- some polish for the guc code (Dave Gordon)
- big refactoring of gen9 display clock handling code (Ville)
- refactoring work in the context code (Chris Wilson)
- give encoder/crtc/planes useful names for debug output (Ville)
- improvements to skl/kbl wm computation code (Mahesh Kumar)
- bunch of smaller improvements all over as usual

* tag 'drm-intel-next-2016-06-06' of git://anongit.freedesktop.org/drm-intel: (64 commits)
  drm/i915: Update DRIVER_DATE to 20160606
  drm/i915: Extract physical display dimensions from VBT
  drm/i915: Silence "unexpected child device config size" for VBT on 845g
  drm/i915/skl+: Use scaling amount for plane data rate calculation (v4)
  drm/i915/skl+: calculate plane pixel rate (v4)
  drm/i915/skl+: calculate ddb minimum allocation (v6)
  drm/i915: Don't try to calculate relative data rates during hw readout
  drm/i915: Only ignore eDP ports that are connected
  drm/i915: Update GEN6_PMINTRMSK setup with GuC enabled
  drm/i915: kill STANDARD/CURSOR plane screams
  drm/i915: Give encoders useful names
  drm/i915: Give meaningful names to all the planes
  drm/i915: Don't leak primary/cursor planes on crtc init failure
  drm/i915: Set crtc->name to "pipe A", "pipe B", etc.
  drm/i915: Use plane->name in debug prints
  drm/i915: Use crtc->name in debug messages
  drm/i915: Reject modeset if the dotclock is too high
  drm/i915: Fix NULL pointer deference when out of PLLs in IVB
  drm/i915/ilk: Don't disable SSC source if it's in use
  drm/i915/bxt: Sanitize CDCLK to fix breakage during S4 resume
  ...

As promised, piles of prep work all around:
- drm_atomic_state rework, prep for nonblocking commit helpers
- fence patches from Gustavo and Christian to prep for atomic fences and
  some cool work in ttm/amdgpu from Christian
- drm event prep for both nonblocking commit and atomic fences
- Gustavo seems on a crusade against the non-kms-native version of the
  vblank functions.
- prep work from Boris to nuke all the silly ->best_encoder
  implementations we have (we really only need that for truly dynamic
  cases like dvi-i vs dvi-d or dp mst selecting the right transcoder on
  intel)
- prep work from Laurent to rework the format handling functions
- and few small things all over

* tag 'topic/drm-misc-2016-06-07' of git://anongit.freedesktop.org/drm-intel: (47 commits)
  drm/dsi: Implement set tear scanline
  drm/fb_cma_helper: Implement fb_mmap callback
  drm/qxl: Remove useless drm_fb_get_bpp_depth() call
  drm/ast: Remove useless drm_fb_get_bpp_depth() call
  drm/atomic: Fix remaining places where !funcs->best_encoder is valid
  drm/core: Change declaration for gamma_set.
  Documentation: add fence-array to kernel DocBook
  drm/shmobile: use drm_crtc_vblank_{get,put}()
  drm/radeon: use drm_crtc_vblank_{get,put}()
  drm/qxl: use drm_crtc_vblank_{get,put}()
  drm/atmel: use drm_crtc_vblank_{get,put}()
  drm/armada: use drm_crtc_vblank_{get,put}()
  drm/amdgpu: use drm_crtc_vblank_{get,put}()
  drm/virtio: use drm_crtc_send_vblank_event()
  drm/udl: use drm_crtc_send_vblank_event()
  drm/qxl: use drm_crtc_send_vblank_event()
  drm/atmel: use drm_crtc_send_vblank_event()
  drm/armada: use drm_crtc_send_vblank_event()
  drm/doc: Switch to sphinx/rst fixed-width quoting
  drm/doc: Drop kerneldoc for static functions in drm_irq.c
  ...

Merge tag 'topic/lockless-gem-bo-freeing-2016-06-01' of git://anongit.freedesktop.org/drm-intel into drm-next

lockless gem bo freeing patches (and the oddball related patch) for all
the drivers who's maintainers are asleep at the helm - includes you ;-)

I based this on top of drm-fixes to include Chris' fix for the cma issue.

* tag 'topic/lockless-gem-bo-freeing-2016-06-01' of git://anongit.freedesktop.org/drm-intel: (21 commits)
  drm/arcpgu: Use lockless gem BO free callback
  drm/sun4i: Use lockless gem BO free callback
  drm/omapdrm: Nuke dummy fb->dirty callback
  drm/msm: Nuke dummy fb->dirty callback
  drm/rockchip: Use cma gem vm ops
  drm/sti: Use lockless gem BO free callback
  drm: sti: remove useless call to dev->struct_mutex
  drm/virtio: Use lockless gem BO free callback
  drm/tilcdc: Use lockless gem BO free callback
  drm/shmob: Use lockless gem BO free callback
  drm/rockchip: Use lockless gem BO free callback
  drm/rcar-du: Use lockless gem BO free callback
  drm/qxl: Use lockless gem BO free callback
  drm/nouveau: Use lockless gem BO free callback
  drm/mga200g: Use lockless gem BO free callback
  drm/fls-dcu: Use lockless gem BO free callback
  drm/cirrus: Use lockless gem BO free callback
  drm/bochs: Use lockless gem BO free callback
  drm/atmel: Use lockless gem BO free callback
  drm/ast: Use lockless gem BO free callback
  ...

Daniel has a pull request that relies on stuff in fixes that are in rc2.

Provide a small convenience wrapper that transmits
a set_tear_scanline command.

v2:
  * helper function suggested by Thierry
    for set_tear_scanline
  * Also includes small build fixes from Sumit Semwal.

v3: one scanline parameter suggested by jani

v4: passing the payload properly as suggested by jani

Cc: Archit Taneja <archit.taneja@gmail.com>
Cc: John Stultz <john.stultz@linaro.org>
Cc: Thierry Reding <thierry.reding@gmail.com>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Signed-off-by: NVinay Simha BN <simhavcs@gmail.com>
Reviewed-by: NSumit Semwal <sumit.semwal@linaro.org>
Reviewed-by: NJani Nikula <jani.nikula@intel.com>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465285532-12676-1-git-send-email-simhavcs@gmail.com

In the absence of an fb_mmap callback, the fbdev code falls back to a
naive implementation which relies upon the DMA address being the same
as the physical address, and the buffer being physically contiguous
from there. Whilst this often holds for standard CMA allocations via
the platform's regular DMA ops, if the allocation is provided by an
IOMMU then such assumptions can fall apart spectacularly.

To resolve this, reroute the fb_mmap call to the appropriate DMA API
implementation, as per the other cma_helper calls.
Signed-off-by: NRobin Murphy <robin.murphy@arm.com>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/8fd95ac1440e0f01daad6d4380be3a4c8fa61055.1465301219.git.robin.murphy@arm.com

The function has no side effect and its returned values are ignored,
don't call it.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: NEric Engestrom <eric.engestrom@imgtec.com>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465236891-11773-1-git-send-email-laurent.pinchart@ideasonboard.com

The function has no side effect and its returned values are ignored,
don't call it.
Signed-off-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: NEric Engestrom <eric.engestrom@imgtec.com>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465236852-11710-1-git-send-email-laurent.pinchart@ideasonboard.com

Adapt drm_pick_crtcs() and update_connector_routing() to fallback to
drm_atomic_helper_best_encoder() if funcs->best_encoder() is NULL so
that DRM drivers can leave this hook unassigned if they know they want
to use drm_atomic_helper_best_encoder().

Update the vtables documentation accordingly.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465300095-16971-2-git-send-email-boris.brezillon@free-electrons.com

Change return value to int to propagate errors from gamma_set,
and remove start parameter. Updates always use the full size,
and some drivers even ignore the start parameter altogether.

This is needed for atomic drivers, where an atomic commit can
fail with -EINTR or -ENOMEM and should be restarted. This is already
and issue for drm_atomic_helper_legacy_set_gamma, which this patch
fixes up.

Changes since v1:
- Fix compiler warning. (Emil)
- Fix commit message (Daniel)

Cc: Alex Deucher <alexander.deucher@amd.com>
Acked-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: Christian König <christian.koenig@amd.com>
Cc: David Airlie <airlied@linux.ie>
Cc: Patrik Jakobsson <patrik.r.jakobsson@gmail.com>
Cc: Ben Skeggs <bskeggs@redhat.com>
Cc: Eric Anholt <eric@anholt.net>
Cc: VMware Graphics <linux-graphics-maintainer@vmware.com>
Cc: Mathieu Larouche <mathieu.larouche@matrox.com>
Cc: Thierry Reding <treding@nvidia.com>
Acked-by: NPatrik Jakobsson <patrik.r.jakobsson@gmail.com>
Signed-off-by: NMaarten Lankhorst <maarten.lankhorst@linux.intel.com>
[danvet: Improve commit message a bit more, mention that this fixes
the helper.]
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/742944bc-9f41-1acb-df4f-0fd4c8a10168@linux.intel.com

Include fence-array files in the DocBook.
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465226465-23683-1-git-send-email-gustavo@padovan.org

Replace the legacy drm_vblank_{get,put}() with the new helper functions.
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
Reviewed-by: NAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465224105-21485-14-git-send-email-gustavo@padovan.org

Replace the legacy drm_vblank_{get,put}() with the new helper functions.
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
Reviewed-by: NAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465224105-21485-13-git-send-email-gustavo@padovan.org

Replace the legacy drm_vblank_{get,put}() with the new helper functions.
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
Reviewed-by: NAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465224105-21485-12-git-send-email-gustavo@padovan.org

Replace the legacy drm_vblank_{get,put}() with the new helper functions.
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
Reviewed-by: NAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465224105-21485-10-git-send-email-gustavo@padovan.org

Replace the legacy drm_vblank_{get,put}() with the new helper functions.
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
Reviewed-by: NAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465224105-21485-9-git-send-email-gustavo@padovan.org

Replace the legacy drm_vblank_{get,put}() with the new helper functions.
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
Reviewed-by: NAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465224105-21485-8-git-send-email-gustavo@padovan.org

Replace the legacy drm_send_vblank_event() with the new helper function.
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465224105-21485-6-git-send-email-gustavo@padovan.org

Replace the legacy drm_send_vblank_event() with the new helper function.
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465224105-21485-5-git-send-email-gustavo@padovan.org

Replace the legacy drm_send_vblank_event() with the new helper function.
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465224105-21485-4-git-send-email-gustavo@padovan.org

Replace the legacy drm_send_vblank_event() with the new helper function.
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465224105-21485-3-git-send-email-gustavo@padovan.org

Replace the legacy drm_send_vblank_event() with the new helper function.
Signed-off-by: NGustavo Padovan <gustavo.padovan@collabora.co.uk>
Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>
Link: http://patchwork.freedesktop.org/patch/msgid/1465224105-21485-2-git-send-email-gustavo@padovan.org

Signed-off-by: NDaniel Vetter <daniel.vetter@ffwll.ch>

Pull parisc fixes from Helge Deller:

 - Fix printk time stamps on SMP systems which got wrong due to a patch
   which was added during the merge window

 - Fix two bugs in the stack backtrace code: Races in module unloading
   and possible invalid accesses to memory due to wrong instruction
   decoding (Mikulas Patocka)

 - Fix userspace crash when syscalls access invalid unaligned userspace
   addresses.  Those syscalls will now return EFAULT as expected.
   (tagged for stable kernel series)

* 'parisc-4.7-2' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc: Move die_if_kernel() prototype into traps.h header
  parisc: Fix pagefault crash in unaligned __get_user() call
  parisc: Fix printk time during boot
  parisc: Fix backtrace on PA-RISC

Pull key handling update from James Morris:
 "This alters a new keyctl function added in the current merge window to
  allow for a future extension planned for the next merge window"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  KEYS: Add placeholder for KDF usage with DH

The /dev/ptmx device node is changed to lookup the directory entry "pts"
in the same directory as the /dev/ptmx device node was opened in.  If
there is a "pts" entry and that entry is a devpts filesystem /dev/ptmx
uses that filesystem.  Otherwise the open of /dev/ptmx fails.

The DEVPTS_MULTIPLE_INSTANCES configuration option is removed, so that
userspace can now safely depend on each mount of devpts creating a new
instance of the filesystem.

Each mount of devpts is now a separate and equal filesystem.

Reserved ttys are now available to all instances of devpts where the
mounter is in the initial mount namespace.

A new vfs helper path_pts is introduced that finds a directory entry
named "pts" in the directory of the passed in path, and changes the
passed in path to point to it.  The helper path_pts uses a function
path_parent_directory that was factored out of follow_dotdot.

In the implementation of devpts:
 - devpts_mnt is killed as it is no longer meaningful if all mounts of
   devpts are equal.
 - pts_sb_from_inode is replaced by just inode->i_sb as all cached
   inodes in the tty layer are now from the devpts filesystem.
 - devpts_add_ref is rolled into the new function devpts_ptmx.  And the
   unnecessary inode hold is removed.
 - devpts_del_ref is renamed devpts_release and reduced to just a
   deacrivate_super.
 - The newinstance mount option continues to be accepted but is now
   ignored.

In devpts_fs.h definitions for when !CONFIG_UNIX98_PTYS are removed as
they are never used.

Documentation/filesystems/devices.txt is updated to describe the current
situation.

This has been verified to work properly on openwrt-15.05, centos5,
centos6, centos7, debian-6.0.2, debian-7.9, debian-8.2, ubuntu-14.04.3,
ubuntu-15.10, fedora23, magia-5, mint-17.3, opensuse-42.1,
slackware-14.1, gentoo-20151225 (13.0?), archlinux-2015-12-01.  With the
caveat that on centos6 and on slackware-14.1 that there wind up being
two instances of the devpts filesystem mounted on /dev/pts, the lower
copy does not end up getting used.
Signed-off-by: N"Eric W. Biederman" <ebiederm@xmission.com>
Cc: Greg KH <greg@kroah.com>
Cc: Peter Hurley <peter@hurleysoftware.com>
Cc: Peter Anvin <hpa@zytor.com>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Serge Hallyn <serge.hallyn@ubuntu.com>
Cc: Willy Tarreau <w@1wt.eu>
Cc: Aurelien Jarno <aurelien@aurel32.net>
Cc: One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>
Cc: Jann Horn <jann@thejh.net>
Cc: Jiri Slaby <jslaby@suse.com>
Cc: Florian Weimer <fw@deneb.enyo.de>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NHelge Deller <deller@gmx.de>

One of the debian buildd servers had this crash in the syslog without
any other information:

 Unaligned handler failed, ret = -2
 clock_adjtime (pid 22578): Unaligned data reference (code 28)
 CPU: 1 PID: 22578 Comm: clock_adjtime Tainted: G  E  4.5.0-2-parisc64-smp #1 Debian 4.5.4-1
 task: 000000007d9960f8 ti: 00000001bde7c000 task.ti: 00000001bde7c000

      YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI
 PSW: 00001000000001001111100000001111 Tainted: G            E
 r00-03  000000ff0804f80f 00000001bde7c2b0 00000000402d2be8 00000001bde7c2b0
 r04-07  00000000409e1fd0 00000000fa6f7fff 00000001bde7c148 00000000fa6f7fff
 r08-11  0000000000000000 00000000ffffffff 00000000fac9bb7b 000000000002b4d4
 r12-15  000000000015241c 000000000015242c 000000000000002d 00000000fac9bb7b
 r16-19  0000000000028800 0000000000000001 0000000000000070 00000001bde7c218
 r20-23  0000000000000000 00000001bde7c210 0000000000000002 0000000000000000
 r24-27  0000000000000000 0000000000000000 00000001bde7c148 00000000409e1fd0
 r28-31  0000000000000001 00000001bde7c320 00000001bde7c350 00000001bde7c218
 sr00-03  0000000001200000 0000000001200000 0000000000000000 0000000001200000
 sr04-07  0000000000000000 0000000000000000 0000000000000000 0000000000000000

 IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000402d2e84 00000000402d2e88
  IIR: 0ca0d089    ISR: 0000000001200000  IOR: 00000000fa6f7fff
  CPU:        1   CR30: 00000001bde7c000 CR31: ffffffffffffffff
  ORIG_R28: 00000002369fe628
  IAOQ[0]: compat_get_timex+0x2dc/0x3c0
  IAOQ[1]: compat_get_timex+0x2e0/0x3c0
  RP(r2): compat_get_timex+0x40/0x3c0
 Backtrace:
  [<00000000402d4608>] compat_SyS_clock_adjtime+0x40/0xc0
  [<0000000040205024>] syscall_exit+0x0/0x14

This means the userspace program clock_adjtime called the clock_adjtime()
syscall and then crashed inside the compat_get_timex() function.
Syscalls should never crash programs, but instead return EFAULT.

The IIR register contains the executed instruction, which disassebles
into "ldw 0(sr3,r5),r9".
This load-word instruction is part of __get_user() which tried to read the word
at %r5/IOR (0xfa6f7fff). This means the unaligned handler jumped in.  The
unaligned handler is able to emulate all ldw instructions, but it fails if it
fails to read the source e.g. because of page fault.

The following program reproduces the problem:

#define _GNU_SOURCE
#include <unistd.h>
#include <sys/syscall.h>
#include <sys/mman.h>

int main(void) {
        /* allocate 8k */
        char *ptr = mmap(NULL, 2*4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
        /* free second half (upper 4k) and make it invalid. */
        munmap(ptr+4096, 4096);
        /* syscall where first int is unaligned and clobbers into invalid memory region */
        /* syscall should return EFAULT */
        return syscall(__NR_clock_adjtime, 0, ptr+4095);
}

To fix this issue we simply need to check if the faulting instruction address
is in the exception fixup table when the unaligned handler failed. If it
is, call the fixup routine instead of crashing.

While looking at the unaligned handler I found another issue as well: The
target register should not be modified if the handler was unsuccessful.
Signed-off-by: NHelge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org

Avoid showing invalid printk time stamps during boot.
Signed-off-by: NHelge Deller <deller@gmx.de>
Reviewed-by: NAaro Koskinen <aaro.koskinen@iki.fi>

This patch fixes backtrace on PA-RISC

There were several problems:

1) The code that decodes instructions handles instructions that subtract
from the stack pointer incorrectly. If the instruction subtracts the
number X from the stack pointer the code increases the frame size by
(0x100000000-X).  This results in invalid accesses to memory and
recursive page faults.

2) Because gcc reorders blocks, handling instructions that subtract from
the frame pointer is incorrect. For example, this function
	int f(int a)
	{
		if (__builtin_expect(a, 1))
			return a;
		g();
		return a;
	}
is compiled in such a way, that the code that decreases the stack
pointer for the first "return a" is placed before the code for "g" call.
If we recognize this decrement, we mistakenly believe that the frame
size for the "g" call is zero.

To fix problems 1) and 2), the patch doesn't recognize instructions that
decrease the stack pointer at all. To further safeguard the unwind code
against nonsense values, we don't allow frame size larger than
Total_frame_size.

3) The backtrace is not locked. If stack dump races with module unload,
invalid table can be accessed.

This patch adds a spinlock when processing module tables.

Note, that for correct backtrace, you need recent binutils.
Binutils 2.18 from Debian 5 produce garbage unwind tables.
Binutils 2.21 work better (it sometimes forgets function frames, but at
least it doesn't generate garbage).
Signed-off-by: NMikulas Patocka <mpatocka@redhat.com>
Signed-off-by: NHelge Deller <deller@gmx.de>

Pull drm fixes from Dave Airlie:
 "A bunch of ARM drivers got into the fixes vibe this time around, so
  this contains a bunch of fixes for imx, atmel hlcdc, arm hdlcd (only
  so many combos of hlcd), mediatek and omap drm.

  Other than that there is one mgag200 fix and a few core drm regression
  fixes"

* tag 'drm-fixes-for-v4.7-rc2' of git://people.freedesktop.org/~airlied/linux: (34 commits)
  drm/omap: fix unused variable warning.
  drm: hdlcd: Add information about the underlying framebuffers in debugfs
  drm: hdlcd: Cleanup the atomic plane operations
  drm/hdlcd: Fix up crtc_state->event handling
  drm: hdlcd: Revamp runtime power management
  drm/mediatek: mtk_dsi: Remove spurious drm_connector_unregister
  drm/mediatek: mtk_dpi: remove invalid error message
  drm: atmel-hlcdc: fix a NULL check
  drm: atmel-hlcdc: fix atmel_hlcdc_crtc_reset() implementation
  drm/mgag200: Black screen fix for G200e rev 4
  drm: Wrap direct calls to driver->gem_free_object from CMA
  drm: fix fb refcount issue with atomic modesetting
  drm: make drm_atomic_set_mode_prop_for_crtc() more reliable
  drm/sti: remove extra mode fixup
  drm: add missing drm_mode_set_crtcinfo call
  drm/omap: include gpio/consumer.h where needed
  drm/omap: include linux/seq_file.h where needed
  Revert "drm/omap: no need to select OMAP2_DSS"
  drm/omap: Remove regulator API abuse
  OMAPDSS: HDMI5: Change DDC timings
  ...

Pull VFIO fixes from Alex Williamson:
 "Fix irqfd shutdown ordering, build warning, and VPD short read"

* tag 'vfio-v4.7-rc2' of git://github.com/awilliam/linux-vfio:
  vfio/pci: Allow VPD short read
  vfio/type1: Fix build warning
  vfio/pci: Fix ordering of eventfd vs virqfd shutdown

Pull MMC fixes from Ulf Hansson:
 "MMC core:
   - Fix/restore behaviour when selecting bus width for (e)MMC

  MMC host:
   - sunxi: Fix eMMC HS-DDR modes on Allwinner A80"

* tag 'mmc-v4.7-rc1-2' of git://git.linaro.org/people/ulf.hansson/mmc:
  mmc: sunxi: Re-enable eMMC HS-DDR modes on Allwinner A80
  mmc: sunxi: Fix DDR MMC timings for A80
  mmc: fix mmc mode selection for HS-DDR and higher

Pull btrfs fixes from Chris Mason:
 "The important part of this pull is Filipe's set of fixes for btrfs
  device replacement.  Filipe fixed a few issues seen on the list and a
  number he found on his own"

* 'for-linus-4.7' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  Btrfs: deal with duplciates during extent_map insertion in btrfs_get_extent
  Btrfs: fix race between device replace and read repair
  Btrfs: fix race between device replace and discard
  Btrfs: fix race between device replace and chunk allocation
  Btrfs: fix race setting block group back to RW mode during device replace
  Btrfs: fix unprotected assignment of the left cursor for device replace
  Btrfs: fix race setting block group readonly during device replace
  Btrfs: fix race between device replace and block group removal
  Btrfs: fix race between readahead and device replace/removal

Pull Ceph fixes from Sage Weil:
 "We have a few follow-up fixes for the libceph refactor from Ilya, and
  then some cephfs + fscache fixes from Zheng.

  The first two FS-Cache patches are acked by David Howells and deemed
  trivial enough to go through our tree.  The rest fix some issues with
  the ceph fscache handling (disable cache for inodes opened for write,
  and simplify the revalidation logic accordingly, dropping the
  now-unnecessary work queue)"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
  ceph: use i_version to check validity of fscache
  ceph: improve fscache revalidation
  ceph: disable fscache when inode is opened for write
  ceph: avoid unnecessary fscache invalidation/revlidation
  ceph: call __fscache_uncache_page() if readpages fails
  FS-Cache: make check_consistency callback return int
  FS-Cache: wake write waiter after invalidating writes
  libceph: use %s instead of %pE in dout()s
  libceph: put request only if it's done in handle_reply()
  libceph: change ceph_osdmap_flag() to take osdc

Pull ACPI fixes from Rafael Wysocki:
 "Two fixes for problems introduced recently (ACPICA and the ACPI
  backlight driver) and one fix for an older issue that prevents at
  least one system from booting.

  Specifics:

   - Fix an incorrect check introduced by recent ACPICA changes which
     causes problems with booting KVM guests to happen, among other
     things (Lv Zheng).

   - Fix a backlight issue introduced by recent changes to the ACPI
     video driver (Aaron Lu).

   - Fix the ACPI processor initialization which attempts to register an
     IO region without checking if that really is necessary and
     sometimes prevents drivers loaded subsequently from registering
     their resources which leads to boot issues (Rafael Wysocki)"

* tag 'acpi-4.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI / processor: Avoid reserving IO regions too early
  ACPICA / Hardware: Fix old register check in acpi_hw_get_access_bit_width()
  ACPI / Thermal / video: fix max_level incorrect value

Pull power management fixes from Rafael Wysocki:
 "Two fixes for problems introduced recently in the cpufreq core and the
  intel_pstate driver.

  Specifics:

   - Fix a silly mistake related to the clamp_val() usage in a function
     added by a recent commit (Rafael Wysocki).

   - Reduce the log level of an annoying message added to intel_pstate
     during the recent merge window (Srinivas Pandruvada)"

* tag 'pm-4.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpufreq: Fix clamp_val() usage in cpufreq_driver_fast_switch()
  cpufreq: intel_pstate: Downgrade print level for _PPC

Merge various fixes from Andrew Morton:
 "10 fixes"

* emailed patches from Andrew Morton <akpm@linux-foundation.org>:
  mm, page_alloc: recalculate the preferred zoneref if the context can ignore memory policies
  mm, page_alloc: reset zonelist iterator after resetting fair zone allocation policy
  mm, oom_reaper: do not use siglock in try_oom_reaper()
  mm, page_alloc: prevent infinite loop in buffered_rmqueue()
  checkpatch: reduce git commit description style false positives
  mm/z3fold.c: avoid modifying HEADLESS page and minor cleanup
  memcg: add RCU locking around css_for_each_descendant_pre() in memcg_offline_kmem()
  mm: check the return value of lookup_page_ext for all call sites
  kdump: fix dmesg gdbmacro to work with record based printk
  mm: fix overflow in vm_map_ram()

Pull irq fixes from Thomas Gleixner:
 - a few simple fixes for fallout from the recent gic-v3 changes
 - a workaround for a Cavium thunderX erratum
 - a bugfix for the pic32 irqchip to make external interrupts work proper
 - a missing return value in the generic IPI management code

* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/irq-pic32-evic: Fix bug with external interrupts.
  irqchip/gicv3-its: numa: Enable workaround for Cavium thunderx erratum 23144
  irqchip/gic-v3: Fix quiescence check in gic_enable_redist
  irqchip/gic-v3: Fix copy+paste mistakes in defines
  irqchip/gic-v3: Fix ICC_SGI1R_EL1.INTID decoding mask
  genirq: Fix missing return value in irq_destroy_ipi()