Pull drm fixes from Dave Airlie:
 "Fixes for i915, nouveau and radeon:

   - i915: haswell stability, modeset rework fallout, ums fix
   - nouveau: misc fixes from code rework
   - radeon: pll rework fixes, more 2 level PTE cleanups.
   - core: warning fixes on 32-bit."

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (31 commits)
  nouveau: fix warning on 32-bit build.
  drm/nouveau/bios: fix typo in error message
  drm/nouveau: only call ttm_agp_tt_create when __OS_HAS_AGP
  drm/nv50/fb: fix double free of vram mm
  drm/nouveau/pm: do not stop reclocking if failing to set the fan speed
  drm/nouveau/pm: fix a typo related to the move to the therm subdev
  drm/nouveau/hwmon: fix the initialization condition
  drm: fix warning on 32-bit.
  drm: radeon: fix printk format warning
  drm/radeon: fix spelling typos in debugging output
  drm/radeon: Don't destroy I2C Bus Rec in radeon_ext_tmds_enc_destroy().
  drm/radeon: check if pcie gen 2 is already enabled (v2)
  drm/radeon/cayman: set VM max pfn at MC init
  drm/radeon: separate pt alloc from lru add
  drm/radeon: don't add the IB pool to all VMs v2
  drm/radeon: allocate page tables on demand v4
  drm/radeon: update comments to clarify VM setup (v2)
  drm/radeon: allocate PPLLs from low to high
  drm/radeon: fix compilation with backlight disabled
  drm/radeon: use %zu for formatting size_t
  ...

Pull ext2, ext3, quota fixes from Jan Kara:
 "Fix three regressions caused by user namespace conversions (ext2,
  ext3, quota) and minor ext3 fix and cleanup."

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  quota: Silence warning about PRJQUOTA not being handled in need_print_warning()
  ext3: fix return values on parse_options() failure
  ext2: fix return values on parse_options() failure
  ext3: ext3_bread usage audit
  ext3: fix possible non-initialized variable on htree_dirblock_to_tree()

Pull vfs fixes from Al Viro:
 "Fix for my braino in replace_fd(), dhowell's fix for the fallout from
  over-enthusiastic bo^Wdeclaration movements plus crapectomy that
  should've happened a long time ago (SEL_...  definitions)."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  bury SEL_{IN,OUT,EX}
  Unexport some bits of linux/fs.h
  fix a leak in replace_fd() users

Merge tag 'pinctrl-fixes-v3.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pinctrl fixes from Linus Walleij:
 "A number of pinctrl fixes for the v3.7 series:
   - duplicate includes, section markup, code mishaps
   - erroneous return value in errorpath on the bcm2835 driver
   - remove an unused sirf function that was causing build errors
   - multiple-platform compilation stubs and a missed code review
     comment fixup on the nomadik pin controller"

* tag 'pinctrl-fixes-v3.7-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl/nomadik: always use the simple irqdomain
  pinctrl/nomadik: provide stubs for legacy Nomadik
  pinctrl: remove duplicated include from pinctrl-xway.c
  pinctrl: sirf: remove sirfsoc_gpio_set_pull function
  pinctrl: fix return value in bcm2835_pinctrl_probe()
  pinctrl: remove duplicated include from pinctrl-bcm2835.c
  pinctrl: bcm2835: Use existing pointer to struct device
  pinctrl: samsung: use __devinit section for init code

Merge emailed patches from Corey Minyard:
 "Remove some bogus docs, Fix ACPI/IPMI interactions, fix some warnings,
  and add register spacing detection for PCI interfaces."

* ipmi:
  IPMI: Detect register spacing on PCI interfaces
  IPMI: Fix some uninitialized warning
  IPMI: Change link order
  ACPI: Reorder IPMI driver before any other ACPI drivers
  IPMI: Remove SMBus driver info from the docs

The IPMI spec defines a way to detect register spacing for PCI interfaces,
so implement it.
Signed-off-by: NSteven Hsieh <sshsieh@broadcom.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

There was a spot where the compiler couldn't tell some variables
would be set.  So initialize them to make the warning go away.
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

IPMI must be initialised before ACPI in order to ensure that any IPMI
services are available before ACPI driver initialisation attempts to use
any IPMI operation regions.
Signed-off-by: NMatthew Garrett <mjg@redhat.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Drivers may make calls that require the ACPI IPMI driver to have been
initialised already, so make sure that it appears earlier in the build
order.
Signed-off-by: NMatthew Garrett <mjg@redhat.com>
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Some documentation for the SMBus driver is in the IPMI docs, but that
code is not in the kernel tree at this point.  So remove the docs to
avoid confusion.
Signed-off-by: NCorey Minyard <cminyard@mvista.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NBryan Wu <cooloney@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

When reading /proc/pid/numa_maps, it's possible to return the contents of
the stack where the mempolicy string should be printed if the policy gets
freed from beneath us.

This happens because mpol_to_str() may return an error the
stack-allocated buffer is then printed without ever being stored.

There are two possible error conditions in mpol_to_str():

 - if the buffer allocated is insufficient for the string to be stored,
   and

 - if the mempolicy has an invalid mode.

The first error condition is not triggered in any of the callers to
mpol_to_str(): at least 50 bytes is always allocated on the stack and this
is sufficient for the string to be written.  A future patch should convert
this into BUILD_BUG_ON() since we know the maximum strlen possible, but
that's not -rc material.

The second error condition is possible if a race occurs in dropping a
reference to a task's mempolicy causing it to be freed during the read().
The slab poison value is then used for the mode and mpol_to_str() returns
-EINVAL.

This race is only possible because get_vma_policy() believes that
mm->mmap_sem protects task->mempolicy, which isn't true.  The exit path
does not hold mm->mmap_sem when dropping the reference or setting
task->mempolicy to NULL: it uses task_lock(task) instead.

Thus, it's required for the caller of a task mempolicy to hold
task_lock(task) while grabbing the mempolicy and reading it.  Callers with
a vma policy store their mempolicy earlier and can simply increment the
reference count so it's guaranteed not to be freed.
Reported-by: NDave Jones <davej@redhat.com>
Signed-off-by: NDavid Rientjes <rientjes@google.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

	Had not been used for more than a decade and half; it used
to be a part of (in-kernel) ->select() API and it has been pining
for fjords since 2.1.23pre1.  This is an ex-parrot...
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

There are some bits of linux/fs.h which are only used within the kernel and
shouldn't be in the UAPI.  Move these from uapi/linux/fs.h into linux/fs.h.
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

replace_fd() began with "eats a reference, tries to insert into
descriptor table" semantics; at some point I'd switched it to
much saner current behaviour ("try to insert into descriptor
table, grabbing a new reference if inserted; caller should do
fput() in any case"), but forgot to update the callers.
Mea culpa...

[Spotted by Pavel Roskin, who has really weird system with pipe-fed
coredumps as part of what he considers a normal boot ;-)]
Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>

Signed-off-by: NDave Airlie <airlied@redhat.com>

Merge branch 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6 into drm-fixes

minor set of nouveau fixes.

* 'drm-nouveau-fixes' of git://anongit.freedesktop.org/git/nouveau/linux-2.6:
  drm/nouveau/bios: fix typo in error message
  drm/nouveau: only call ttm_agp_tt_create when __OS_HAS_AGP
  drm/nv50/fb: fix double free of vram mm
  drm/nouveau/pm: do not stop reclocking if failing to set the fan speed
  drm/nouveau/pm: fix a typo related to the move to the therm subdev
  drm/nouveau/hwmon: fix the initialization condition

Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

ttm_agp_tt_create is itself defined under CONFIG_AGP, so there's no
point calling it otherwise.
Signed-off-by: NMax Filippov <jcmvbkbc@gmail.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

nouveau_fb_destroy already calls nouveau_mm_fini on vram mm.
Signed-off-by: NMarcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

With the introduction of fan management modes, fan may not be drivable.
We should allow reclocking nonetheless.

This return was stupid to begin with since it may have left the card
in an intermediate state (clocks corresponding to a perflvl and voltage
corresponding to another one). The reclocking code will need to be
rewritten in a near-future in order to provide a better error handling.
Reported-by: NMarcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: NMartin Peres <martin.peres@labri.fr>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Reported-by: Vekin on IRC
Reported-by: NEmil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: NMartin Peres <martin.peres@labri.fr>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

Signed-off-by: NMartin Peres <martin.peres@labri.fr>
Signed-off-by: NBen Skeggs <bskeggs@redhat.com>

This cast was causing a warning on 32-bit builds.
Signed-off-by: NDave Airlie <airlied@redhat.com>

drivers/gpu/drm/radeon/radeon_atpx_handler.c:151:3: warning: format '%lu' expects type 'long unsigned int', but argument 2 has type 'size_t'

[airlied: Alex had others fixed already, except for atpx one]
Signed-off-by: NRandy Dunlap <rdunlap@xenotime.net>
Signed-off-by: NDave Airlie <airlied@redhat.com>

Alex writes:
"This is the first -fixes pull for 3.7.  I would have preferred
to have gotten it out a bit sooner, but I was on holiday last week.
- Cleanup of the new 2 level page table code it get it in
  better shape and using less memory.
- Fix some display issues related to the PLL rework.
- Fix some cmpiler warnings and errors with certain config
  options.
- Other misc bug fixes."

* 'drm-fixes-3.7' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon: fix spelling typos in debugging output
  drm/radeon: Don't destroy I2C Bus Rec in radeon_ext_tmds_enc_destroy().
  drm/radeon: check if pcie gen 2 is already enabled (v2)
  drm/radeon/cayman: set VM max pfn at MC init
  drm/radeon: separate pt alloc from lru add
  drm/radeon: don't add the IB pool to all VMs v2
  drm/radeon: allocate page tables on demand v4
  drm/radeon: update comments to clarify VM setup (v2)
  drm/radeon: allocate PPLLs from low to high
  drm/radeon: fix compilation with backlight disabled
  drm/radeon: use %zu for formatting size_t

Daniel writes:
"- some register magic to fix hsw crw (Paulo&Ben)
- fix backlight destruction for cpu edp (Jani)
- fix gen ch7xxx dvo ->get_hw_state
- fixup the plane->pipe fixup code, the broken version massively angers
  the modeset sanity checks
- kill pipe A quirk for i855gm, otherwise I get a black screen with the
  above patch
- fixup for gem_get_page helper (Chris)
- fixup guardband clipping w/a (Ken), without this mesa master can erronously
  drop vertices on snb, mesa 9.0 has the optimization reverted
- another pageflip vs. modeset fix
- kill bogus BUG_ON which broke ums+gem from Willy Tarreau (gasp, people
  are still using this!)"

* 'drm-intel-fixes' of git://people.freedesktop.org/~danvet/drm-intel:
  drm/i915: fix non-DP-D eDP backlight cleanup and module reload
  drm/i915: HSW CRW stability magic
  drm/i915/dvo-ch7xxx: fix get_hw_state
  drm/i915: fixup the plane->pipe fixup code
  drm/i915: rip out the pipe A quirk for i855gm
  drm/i915: disable wc gtt pte mappings on gen2
  drm/i915: fixup i915_gem_object_get_page inline helper
  drm/i915: Disallow preallocation of requests
  drm/i915: Set guardband clipping workaround bit in the right register.
  drm/i915: paper over a pipe-enable vs pageflip race
  drm/i915: remove useless BUG_ON which caused a regression in 3.5.

Commit 02361418 ("thermal: add generic cpufreq cooling
implementation") requires cpufreq_frequency_get_table(), but that
function is only defined for CONFIG_CPU_FREQ_TABLE resulting in the
following build error:

  drivers/built-in.o: In function `cpufreq_get_max_state':
  drivers/thermal/cpu_cooling.c:259: undefined reference to `cpufreq_frequency_get_table'
  drivers/built-in.o: In function `get_cpu_frequency':
  drivers/thermal/cpu_cooling.c:129: undefined reference to `cpufreq_frequency_get_table'

Fix it by selecting CONFIG_CPU_FREQ_TABLE for such a configuration.

It turns out CONFIG_EXYNOS_THERMAL also needs CONFIG_CPU_FREQ_TABLE, so
select it there as well.
Signed-off-by: NDavid Rientjes <rientjes@google.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Commit fe04ddf7 ("kbuild: Do not package /boot and /lib in make
tar-pkg") accidentally reverted two previous kbuild commits.  I don't
know what I was thinking.

This brings back changes made by commits 24cc7fb6 ("x86/kbuild:
archscripts depends on scripts_basic") and c1c1a59e ("firmware: fix
directory creation rule matching with make 3.80")
Reported-by: NJan Beulich <JBeulich@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NMichal Marek <mmarek@suse.cz>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

radeon_i2c_fini() walks thru the list of I2C bus recs rdev->i2c_bus[]
to destroy each of them.
radeon_ext_tmds_enc_destroy() however also has code to destroy it's
associated I2C bus rec which has been obtained by radeon_i2c_lookup()
and is therefore also in the i2c_bus[] list.
This causes a double free resulting in a kernel panic when unloading
the radeon driver.
Removing destroy code from radeon_ext_tmds_enc_destroy() fixes this
problem.

agd5f: fix compiler warning
Signed-off-by: NEgbert Eich <eich@suse.de>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org

If so, skip enabling it to save time.

v2: coding style fixes
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

No need to emit them at VM flush as we no longer use
variable sized page tables now that we support 2 level
page tables.  This matches the behavior of SI (which
does not support variable sized page tables).
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Reviewed-by: NChristian König <christian.koenig@amd.com>

Make it possible to allocate a persistent page table.
Signed-off-by: NChristian König <deathsimple@vodafone.de>
Reviewed-by: NAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

We want to use VMs without the IB pool in the future.

v2: also remove it from radeon_vm_finish.
Signed-off-by: NChristian König <deathsimple@vodafone.de>
Reviewed-by: NMichel Dänzer <michel.daenzer@amd.com>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Based on Dmitries work, but splitting the code into page
directory and page table handling makes it far more
readable and (hopefully) more reliable.

Allocations of page tables are made from the SA on demand,
that should still work fine since all page tables are of
the same size.

Also using the fact that allocations from the SA are mostly
continuously (except for end of buffer wraps and under very
high memory pressure) to group updates send to the chipset
specific code into larger chunks.

v3: mostly a rewrite of Dmitries previous patch.
v4: fix some typos and coding style
Signed-off-by: NDmitry Cherkasov <Dmitrii.Cherkasov@amd.com>
Signed-off-by: NChristian König <deathsimple@vodafone.de>
Tested-by: NMichel Dänzer <michel.daenzer@amd.com>
Reviewed-by: NAlex Deucher <alexander.deucher@amd.com>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

The actual set up and assignment of VM page tables
is done on the fly in radeon_gart.c.

v2: update vm size comments
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Reviewed-by: NChristian König <christian.koenig@amd.com>

The order shouldn't matter, but there have been problems
reported on certain older asics.  This behaves more
like the original code before the PPLL allocation
rework.
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
Cc:  Markus Trippelsdorf <markus@trippelsdorf.de>

Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>

Fixes compiler warnings on 32bit.
Signed-off-by: NLuca Tettamanti <kronos.it@gmail.com>
Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>