel Vetter <daniel@ffwll.ch>
Reviewed-by: NRob Clark <robdclark@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Just to show it's easy.

Android syncpoints can be mapped to a timeline. This removes the need
to maintain a separate api for synchronization. I've left the android
trace events in place, but the core fence events should already be
sufficient for debugging.

v2:
- Call fence_remove_callback in sync_fence_free if not all fences have fired.
v3:
- Merge Colin Cross' bugfixes, and the android fence merge optimization.
v4:
- Merge with the upstream fixes.
v5:
- Fix small style issues pointed out by Thomas Hellstrom.
v6:
- Fix for updates to fence api.
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Acked-by: NJohn Stultz <john.stultz@linaro.org>
Acked-by: NSumit Semwal <sumit.semwal@linaro.org>
Acked-by: NDaniel Vetter <daniel@ffwll.ch>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This allows reservation objects to be used in dma-buf. it's required
for implementing polling support on the fences that belong to a dma-buf.
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Acked-by: Mauro Carvalho Chehab <m.chehab@samsung.com> #drivers/media/v4l2-core/
Acked-by: Thomas Hellstrom <thellstrom@vmware.com> #drivers/gpu/drm/ttm
Acked-by: NSumit Semwal <sumit.semwal@linaro.org>
Acked-by: NDaniel Vetter <daniel@ffwll.ch>
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net> #drivers/gpu/drm/armada/
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

This type of fence can be used with hardware synchronization for simple
hardware that can block execution until the condition
(dma_buf[offset] - value) >= 0 has been met when WAIT_GEQUAL is used,
or (dma_buf[offset] != 0) has been met when WAIT_NONZERO is set.

A software fallback still has to be provided in case the fence is used
with a device that doesn't support this mechanism. It is useful to expose
this for graphics cards that have an op to support this.

Some cards like i915 can export those, but don't have an option to wait,
so they need the software fallback.

I extended the original patch by Rob Clark.

v1: Original
v2: Renamed from bikeshed to seqno, moved into dma-fence.c since
    not much was left of the file. Lots of documentation added.
v3: Use fence_ops instead of custom callbacks. Moved to own file
    to avoid circular dependency between dma-buf.h and fence.h
v4: Add spinlock pointer to seqno_fence_init
v5: Add condition member to allow wait for != 0.
    Fix small style errors pointed out by checkpatch.
v6: Move to a separate file. Fix up api changes in fences.
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Acked-by: NSumit Semwal <sumit.semwal@linaro.org>
Acked-by: NDaniel Vetter <daniel@ffwll.ch>
Reviewed-by: Rob Clark <robdclark@gmail.com> #v4
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

A fence can be attached to a buffer which is being filled or consumed
by hw, to allow userspace to pass the buffer without waiting to another
device.  For example, userspace can call page_flip ioctl to display the
next frame of graphics after kicking the GPU but while the GPU is still
rendering.  The display device sharing the buffer with the GPU would
attach a callback to get notified when the GPU's rendering-complete IRQ
fires, to update the scan-out address of the display, without having to
wake up userspace.

A driver must allocate a fence context for each execution ring that can
run in parallel. The function for this takes an argument with how many
contexts to allocate:
  + fence_context_alloc()

A fence is transient, one-shot deal.  It is allocated and attached
to one or more dma-buf's.  When the one that attached it is done, with
the pending operation, it can signal the fence:
  + fence_signal()

To have a rough approximation whether a fence is fired, call:
  + fence_is_signaled()

The dma-buf-mgr handles tracking, and waiting on, the fences associated
with a dma-buf.

The one pending on the fence can add an async callback:
  + fence_add_callback()

The callback can optionally be cancelled with:
  + fence_remove_callback()

To wait synchronously, optionally with a timeout:
  + fence_wait()
  + fence_wait_timeout()

When emitting a fence, call:
  + trace_fence_emit()

To annotate that a fence is blocking on another fence, call:
  + trace_fence_annotate_wait_on(fence, on_fence)

A default software-only implementation is provided, which can be used
by drivers attaching a fence to a buffer when they have no other means
for hw sync.  But a memory backed fence is also envisioned, because it
is common that GPU's can write to, or poll on some memory location for
synchronization.  For example:

  fence = custom_get_fence(...);
  if ((seqno_fence = to_seqno_fence(fence)) != NULL) {
    dma_buf *fence_buf = seqno_fence->sync_buf;
    get_dma_buf(fence_buf);

    ... tell the hw the memory location to wait ...
    custom_wait_on(fence_buf, seqno_fence->seqno_ofs, fence->seqno);
  } else {
    /* fall-back to sw sync * /
    fence_add_callback(fence, my_cb);
  }

On SoC platforms, if some other hw mechanism is provided for synchronizing
between IP blocks, it could be supported as an alternate implementation
with it's own fence ops in a similar way.

enable_signaling callback is used to provide sw signaling in case a cpu
waiter is requested or no compatible hardware signaling could be used.

The intention is to provide a userspace interface (presumably via eventfd)
later, to be used in conjunction with dma-buf's mmap support for sw access
to buffers (or for userspace apps that would prefer to do their own
synchronization).

v1: Original
v2: After discussion w/ danvet and mlankhorst on #dri-devel, we decided
    that dma-fence didn't need to care about the sw->hw signaling path
    (it can be handled same as sw->sw case), and therefore the fence->ops
    can be simplified and more handled in the core.  So remove the signal,
    add_callback, cancel_callback, and wait ops, and replace with a simple
    enable_signaling() op which can be used to inform a fence supporting
    hw->hw signaling that one or more devices which do not support hw
    signaling are waiting (and therefore it should enable an irq or do
    whatever is necessary in order that the CPU is notified when the
    fence is passed).
v3: Fix locking fail in attach_fence() and get_fence()
v4: Remove tie-in w/ dma-buf..  after discussion w/ danvet and mlankorst
    we decided that we need to be able to attach one fence to N dma-buf's,
    so using the list_head in dma-fence struct would be problematic.
v5: [ Maarten Lankhorst ] Updated for dma-bikeshed-fence and dma-buf-manager.
v6: [ Maarten Lankhorst ] I removed dma_fence_cancel_callback and some comments
    about checking if fence fired or not. This is broken by design.
    waitqueue_active during destruction is now fatal, since the signaller
    should be holding a reference in enable_signalling until it signalled
    the fence. Pass the original dma_fence_cb along, and call __remove_wait
    in the dma_fence_callback handler, so that no cleanup needs to be
    performed.
v7: [ Maarten Lankhorst ] Set cb->func and only enable sw signaling if
    fence wasn't signaled yet, for example for hardware fences that may
    choose to signal blindly.
v8: [ Maarten Lankhorst ] Tons of tiny fixes, moved __dma_fence_init to
    header and fixed include mess. dma-fence.h now includes dma-buf.h
    All members are now initialized, so kmalloc can be used for
    allocating a dma-fence. More documentation added.
v9: Change compiler bitfields to flags, change return type of
    enable_signaling to bool. Rework dma_fence_wait. Added
    dma_fence_is_signaled and dma_fence_wait_timeout.
    s/dma// and change exports to non GPL. Added fence_is_signaled and
    fence_enable_sw_signaling calls, add ability to override default
    wait operation.
v10: remove event_queue, use a custom list, export try_to_wake_up from
    scheduler. Remove fence lock and use a global spinlock instead,
    this should hopefully remove all the locking headaches I was having
    on trying to implement this. enable_signaling is called with this
    lock held.
v11:
    Use atomic ops for flags, lifting the need for some spin_lock_irqsaves.
    However I kept the guarantee that after fence_signal returns, it is
    guaranteed that enable_signaling has either been called to completion,
    or will not be called any more.

    Add contexts and seqno to base fence implementation. This allows you
    to wait for less fences, by testing for seqno + signaled, and then only
    wait on the later fence.

    Add FENCE_TRACE, FENCE_WARN, and FENCE_ERR. This makes debugging easier.
    An CONFIG_DEBUG_FENCE will be added to turn off the FENCE_TRACE
    spam, and another runtime option can turn it off at runtime.
v12:
    Add CONFIG_FENCE_TRACE. Add missing documentation for the fence->context
    and fence->seqno members.
v13:
    Fixup CONFIG_FENCE_TRACE kconfig description.
    Move fence_context_alloc to fence.
    Simplify fence_later.
    Kill priv member to fence_cb.
v14:
    Remove priv argument from fence_add_callback, oops!
v15:
    Remove priv from documentation.
    Explicitly include linux/atomic.h.
v16:
    Add trace events.
    Import changes required by android syncpoints.
v17:
    Use wake_up_state instead of try_to_wake_up. (Colin Cross)
    Fix up commit description for seqno_fence. (Rob Clark)
v18:
    Rename release_fence to fence_release.
    Move to drivers/dma-buf/.
    Rename __fence_is_signaled and __fence_signal to *_locked.
    Rename __fence_init to fence_init.
    Make fence_default_wait return a signed long, and fix wait ops too.
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com> #use smp_mb__before_atomic()
Acked-by: NSumit Semwal <sumit.semwal@linaro.org>
Acked-by: NDaniel Vetter <daniel@ffwll.ch>
Reviewed-by: NRob Clark <robdclark@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@canonical.com>
Acked-by: NSumit Semwal <sumit.semwal@linaro.org>
Acked-by: NDaniel Vetter <daniel@ffwll.ch>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Russell writes:

Greg,

Please incorporate a fix for the component helper.
This fixes a bug reported by Sachin Kamat found with Exynos DRM.

We want the lz* fixes here to do more work with them.
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Pull devicetree bugfix from Grant Likely:
 "Important bug fix for parsing 64-bit addresses on 32-bit platforms.
  Without this patch the kernel will try to use memory ranges that
  cannot be reached"

* tag 'dt-for-linus' of git://git.secretlab.ca/git/linux:
  of: Check for phys_addr_t overflows in early_init_dt_add_memory_arch

Pull SCSI fixes from James Bottomley:
 "This is a set of 13 fixes, a MAINTAINERS update and a sparse update.
  The fixes are mostly correct value initialisations, avoiding NULL
  derefs and some uninitialised pointer avoidance.

  All the patches have been incubated in -next for a few days.  The
  final patch (use the scsi data buffer length to extract transfer size)
  has been rebased to add a cc to stable, but only the commit message
  has changed"

* tag 'scsi-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  [SCSI] use the scsi data buffer length to extract transfer size
  virtio-scsi: fix various bad behavior on aborted requests
  virtio-scsi: avoid cancelling uninitialized work items
  ibmvscsi: Add memory barriers for send / receive
  ibmvscsi: Abort init sequence during error recovery
  qla2xxx: Fix sparse warning in qla_target.c.
  bnx2fc: Improve stats update mechanism
  bnx2fc: do not scan uninitialized lists in case of error.
  fc: ensure scan_work isn't active when freeing fc_rport
  pm8001: Fix potential null pointer dereference and memory leak.
  MAINTAINERS: Update LSILOGIC MPT FUSION DRIVERS (FC/SAS/SPI) maintainers Email IDs
  be2iscsi: remove potential junk pointer free
  be2iscsi: add an missing goto in error path
  scsi_error: set DID_TIME_OUT correctly
  scsi_error: fix invalid setting of host byte

Pull drm fixes from Dave Airlie:
 "i915, tda998x and vmwgfx fixes,

  The main one is i915 fix for missing VGA connectors, along with some
  fixes for the tda998x from Russell fixing some modesetting problems.

  (still on holidays, but got a spare moment to find these)"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/vmwgfx: Fix incorrect write to read-only register v2:
  drm/i915: Drop early VLV WA to fix Voltage not getting dropped to Vmin
  drm/i915: only apply crt_present check on VLV
  drm/i915: Wait for vblank after enabling the primary plane on BDW
  drm/i2c: tda998x: add some basic mode validation
  drm/i2c: tda998x: faster polling for edid
  drm/i2c: tda998x: move drm_i2c_encoder_destroy call

Pull ARM SoC fixes from Olof Johansson:
 "This week's arm-soc fixes:

   - A set of of OMAP patches that we had missed Tony's pull request of:
     * Reset fix for am43xx
     * Proper OPP table for omap5
     * Fix for SoC detection of one of the DRA7 SoCs
     * hwmod updates to get SATA and OCP to work on omap5 (drivers
       merged in 3.16)
     * ... plus a handful of smaller fixes
   - sunxi needed to re-add machine specific restart code that was
     removed in anticipation of a watchdog driver being merged for 3.16,
     and it didn't make it in.
   - Marvell fixes for PCIe on SMP and a big-endian fix.
   - A trivial defconfig update to make my capri test board boot with
     bcm_defconfig again.

  ... and a couple of MAINTAINERS updates, one to claim new Keystone
  drivers that have been merged, and one to merge MXS and i.MX (both
  Freescale platforms).

  The largest diffs come from the hwmod code for omap5 and the re-add of
  the restart code on sunxi.  The hwmod stuff is quite late at this
  point but it slipped through cracks repeatedly while coming up the
  maintainer chain and only affects the one SoC so risk is low"

* tag 'fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  MAINTAINERS: Add few more Keystone drivers
  MAINTAINERS: merge MXS entry into IMX one
  ARM: sunxi: Reintroduce the restart code for A10/A20 SoCs
  ARM: mvebu: fix cpuidle implementation to work on big-endian systems
  ARM: mvebu: update L2/PCIe deadlock workaround after L2CC cleanup
  ARM: mvebu: move Armada 375 external abort logic as a quirk
  ARM: bcm: Fix bcm and multi_v7 defconfigs
  ARM: dts: dra7-evm: remove interrupt binding
  ARM: OMAP2+: Fix parser-bug in platform muxing code
  ARM: DTS: dra7/dra7xx-clocks: ATL related changes
  ARM: OMAP2+: drop unused function
  ARM: dts: am43x-epos-evm: Add Missing cpsw-phy-sel for am43x-epos-evm
  ARM: dts: omap5: Update CPU OPP table as per final production Manual
  ARM: DRA722: add detection of SoC information
  ARM: dts: Enable twl4030 off-idle configuration for selected omaps
  ARM: OMAP5: hwmod: Add ocp2scp3 and sata hwmods
  ARM: OMAP2+: hwmod: Change hardreset soc_ops for AM43XX

Pull irq fixes from Thomas Gleixner:
 "A few minor fixlets in ARM SoC irq drivers and a fix for a memory leak
  which I introduced in the last round of cleanups :("

* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  genirq: Fix memory leak when calling irq_free_hwirqs()
  irqchip: spear_shirq: Fix interrupt offset
  irqchip: brcmstb-l2: Level-2 interrupts are edge sensitive
  irqchip: armada-370-xp: Mask all interrupts during initialization.

Fixes for 3.16-rc3; most importantly Jesse brings back VGA he took away
on a bunch of machines. Also a vblank fix for BDW and a power workaround
fix for VLV.

* tag 'drm-intel-fixes-2014-07-03' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: Drop early VLV WA to fix Voltage not getting dropped to Vmin
  drm/i915: only apply crt_present check on VLV
  drm/i915: Wait for vblank after enabling the primary plane on BDW

fix to a 3.15 commit.

* 'vmwgfx-fixes-3.16' of git://people.freedesktop.org/~thomash/linux:
  drm/vmwgfx: Fix incorrect write to read-only register v2:

mode fixes for tda998x.

* 'tda998x-fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-cubox:
  drm/i2c: tda998x: add some basic mode validation
  drm/i2c: tda998x: faster polling for edid
  drm/i2c: tda998x: move drm_i2c_encoder_destroy call

irq_free_hwirqs() always calls irq_free_descs() with a cnt == 0
which makes it a no-op since the interrupt count to free is
decremented in itself.

Fixes: 7b6ef126Signed-off-by: NKeith Busch <keith.busch@intel.com>
Acked-by: NDavid Rientjes <rientjes@google.com>
Link: http://lkml.kernel.org/r/1404167084-8070-1-git-send-email-keith.busch@intel.comSigned-off-by: NThomas Gleixner <tglx@linutronix.de>

Pull ARM64 fixes from Catalin Marinas:
 - Exception level check at boot time (for completeness, not triggering
   any bug before)
 - I/D-cache synchronisation logic for huge pages
 - Config symbol typo

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: fix el2_setup check of CurrentEL
  arm64: mm: Make icache synchronisation logic huge page aware
  arm64: mm: Fix horrendous config typo

Update MAINTAINERS file for recently added reset controller, AEMIF
and clocksource driver for Keystone SOCs.

The EMIF memory controller driver is also added along with AEMIF.

Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Olof Johansson <olof@lixom.net>
Cc: Kevin Hilman <khilman@linaro.org>
Cc: Mike Turquette <mturquette@linaro.org>
Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NSantosh Shilimkar <santosh.shilimkar@ti.com>
Signed-off-by: NOlof Johansson <olof@lixom.net>

The mach-mxs platform is actually co-maintained by myself and
pengutronix folks.  Also it's hosted in the same kernel tree as IMX.
So let's merge the entry into IMX one.
Signed-off-by: NShawn Guo <shawn.guo@freescale.com>
Acked-by: NSascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: NOlof Johansson <olof@lixom.net>

mvebu fixes for v3.16 (round #2)

 - mvebu
    - Fix PCIe deadlock now that SMP is enabled
    - Fix cpuidle for big-endian systems

* tag 'mvebu-fixes-3.16-2' of git://git.infradead.org/linux-mvebu:
  ARM: mvebu: fix cpuidle implementation to work on big-endian systems
  ARM: mvebu: update L2/PCIe deadlock workaround after L2CC cleanup
  ARM: mvebu: move Armada 375 external abort logic as a quirk
Signed-off-by: NOlof Johansson <olof@lixom.net>

This partly reverts commits 55360050 (ARM: sunxi: Remove reset code from
the platform) and 5e669ec5 (ARM: sunxi: Remove init_machine callback) for
the sun4i, sun5i and sun7i families.

This is needed because the watchdog counterpart of these commits was dropped,
and didn't make it into 3.16. In order to still be able to reboot the board, we
need to reintroduce that code. Of course, the long term view is still to get
rid of that code in mach-sunxi.
Signed-off-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: NOlof Johansson <olof@lixom.net>

Merge tag 'omap-for-v3.16/fixes-against-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes

Merge OMAP fixes from Tony Lindgren:

Fixes for omaps for issues discovered during the merge window and
enabling of a few features that had to wait for the driver
dependencies to clear.

The fixes included are:

- Fix am43xx hard reset flags
- Fix SoC detection for DRA722
- Fix CPU OPP table for omap5
- Fix legacy mux parser bug if requested muxname is a prefix of
  multiple mux entries
- Fix qspi interrupt binding that relies on the irq crossbar
  that has not yet been enabled
- Add missing phy_sel for am43x-epos-evm
- Drop unused gic_init_irq() that is no longer needed

And the enabling of features that had driver dependencies are:

- Change dra7 to use Audio Tracking Logic clock instead of a fixed
  clock now that the clock driver for it has been merged

- Enable off idle configuration for selected omaps as all the kernel
  dependencies for device tree based booting are finally merged as
  this is needed to get the automated PM tests working finally with
  device tree based booting

- Add hwmod entry for ocp2scp3 for omap5 to get sata working as
  all the driver dependencies are now in the kernel and this patch
  fell through the cracks during the merge window

* tag 'omap-for-v3.16/fixes-against-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: dts: dra7-evm: remove interrupt binding
  ARM: OMAP2+: Fix parser-bug in platform muxing code
  ARM: DTS: dra7/dra7xx-clocks: ATL related changes
  ARM: OMAP2+: drop unused function
  ARM: dts: am43x-epos-evm: Add Missing cpsw-phy-sel for am43x-epos-evm
  ARM: dts: omap5: Update CPU OPP table as per final production Manual
  ARM: DRA722: add detection of SoC information
  ARM: dts: Enable twl4030 off-idle configuration for selected omaps
  ARM: OMAP5: hwmod: Add ocp2scp3 and sata hwmods
  ARM: OMAP2+: hwmod: Change hardreset soc_ops for AM43XX

Sachin Kamat reports that "component: add support for component match
array" broke Exynos DRM due to a NULL pointer deref.  Fix this.
Reported-by: NSachin Kamat <sachin.kamat@samsung.com>
Tested-by: NSachin Kamat <sachin.kamat@samsung.com>
Signed-off-by: NRussell King <rmk+kernel@arm.linux.org.uk>

Pull md bugfixes from Neil Brown:
 "Two minor bugfixes for md in 3.16"

* tag 'md/3.16-fixes' of git://neil.brown.name/md:
  md: flush writes before starting a recovery.
  md: make sure GET_ARRAY_INFO ioctl reports correct "clean" status

Pull sound fixes from Takashi Iwai:
 "This contains a few fixes for HD-audio: yet another Dell headset pin
  quirk, a fixup for Thinkpad T540P, and an improved fix for
  Haswell/Broadwell HDMI clock setup"

* tag 'sound-3.16-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda - restore BCLK M/N value as per CDCLK for HSW/BDW display HDA controller
  drm/i915: provide interface for audio driver to query cdclk
  ALSA: hda - Add a fixup for Thinkpad T540p
  ALSA: hda - Add another headset pin quirk for some Dell machines

Pull btrfs fixes from Chris Mason:
 "We've queued up a few fixes in my for-linus branch"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  Btrfs: fix crash when starting transaction
  Btrfs: fix btrfs_print_leaf for skinny metadata
  Btrfs: fix race of using total_bytes_pinned
  btrfs: use E2BIG instead of EIO if compression does not help
  btrfs: remove stale comment from btrfs_flush_all_pending_stuffs
  Btrfs: fix use-after-free when cloning a trailing file hole
  btrfs: fix null pointer dereference in btrfs_show_devname when name is null
  btrfs: fix null pointer dereference in clone_fs_devices when name is null
  btrfs: fix nossd and ssd_spread mount option regression
  Btrfs: fix race between balance recovery and root deletion
  Btrfs: atomically set inode->i_flags in btrfs_update_iflags
  btrfs: only unlock block in verify_parent_transid if we locked it
  Btrfs: assert send doesn't attempt to start transactions
  btrfs compression: reuse recently used workspace
  Btrfs: fix crash when mounting raid5 btrfs with missing disks
  btrfs: create sprout should rename fsid on the sysfs as well
  btrfs: dev replace should replace the sysfs entry
  btrfs: dev add should add its sysfs entry
  btrfs: dev delete should remove sysfs entry
  btrfs: rename add_device_membership to btrfs_kobj_add_device

The CurrentEL system register reports the Current Exception Level
of the CPU. It doesn't say anything about the stack handling, and
yet we compare it to PSR_MODE_EL2t and PSR_MODE_EL2h.

It works by chance because PSR_MODE_EL2t happens to match the right
bits, but that's otherwise a very bad idea. Just check for the EL
value instead.
Signed-off-by: NMarc Zyngier <marc.zyngier@arm.com>
[catalin.marinas@arm.com: fixed arch/arm64/kernel/efi-entry.S]
Signed-off-by: NCatalin Marinas <catalin.marinas@arm.com>