Pull core locking updates from Ingo Molnar:
 "This update:

   - extends and simplifies x86 NMI callback handling code to enhance
     and fix the HP hw-watchdog driver

   - simplifies the x86 NMI callback handling code to fix a kmemcheck
     bug.

   - enhances the hung-task debugger"

* 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/nmi: Fix the type of the nmiaction.flags field
  x86/nmi: Fix page faults by nmiaction if kmemcheck is enabled
  x86/nmi: Add new NMI queues to deal with IO_CHK and SERR
  watchdog, hpwdt: Remove priority option for NMI callback
  hung task debugging: Inject NMI when hung and going to panic

Pull iommu core changes from Ingo Molnar:
 "The IOMMU changes in this cycle are mostly about factoring out
  Intel-VT-d specific IRQ remapping details and introducing struct
  irq_remap_ops, in preparation for AMD specific hardware."

* 'core-iommu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  iommu: Fix off by one in dmar_get_fault_reason()
  irq_remap: Fix the 'sub_handle' uninitialized warning
  irq_remap: Fix UP build failure
  irq_remap: Fix compiler warning with CONFIG_IRQ_REMAP=y
  iommu: rename intr_remapping.[ch] to irq_remapping.[ch]
  iommu: rename intr_remapping references to irq_remapping
  x86, iommu/vt-d: Clean up interfaces for interrupt remapping
  iommu/vt-d: Convert MSI remapping setup to remap_ops
  iommu/vt-d: Convert free_irte into a remap_ops callback
  iommu/vt-d: Convert IR set_affinity function to remap_ops
  iommu/vt-d: Convert IR ioapic-setup to use remap_ops
  iommu/vt-d: Convert missing apic.c intr-remapping call to remap_ops
  iommu/vt-d: Make intr-remapping initialization generic
  iommu: Rename intr_remapping files to intel_intr_remapping

Pull core/debugobjects changes from Ingo Molnar:
 "Not much happened: it includes a cleanup and an irq latency reduction
  fixlet."

* 'core-debugobjects-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  debugobjects: Fill_pool() returns void now
  debugobjects: printk with irqs enabled
  debugobjects: Remove unused return value from fill_pool()

Pull GFS2 changes from Steven Whitehouse.

* git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-nmw: (24 commits)
  GFS2: Fix quota adjustment return code
  GFS2: Add rgrp information to block_alloc trace point
  GFS2: Eliminate unused "new" parameter to gfs2_meta_indirect_buffer
  GFS2: Update glock doc to add new stats info
  GFS2: Update main gfs2 doc
  GFS2: Remove redundant metadata block type check
  GFS2: Fix sgid propagation when using ACLs
  GFS2: eliminate log elements and simplify
  GFS2: Eliminate vestigial sd_log_le_rg
  GFS2: Eliminate needless parameter from function gfs2_setbit
  GFS2: Log code fixes
  GFS2: Remove unused argument from gfs2_internal_read
  GFS2: Remove bd_list_tr
  GFS2: Remove duplicate log code
  GFS2: Clean up log write code path
  GFS2: Use variable rather than qa to determine if unstuff necessary
  GFS2: Change variable blk to biblk
  GFS2: Fix function parameter comments in rgrp.c
  GFS2: Eliminate offset parameter to gfs2_setbit
  GFS2: Use slab for block reservation memory
  ...

Pull m68knommu tree from Greg Ungerer:
 "More merge and clean up of MMU and non-MMU common files, namely
  signal.c and dma.c.  There is also a simplification of the ColdFire
  GPIO setup tables.  Using a couple of simple macros we make the init
  tables really small and easy to read, and save a couple of thousand
  lines of code.  Also a move of all the ColdFire subarch support files
  into the existing coldfire directory.  The sub-directories just ended
  up duplicating Makefiles and now only contain really simple pieces of
  code.  This saves quite a few lines of code too.

  As always a couple of bugs fixes thrown in too.  Oh and a new
  defconfig for the ColdFire platforms that support having the MMU
  enabled."

* 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu: (39 commits)
  m68k: add a defconfig for the M5475EVB ColdFire with MMU board
  m68knommu: unaligned.h fix for M68000 core
  m68k: merge the MMU and non-MMU versions of the arch dma code
  m68knommu: reorganize the no-MMU cache flushing to match m68k
  m68knommu: move the 54xx platform code into the common ColdFire code directory
  m68knommu: move the 532x platform code into the common ColdFire code directory
  m68knommu: move the 5407 platform code into the common ColdFire code directory
  m68knommu: move the 5307 platform code into the common ColdFire code directory
  m68knommu: move the 528x platform code into the common ColdFire code directory
  m68knommu: move the 527x platform code into the common ColdFire code directory
  m68knommu: move the 5272 platform code into the common ColdFire code directory
  m68knommu: move the 5249 platform code into the common ColdFire code directory
  m68knommu: move the 523x platform code into the common ColdFire code directory
  m68knommu: move the 520x platform code into the common ColdFire code directory
  m68knommu: move the 5206 platform code into the common ColdFire code directory
  m68knommu: simplify the ColdFire 5407 GPIO struct setup
  m68knommu: simplify the ColdFire 532x GPIO struct setup
  m68knommu: simplify the ColdFire 5307 GPIO struct setup
  m68knommu: simplify the ColdFire 528x GPIO struct setup
  m68knommu: simplify the ColdFire 527x GPIO struct setup
  ...

This reverts commit 8c01a529.

It turns out the d_unhashed() check isn't unnecessary after all: while
it's true that unhashing will increment the sequence numbers, that does
not necessarily invalidate the RCU lookup, because it might have seen
the dentry pointer (before it got unhashed), but by the time it loaded
the sequence number, it could have seen the *new* sequence number (after
it got unhashed).

End result: we might look up an unhashed dentry that is about to be
freed, with the sequence number never indicating anything bad about it.
So checking that the dentry is still hashed (*after* reading the sequence
number) is indeed the proper fix, and was never unnecessary.
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull InfiniBand/RDMA changes from Roland Dreier:
 - Add ocrdma hardware driver for Emulex IB-over-Ethernet adapters
 - Add generic and mlx4 support for "raw" QPs: allow suitably privileged
   applications to send and receive arbitrary packets directly to/from
   the hardware
 - Add "doorbell drop" handling to the cxgb4 driver
 - A fairly large batch of qib hardware driver changes
 - A few fixes for lockdep-detected issues
 - A few other miscellaneous fixes and cleanups

Fix up trivial conflict in drivers/net/ethernet/emulex/benet/be.h.

* tag 'rdma-for-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: (53 commits)
  RDMA/cxgb4: Include vmalloc.h for vmalloc and vfree
  IB/mlx4: Fix mlx4_ib_add() error flow
  IB/core: Fix IB_SA_COMP_MASK macro
  IB/iser: Fix error flow in iser ep connection establishment
  IB/mlx4: Increase the number of vectors (EQs) available for ULPs
  RDMA/cxgb4: Add query_qp support
  RDMA/cxgb4: Remove kfifo usage
  RDMA/cxgb4: Use vmalloc() for debugfs QP dump
  RDMA/cxgb4: DB Drop Recovery for RDMA and LLD queues
  RDMA/cxgb4: Disable interrupts in c4iw_ev_dispatch()
  RDMA/cxgb4: Add DB Overflow Avoidance
  RDMA/cxgb4: Add debugfs RDMA memory stats
  cxgb4: DB Drop Recovery for RDMA and LLD queues
  cxgb4: Common platform specific changes for DB Drop Recovery
  cxgb4: Detect DB FULL events and notify RDMA ULD
  RDMA/cxgb4: Drop peer_abort when no endpoint found
  RDMA/cxgb4: Always wake up waiters in c4iw_peer_abort_intr()
  mlx4_core: Change bitmap allocator to work in round-robin fashion
  RDMA/nes: Don't call event handler if pointer is NULL
  RDMA/nes: Fix for the ORD value of the connecting peer
  ...

Pull SCSI misc update from James Bottomley:
 "The patch contains the usual assortment of driver updates (be2iscsi,
  bfa, bnx2i, fcoe, hpsa, isci, lpfc, megaraid, mpt2sas, pm8001, sg)
  plus an assortment of other changes and fixes.  Also new is the fact
  that the isci update is delivered as a git merge (with signed tag)."

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (158 commits)
  isci: End the RNC resumption wait when the RNC is destroyed.
  isci: Fixed RNC bug that lost the suspension or resumption during destroy
  isci: Fix RNC AWAIT_SUSPENSION->INVALIDATING transition.
  isci: Manage the IREQ_NO_AUTO_FREE_TAG under scic_lock.
  isci: Remove obviated host callback list.
  isci: Check IDEV_GONE before performing abort path operations.
  isci: Restore the ATAPI device RNC management code.
  isci: Don't wait for an RNC suspend if it's being destroyed.
  isci: Change the phy control and link reset interface for HW reasons.
  isci: Added timeouts to RNC suspensions in the abort path.
  isci: Add protocol indicator for TMF requests.
  isci: Directly control IREQ_ABORT_PATH_ACTIVE when completing TMFs.
  isci: Wait for RNC resumption before leaving the abort path.
  isci: Fix RNC suspend call for SCI_RESUMING state.
  isci: Manage tag releases differently when aborting tasks.
  isci: Callbacks to libsas occur under scic_lock and are synchronized.
  isci: When in the abort path, defeat other resume calls until done.
  isci: Implement waiting for suspend in the abort path.
  isci: Make sure all TCs are terminated and cleaned in LUN reset.
  isci: Manage the LLHANG timer enable/disable per-device.
  ...

Pull usb-gadget scsi-target merge from Nicholas Bellinger:
 "As promised, here is the pull request for Sebastian's usb-gadget
  target UASP / BOT driver for v3.5-rc1.  This code has been in
  linux-next for a number of weeks, and is now ready for an initial
  merge.

  This fabric uses the target framework to provide a usb gadget device.
  This gadget supports the USB Attached SCSI Protocol (UASP) and Bulk
  Only Transfers (BOT or BBB).  BOT is the primary interface, UAS is the
  alternative interface.

  Note this series is dependent upon a single target core patch for
  adding se_cmd->unknown_data_length in target-pending/for-next, that
  got merged in the parent.

  Kudos to Sebastian for making this driver happen so easily, and for
  his patches to improve usb-core and target core along the way to his
  goal.  Also thanks to Felipe + Greg-KH for their help in getting this
  driver ready for mainline."

* 'usb-target-merge' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  usb-gadget: Initial merge of target module for UASP + BOT

Pull scsi-target changes from Nicholas Bellinger:
 "There has been lots of work in existing code in a number of areas this
  past cycle.  The major highlights have been:

   * Removal of transport_do_task_sg_chain() from core + fabrics
     (Roland)
   * target-core: Removal of se_task abstraction from target-core and
     enforce hw_max_sectors for pSCSI backends (hch)
   * Re-factoring of iscsi-target tx immediate/response queues (agrover)
   * Conversion of iscsi-target back to using target core memory
     allocation logic (agrover)

  We've had one last minute iscsi-target patch go into for-next to
  address a nasty regression bug related to the target core allocation
  logic conversion from agrover that is not included in friday's
  linux-next build, but has been included in this series.

  On the new fabric module code front for-3.5, here is a brief status
  update for the three currently in flight this round:

   * usb-gadget target driver:

  Sebastian Siewior's driver for supporting usb-gadget target mode
  operation.  This will be going out as a separate PULL request from
  target-pending/usb-target-merge with subsystem maintainer ACKs.  There
  is one minor target-core patch in this series required to function.

   * sbp ieee-1394/firewire target driver:

  Chris Boot's driver for supportting the Serial Block Protocol (SBP)
  across IEEE-1394 Firewire hardware.  This will be going out as a
  separate PULL request from target-pending/sbp-target-merge with two
  additional drivers/firewire/ patches w/ subsystem maintainer ACKs.

   * qla2xxx LLD target mode infrastructure changes + tcm_qla2xxx:

  The Qlogic >= 24xx series HW target mode LLD infrastructure patch-set
  and tcm_qla2xxx fabric driver.  Support for FC target mode using
  qla2xxx LLD code has been officially submitted by Qlogic to James
  below, and is currently outstanding but not yet merged into
  scsi.git/for-next..

    [PATCH 00/22] qla2xxx: Updates for scsi "misc" branch
    http://www.spinics.net/lists/linux-scsi/msg59350.html

  Note there are *zero* direct dependencies upon this for-next series
  for the qla2xxx LLD target + tcm_qla2xxx patches submitted above, and
  over the last days the target mode team has been tracking down an
  tcm_qla2xxx specific active I/O shutdown bug that appears to now be
  almost squashed for 3.5-rc-fixes."

* 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending: (47 commits)
  iscsi-target: Fix iov_count calculation bug in iscsit_allocate_iovecs
  iscsi-target: remove dead code in iscsi_check_valuelist_for_support
  target: Handle ATA_16 passthrough for pSCSI backend devices
  target: Add MI_REPORT_TARGET_PGS ext. header + implict_trans_secs attribute
  target: Fix MAINTENANCE_IN service action CDB checks to use lower 5 bits
  target: add support for the WRITE_VERIFY command
  target: make target_put_session void
  target: cleanup transport_execute_tasks()
  target: Remove max_sectors device attribute for modern se_task less code
  target: lock => unlock typo in transport_lun_wait_for_tasks
  target: Enforce hw_max_sectors for SCF_SCSI_DATA_SG_IO_CDB
  target: remove the t_se_count field in struct se_cmd
  target: remove the t_task_cdbs_ex_left field in struct se_cmd
  target: remove the t_task_cdbs_left field in struct se_cmd
  target: remove struct se_task
  target: move the state and execute lists to the command
  target: simplify command to task linkage
  target: always allocate a single task
  target: replace ->execute_task with ->execute_cmd
  target: remove the task_sectors field in struct se_task
  ...

Pull OpenRISC updates from Jonas Bonn:
 "A couple of cleanups for the OpenRISC architecture:

   - Implement IRQ domains
   - Use DMA mapping framework completely and catch up with recent
     changes to dma_map_ops
   - One bug fix to the "or1k_atomic" syscall to not clobber call-saved
     registers
   - OOM killer patches to the pagefault handler ported from the X86
     arch
   - ...and a couple of header file cleanups"

* tag 'for-3.5' of git://openrisc.net/jonas/linux:
  openrisc: use scratch regs in atomic syscall
  openrisc: provide dma_map_ops
  openrisc: header file cleanups
  openrisc/mm/fault.c: Port OOM changes to do_page_fault
  openrisc: remove unnecessary includes
  openrisc: implement irqdomains

Pull pin control subsystem changes from Linus Walleij:

 - Generic Device Tree bindings and hooks for drivers so we can move
   over modern drivers to using this.

 - Device Tree bindings for Tegra SoCs.

 - Funneling some devicetree helper code for the drivers/of subsystem.

 - New pin control drivers for:
   * Freescale MXS
   * Freescale i.MX51
   * Freescale i.MX53
     All of these use Device Tree bindings.

 - Dummy pinctrl handles for stepwise migration to pinctrl, akin to
   dummy regulators.
 - Minor non-urgent fixes and improvments.

Fix up trivial conflicts in Documentation/driver-model/devres.txt and
drivers/pinctrl/core.c,

* tag 'pinctrl-for-v3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (46 commits)
  pinctrl: pinctrl-imx: add imx51 pinctrl driver
  pinctrl: pinctrl-imx: add imx53 pinctrl driver
  pinctrl: pinctrl-pxa3xx: remove empty pinmux disable function
  pinctrl: pinctrl-mxs: remove empty pinmux disable function
  pinctrl: pinctrl-imx: remove empty pinmux disable function
  pinctrl: make pinmux disable function optional
  pinctrl: a minor error checking improvement for pinconf
  pinctrl: mxs: skip gpio nodes for group creation
  pinctrl: mxs: create group for pin config node
  pinctrl: (cosmetic) fix two entries in DocBook comments
  pinctrl: add more info to error msgs in pin_request
  pinctrl: add pinctrl-mxs support
  pinctrl: pinctrl-imx: add imx6q pinctrl driver
  pinctrl: pinctrl-imx: add imx pinctrl core driver
  dt: add of_get_child_count helper function
  pinctrl: support gpio request deferred probing
  pinctrl: add pinctrl_provide_dummies interface for platforms to use
  pinctrl: enhance reporting of errors when loading from DT
  pinctrl: add kerneldoc for pinctrl_ops device tree functions
  pinctrl: propagate map validation errors
  ...

Pull regulator updates from Mark Brown:
 "The major thing here is the addition of some helpers to factor code
  out of drivers, making a fair proportion of regulators much more just
  data rather than code which is nice.

  - Helpers in the core for regulators using regmap, providing generic
    implementations of the enable and voltage selection operations which
    just need data to describe them in the drivers.
  - Split out voltage mapping and voltage setting, allowing many more
    drivers to take advantage of the infrastructure for selectors.
  - Loads and loads of cleanups from Axel Lin once again, including many
    changes to take advantage of the above new framework features
  - New drivers for Ricoh RC5T583, TI TPS62362, TI TPS62363, TI
    TPS65913, TI TWL6035 and TI TWL6037.

  Some of the registration changes to support the core refactoring
  caused so many conflicts that eventually topic branches were abandoned
  for this release."

* tag 'regulator-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (227 commits)
  regulator: tps65910: use of_node of matched regulator being register
  regulator: tps65910: dt: support when "regulators" node found
  regulator: tps65910: add error message in case of failure
  regulator: tps62360: dt: initialize of_node param for regulator register.
  regulator: tps65910: use devm_* for memory allocation
  regulator: tps65910: use small letter for regulator names
  mfd: tpx6586x:  Depend on regulator
  regulator: regulator for Palmas Kconfig
  regulator: regulator driver for Palmas series chips
  regulator: Enable Device Tree for the db8500-prcmu regulator driver
  regulator: db8500-prcmu: Separate regulator registration from probe
  regulator: ab3100: Use regulator_map_voltage_iterate()
  regulator: tps65217: Convert to set_voltage_sel and map_voltage
  regulator: Enable the ab8500 for Device Tree
  regulator: ab8500: Split up probe() into manageable pieces
  regulator: max8925: Remove check_range function and max_uV from struct rc5t583_regulator_info
  regulator: max8649: Remove unused check_range() function
  regulator: rc5t583: Remove max_uV from struct rc5t583_regulator_info
  regulator: da9052: Convert to set_voltage_sel and map_voltage
  regulator: max8952: Use devm_kzalloc
  ...

Pull regmap updates from Mark Brown:
 "A surprisingly large series of updates for regmap this time, mostly
  due to all the work Stephen Warren has done to add support for MMIO
  buses.  This wasn't really the target for the framework but it turns
  out that there's a reasonable number of cases where it's very helpful
  to use the register cache support to allow the register map to remain
  available while the device is suspended.

  - A MMIO bus implementation, contributed by Stephen Warren.  Currently
    this is limited to 32 bit systems and native endian registers.
  - Support for naming register maps, mainly intended for MMIO devices
    with multiple register banks.  This was also contributed by Stephen
    Warren.
  - Support for register striding, again contributed by Stephen Warren
    and mainly intended for use with MMIO as typically the registers
    will be a fixed size but byte addressed.
  - irqdomain support for the generic regmap irq_chip, including support
    for dynamically allocate interrupt numbers.
  - A function dev_get_regmap() which allows frameworks using regmap to
    obtain the regmap for a device from the struct device, making life a
    little simpler for them.
  - Updates to regmap-irq to support more chips (contributed by Graeme
    Gregory) and to use irqdomains.
  - Support for devices with 24 bit register addresses.

  The striding support collided with all the topic branches so the
  branches look a bit messy and eventually I just gave up.  There's also
  the TI Palmas driver and a couple of other isolated MFD patches that
  all depend on new regmap features so are being merged here."

* tag 'regmap-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap: (24 commits)
  mfd: palmas PMIC device support Kconfig
  mfd: palmas PMIC device support
  regmap: Fix typo in IRQ register striding
  mfd: wm8994: Update to fully use irq_domain
  regmap: add support for non contiguous status to regmap-irq
  regmap: Convert regmap_irq to use irq_domain
  regmap: Pass back the allocated regmap IRQ controller data
  mfd: da9052: Fix genirq abuse
  regmap: Implement dev_get_regmap()
  regmap: Devices using format_write don't support bulk operations
  regmap: Converts group operation into single read write operations
  regmap: Cache single values read from the chip
  regmap: fix compile errors in regmap-irq.c due to stride changes
  regmap: implement register striding
  regmap: fix compilation when !CONFIG_DEBUG_FS
  regmap: allow regmap instances to be named
  regmap: validate regmap_raw_read/write val_len
  regmap: mmio: remove some error checks now in the core
  regmap: mmio: convert some error returns to BUG()
  regmap: add MMIO bus support
  ...

Pull PCI changes from Bjorn Helgaas:
 - Host bridge cleanups from Yinghai
 - Disable Bus Master bit on PCI device shutdown (kexec-related)
 - Stratus ftServer fix
 - pci_dev_reset() locking fix
 - IvyBridge graphics erratum workaround

* tag 'pci-for-3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci: (21 commits)
  microblaze/PCI: fix "io_offset undeclared" error
  x86/PCI: only check for spinlock being held in SMP kernels
  resources: add resource_overlaps()
  PCI: fix uninitialized variable 'cap_mask'
  MAINTAINERS: update PCI git tree and patchwork
  PCI: disable Bus Master on PCI device shutdown
  PCI: work around IvyBridge internal graphics FLR erratum
  x86/PCI: fix unused variable warning in amd_bus.c
  PCI: move mutex locking out of pci_dev_reset function
  PCI: work around Stratus ftServer broken PCIe hierarchy
  x86/PCI: merge pcibios_scan_root() and pci_scan_bus_on_node()
  x86/PCI: dynamically allocate pci_root_info for native host bridge drivers
  x86/PCI: embed pci_sysdata into pci_root_info on ACPI path
  x86/PCI: embed name into pci_root_info struct
  x86/PCI: add host bridge resource release for _CRS path
  x86/PCI: refactor get_current_resources()
  PCI: add host bridge release support
  PCI: add generic device into pci_host_bridge struct
  PCI: rename pci_host_bridge() to find_pci_root_bridge()
  x86/PCI: fix memleak with get_current_resources()
  ...

Miklos Szeredi points out that we need to also worry about memory
odering when doing the dentry name comparison asynchronously with RCU.

In particular, doing a rename can do a memcpy() of one dentry name over
another, and we want to make sure that any unlocked reader will always
see the proper terminating NUL character, so that it won't ever run off
the allocation.

Rather than having to be extra careful with the name copy or at lookup
time for each character, this resolves the issue by making sure that all
names that are inlined in the dentry always have a NUL character at the
end of the name allocation.  If we do that at dentry allocation time, we
know that no future name copy will ever change that final NUL to
anything else, so there are no memory ordering issues.

So even if a concurrent rename ends up overwriting the NUL character
that terminates the original name, we always know that there is one
final NUL at the end, and there is no worry about the lockless RCU
lookup traversing the name too far.

The out-of-line allocations are never copied over, so we can just make
sure that we write the name (with terminating NULL) and do a write
barrier before we expose the name to anything else by setting it in the
dentry.
Reported-by: Miklos Szeredi <mszeredi@suse.cz>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Nick Piggin <npiggin@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

We had for some reason overlooked the AIO interface, and it didn't use
the proper rw_verify_area() helper function that checks (for example)
mandatory locking on the file, and that the size of the access doesn't
cause us to overflow the provided offset limits etc.

Instead, AIO did just the security_file_permission() thing (that
rw_verify_area() also does) directly.

This fixes it to do all the proper helper functions, which not only
means that now mandatory file locking works with AIO too, we can
actually remove lines of code.
Reported-by: Manish Honap <manish_honap_vit@yahoo.co.in>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull core ARM updates from Russell King:
 "This is the bulk of the core ARM updates for this merge window.
  Included in here is a different way to handle the VIVT cache flushing
  on context switch, which should allow scheduler folk to remove a
  special case in their core code.

  We have architectured timer support here, which is a set of timers
  specified by the ARM architecture for future SoCs.  So we should see
  less variability in timer design going forward.

  The last big thing here is my cleanup to the way we handle PCI across
  ARM, fixing some oddities in some platforms which hadn't realised
  there was a way to deal with their private data already built in to
  our PCI backend.

  I've also removed support for the ARMv3 architecture; it hasn't worked
  properly for years so it seems pointless to keep it around."

* 'for-linus' of git://git.linaro.org/people/rmk/linux-arm: (47 commits)
  ARM: PCI: remove per-pci_hw list of buses
  ARM: PCI: dove/kirkwood/mv78xx0: use sys->private_data
  ARM: PCI: provide a default bus scan implementation
  ARM: PCI: get rid of pci_std_swizzle()
  ARM: PCI: versatile: fix PCI interrupt setup
  ARM: PCI: integrator: use common PCI swizzle
  ARM: 7416/1: LPAE: Remove unused L_PTE_(BUFFERABLE|CACHEABLE) macros
  ARM: 7415/1: vfp: convert printk's to pr_*'s
  ARM: decompressor: avoid speculative prefetch from non-RAM areas
  ARM: Remove ARMv3 support from decompressor
  ARM: 7413/1: move read_{boot,persistent}_clock to the architecture level
  ARM: Remove support for ARMv3 ARM610 and ARM710 CPUs
  ARM: 7363/1: DEBUG_LL: limit early mapping to the minimum
  ARM: 7391/1: versatile: add some auxdata for device trees
  ARM: 7389/2: plat-versatile: modernize FPGA IRQ controller
  AMBA: get rid of last two uses of NO_IRQ
  ARM: 7408/1: cacheflush: return error to userspace when flushing syscall fails
  ARM: 7409/1: Do not call flush_cache_user_range with mmap_sem held
  ARM: 7404/1: cmpxchg64: use atomic64 and local64 routines for cmpxchg64
  ARM: 7347/1: SCU: use cpu_logical_map for per-CPU low power mode
  ...

Pull clkdev updates from Russell King:
 "This supplements clkdev with a device-managed API, allowing drivers
  cleanup paths to be simplified.  We also optimize clk_find() so that
  it exits as soon as it finds a perfect match, and we provide a way to
  minimise the amount of code platforms need to register clkdev entries.

  Some of the code in arm-soc depends on these changes."

* 'clkdev' of git://git.linaro.org/people/rmk/linux-arm:
  CLKDEV: provide helpers for common clock framework
  ARM: 7392/1: CLKDEV: Optimize clk_find()
  ARM: 7376/1: clkdev: Implement managed clk_get()

During early boot, when the scheduler hasn't really been fully set up,
we really can't do blocking allocations because with certain (dubious)
configurations the "might_resched()" calls can actually result in
scheduling events.

We could just make such users always use GFP_ATOMIC, but quite often the
code that does the allocation isn't really aware of the fact that the
scheduler isn't up yet, and forcing that kind of random knowledge on the
initialization code is just annoying and not good for anybody.

And we actually have a the 'gfp_allowed_mask' exactly for this reason:
it's just that the kernel init sequence happens to set it to allow
blocking allocations much too early.

So move the 'gfp_allowed_mask' initialization from 'start_kernel()'
(which is some of the earliest init code, and runs with preemption
disabled for good reasons) into 'kernel_init()'.  kernel_init() is run
in the newly created thread that will become the 'init' process, as
opposed to the early startup code that runs within the context of what
will be the first idle thread.

So by the time we reach 'kernel_init()', we know that the scheduler must
be at least limping along, because we've already scheduled from the idle
thread into the init thread.
Reported-by: Steven Rostedt <rostedt@goodmis.org>
Cc: David Rientjes <rientjes@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

There is no point having the NET dependency on the select target, as it
forces all users to depend on NET to tell they support BPF_JIT.  Move
the config option to the bottom of the file - this could be a nice place
also for future "selectable" config symbols.

Fix up all users to drop the dependency on NET now that it is not
required to supress warnings for non-NET builds.
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Acked-by: David Miller <davem@davemloft.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull blackfin changes from Bob Liu:
 "The biggest change was added an new processor(bf60x series).

  Bf60x series processor of blackfin can up to 1GHz with Hardware
  Support for HD Video Analytics, it use the same blackfin ISA but with
  some changes on system buses, interrupt controller and peripheral
  devices.

  Added dir arch/blackfin/mach-bf609/ and did some changes to the
  framework made linux working fine on the reference board bf609-ezkit
  now."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lliubbo/blackfin: (41 commits)
  blackfin: fix build after add bf60x mach/pm.h
  blackfin: twi: include linux/i2c.h
  blackfin: bf60x: add head file for crc controller
  blackfin: bf60x: twi: work around temporary anomaly 0501001
  blackfin: twi: Move TWI MMR access macro to twi head file
  blackfin: twi: Move TWI peripheral pin request array to platform data
  blackfin: bf60x: anomaly: Add a temporary anomaly 0501001
  blackfin: bf60x: Rename the DDR controller macro
  blackfin: mach-bf609: pm: cleanup bfin_deepsleep
  blackfin: bf60x: cleanup get clock code
  blackfin: bf60x: pm: Add a debug option to calculate kernel wakeup time.
  blackfin: bf60x: add wakeup source select
  blackfin: bf60x: make clock changeable in kernel menuconfig
  blackfin:mach-bf609: fix norflash for bf609-ezkit
  blackfin: mach-bf609: add can_wakeup to ethernet device
  blackfin: remove redundant CONFIG_BF60x macro
  blackfin: rotary: Add pm_wakeup flag to platform data structure.
  bfin_gpio: fix bf548-ezkit kernel fail to boot
  bfin_dma: fix initcall return error in proc_dma_init()
  Blackfin: delete fork func
  ...

Pull c6x updates from Mark Salter:
 "Clean up some c6x Kconfig items and add support for Elf FDPIC loader."

* tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
  C6X: remove unused config items
  C6X: add support to build with BINFMT_ELF_FDPIC
  C6X: change main arch kbuild symbol

Pull m68k updates from Geert Uytterhoeven.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k:
  m68k: Setup CROSS_COMPILE at the top
  m68k: Correct the Atari ALLOWINT definition
  m68k/video: Create <asm/vga.h>
  m68k: Make sure {read,write}s[bwl]() are always defined
  m68k/mm: Port OOM changes to do_page_fault()
  scsi/atari: Make more functions static
  scsi/atari: Revive "atascsi=" setup option
  net/ariadne: Improve debug prints
  m68k/atari: Change VME irq numbers from unsigned long to unsigned int
  m68k/amiga: Use arch_initcall() for registering platform devices
  m68k/amiga: Add error checks when registering platform devices
  m68k/amiga: Mark z_dev_present() __init
  m68k: Remove unused MAX_NOINT_IPL definition

Pull s390 updates from Martin Schwidefsky:
 "Just a random collection of bug-fixes and cleanups, nothing new in
  this merge request."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (46 commits)
  s390/ap: Fix wrong or missing comments
  s390/ap: move receive callback to message struct
  s390/dasd: re-prioritize partition detection message
  s390/qeth: reshuffle initialization
  s390/qeth: cleanup drv attr usage
  s390/claw: cleanup drv attr usage
  s390/lcs: cleanup drv attr usage
  s390/ctc: cleanup drv attr usage
  s390/ccwgroup: remove ccwgroup_create_from_string
  s390/qeth: stop using struct ccwgroup driver for discipline callbacks
  s390/qeth: switch to ccwgroup_create_dev
  s390/claw: switch to ccwgroup_create_dev
  s390/lcs: switch to ccwgroup_create_dev
  s390/ctcm: switch to ccwgroup_create_dev
  s390/ccwgroup: exploit ccwdev_by_dev_id
  s390/ccwgroup: introduce ccwgroup_create_dev
  s390: fix race on TIF_MCCK_PENDING
  s390/barrier: make use of fast-bcr facility
  s390/barrier: cleanup barrier functions
  s390/claw: remove "eieio" calls
  ...

Pull sparc updates from David Miller:

1) Kill off support for sun4c and Cypress sun4m chips.

   And as a result we were able to also kill off that ugly btfixup thing
   that required multi-stage links of the final vmlinux image in the
   Kbuild system.  This should make the kbuild maintainers really happy.

   Thanks a lot to Sam Ravnborg for his tireless efforts to get this
   going.

2) Convert sparc64 to nobootmem.  I suspect now with sparc32 being a lot
   cleaner, it should be able to fall in line and modernize in this area
   too.

3) Make sparc32 use generic clockevents, from Tkhai Kirill.

[ I fixed up the BPF rules, and tried to clean up the build rules too.
  But I don't have - or want - a sparc cross-build environment, so the
  BPF rule bug and the related build cleanup was all done with just a
  bare "make -n" pseudo-test.      - Linus ]

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next: (110 commits)
  sparc32: use flushi when run-time patching in per_cpu_patch
  sparc32: fix cpuid_patch run-time patching
  sparc32: drop unused inline functions in srmmu.c
  sparc32: drop unused functions in pgtsrmmu.h
  sparc32,leon: move leon mmu functions to leon_mm.c
  sparc32,leon: remove duplicate definitions in leon.h
  sparc32,leon: remove duplicate UART register definitions
  sparc32,leon: move leon ASI definitions to asi.h
  sparc32: move trap table to a separate file
  sparc64: renamed ttable.S to ttable_64.S
  sparc32: Remove asm/sysen.h header.
  sparc32: Delete asm/smpprim.h
  sparc32: Remove unused empty_bad_page{,_table} declarations.
  sparc32: Kill boot_cpu_id4
  sparc32: Move GET_PROCESSOR*_ID() out of asm/asmmacro.h
  sparc32: Remove completely unused code from asm/cache.h
  sparc32: Add ucmpdi2.o to obj-y instead of lib-y.
  sparc32: add ucmpdi2
  sparc: introduce arch/sparc/Kbuild
  sparc: remove obsolete documentation
  ...

Pull networking changes from David Miller:

 1) Get rid of the error prone NLA_PUT*() macros that used an embedded
    goto.

 2) Kill off the token-ring and MCA networking drivers, from Paul
    Gortmaker.

 3) Reduce high-order allocations made by datagram AF_UNIX sockets, from
    Eric Dumazet.

 4) Add PTP hardware clock support to IGB and IXGBE, from Richard
    Cochran and Jacob Keller.

 5) Allow users to query timestamping capabilities of a card via
    ethtool, from Richard Cochran.

 6) Add loadbalance mode to the teaming driver, from Jiri Pirko.  Part
    of this is that we can now have BPF filters not attached to sockets,
    and the loadbalancing function is calculated using one.

 7) Francois Romieu went through the network drivers removing gratuitous
    uses of netdev->base_addr, perhaps some day we can remove it
    completely but it's used for ISA probing still.

 8) Add a BPF JIT for sparc.  I know, who cares, right? :-)

 9) Move networking sysctl registry away from using the compatability
    mode interfaces in the sysctl code.  From Eric W Biederman.

10) Pavel Emelyanov added a way to save and restore TCP socket state via
    TCP_REPAIR, TCP_REPAIR_QUEUE, and TCP_QUEUE_SEQ socket options as
    well as a way to forcefully bind a socket to a port via the
    sk->sk_reuse value SK_FORCE_REUSE.  There is also a
    TCP_REPAIR_OPTIONS which allows to reinstante the TCP options
    enabled on the connection.

11) Several enhancements from Eric Dumazet that, in particular, can
    enhance splice performance on TCP sockets significantly.

     a) Reset the offset of the per-socket sendmsg page when we know
        we're the only use of the page in linear_to_page().

     b) Add facilities such that skb->data can be backed a page rather
        than SLAB kmalloc'd memory.  In particular devices which were
        receiving into linear RX buffers can now end up providing paged
        data.

    The big result is that code like splice and GRO do not have to copy
    any more.

12) Allow a pure sender to more gracefully handle ACK backlogs in TCP.
    What can happen at high rates is that the sender hasn't grown his
    receive buffer limits at all (he's not receiving data so really
    doesn't need to), but the non-data ACKs consume receive buffer
    space.

    sk_add_backlog() is too aggressive in dropping frames in this case,
    so relax it's requirements by using the receive buffer plus the send
    buffer limit as the backlog limit instead of just the former.

    Also from Eric Dumazet.

13) Add ipv6 support to L2TP, from Benjamin LaHaise, James Chapman, and
    Chris Elston.

14) Implement TCP early retransmit (RFC 5827), from Yuchung Cheng.
    Basically, we can start fast retransmit before hiting the dupack
    threshold under certain conditions.

15) New CODEL active queue management packet scheduler, from Eric
    Dumazet based upon initial work by Dave Taht.

    Basically, the big feature is that packets are dropped (or ECN bits
    are set) based upon how long packets live in the queue, rather than
    the queue length (which is what RED uses).

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1341 commits)
  drivers/net/stmmac: seq_file fix memory leak
  ipv6/exthdrs: strict Pad1 and PadN check
  USB: qmi_wwan: Add ZTE (Vodafone) K3520-Z
  USB: qmi_wwan: Add ZTE (Vodafone) K3765-Z
  USB: qmi_wwan: Make forced int 4 whitelist generic
  net/ipv4: replace simple_strtoul with kstrtoul
  net/ipv4/ipconfig: neaten __setup placement
  net: qmi_wwan: Add Vodafone/Huawei K5005 support
  net: cdc_ether: Add ZTE WWAN matches before generic Ethernet
  ipv6: use skb coalescing in reassembly
  ipv4: use skb coalescing in defragmentation
  net: introduce skb_try_coalesce()
  net:ipv6:fixed space issues relating to operators.
  net:ipv6:fixed a trailing white space issue.
  ipv6: disable GSO on sockets hitting dst_allfrag
  tg3: use netdev_alloc_frag() API
  net: napi_frags_skb() is static
  ppp: avoid false drop_monitor false positives
  ipv6: bool/const conversions phase2
  ipx: Remove spurious NULL checking in ipx_ioctl().
  ...

Merge branches 'core', 'cxgb4', 'ipath', 'iser', 'lockdep', 'mlx4', 'nes', 'ocrdma', 'qib' and 'raw-qp' into for-linus

Signed-off-by: Vipul Pandya <vipul@chelsio.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>

This branch simplifies and clarifies the dcache lookup, and allows us to
do certain nice optimizations when comparing dentries.  It also cleans
up the interface to __d_lookup_rcu(), especially around passing the
inode information around.

* dentry-cleanups:
  vfs: make it possible to access the dentry hash/len as one 64-bit entry
  vfs: move dentry name length comparison from dentry_cmp() into callers
  vfs: do the careful dentry name access for all dentry_cmp cases
  vfs: remove unnecessary d_unhashed() check from __d_lookup_rcu
  vfs: clean up __d_lookup_rcu() and dentry_cmp() interfaces

This teaches vfs_fstat() to use the appropriate f[get|put]_light
functions, allowing it to avoid some unnecessary locking for the common
case.

More noticeably, it also cleans up and simplifies the "getname_flags()"
function, which now relies on the architecture strncpy_from_user() doing
all the user access checks properly, instead of hacking around the fact
that on x86 it didn't use to do it right (see commit 92ae03f2: "x86:
merge 32/64-bit versions of 'strncpy_from_user()' and speed it up").

* vfs-cleanups:
  VFS: make vfs_fstat() use f[get|put]_light()
  VFS: clean up and simplify getname_flags()
  x86: make word-at-a-time strncpy_from_user clear bytes at the end

This makes cp_new_stat() a bit more readable, and avoids having to
memset() the whole structure just to fill in a couple of padding fields.

This is another result of me looking at code generation of functions
that show up high on certain kernel profiles, and just going "Oh, let's
just clean that up".

Architectures that don't supply the #define to fill just the padding
fields will still fall back to memset().

* stat-cleanups:
  vfs: don't force a big memset of stat data just to clear padding fields
  vfs: de-crapify "cp_new_stat()" function

This series sanitizes the interface to unmap_vma().  The crazy interface
annoyed me no end when I was looking at unmap_single_vma(), which we can
spend quite a lot of time in (especially with loads that have a lot of
small fork/exec's: shell scripts etc).

Moving the nr_accounted calculations to where they belong at least
clarifies things a little.  I hope to come back to look at the
performance of this later, but if/when I get back to it I at least don't
have to see the crazy interfaces any more.

* vm-cleanups:
  vm: remove 'nr_accounted' calculations from the unmap_vmas() interfaces
  vm: simplify unmap_vmas() calling convention

Conflicts:
	arch/arm/boot/compressed/head.S

Conflicts:
	arch/arm/kernel/ptrace.c

Merge branches 'amba', 'devel-stable', 'fixes', 'mach-types', 'mmci', 'pci' and 'versatile' into for-linus

isci update for 3.5

1/ Rework remote-node-context (RNC) handling for proper management of
   the silicon state machine in error handling and hot-plug conditions.
   Further details below, suffice to say if the RNC is mismanaged the
   silicon state machines may lock up.

2/ Refactor the initialization code to be reused for suspend/resume support

3/ Miscellaneous bug fixes to address discovery issues and hardware
   compatibility.

RNC rework details from Jeff Skirvin:

In the controller, devices as they appear on a SAS domain (or
direct-attached SATA devices) are represented by memory structures known
as "Remote Node Contexts" (RNCs).  These structures are transferred from
main memory to the controller using a set of register commands; these
commands include setting up the context ("posting"), removing the
context ("invalidating"), and commands to control the scheduling of
commands and connections to that remote device ("suspensions" and
"resumptions").  There is a similar path to control RNC scheduling from
the protocol engine, which interprets the results of command and data
transmission and reception.

In general, the controller chooses among non-suspended RNCs to find one
that has work requiring scheduling the transmission of command and data
frames to a target.  Likewise, when a target tries to return data back
to the initiator, the state of the RNC is used by the controller to
determine how to treat the incoming request. As an example, if the RNC
is in the state "TX/RX Suspended", incoming SSP connection requests from
the target will be rejected by the controller hardware.  When an RNC is
"TX Suspended", it will not be selected by the controller hardware to
start outgoing command or data operations (with certain priority-based
exceptions).

As mentioned above, there are two sources for management of the RNC
states: commands from driver software, and the result of transmission
and reception conditions of commands and data signaled by the controller
hardware.  As an example of the latter, if an outgoing SSP command ends
with a OPEN_REJECT(BAD_DESTINATION) status, the RNC state will
transition to the "TX Suspended" state, and this is signaled by the
controller hardware in the status to the completion of the pending
command as well as signaled in a controller hardware event.  Examples of
the former are included in the patch changelogs.

Driver software is required to suspend the RNC in a "TX/RX Suspended"
condition before any outstanding commands can be terminated.  Failure to
guarantee this can lead to a complete hardware hang condition.  Earlier
versions of the driver software did not guarantee that an RNC was
correctly managed before I/O termination, and so operated in an unsafe
way.

Further, the driver performed unnecessary contortions to preserve the
remote device command state and so was more complicated than it needed
to be.  A simplifying driver assumption is that once an I/O has entered
the error handler path without having completed in the target, the
requirement on the driver is that all use of the sas_task must end.
Beyond that, recovery of operation is dependent on libsas and other
components to reset, rediscover and reconfigure the device before normal
operation can restart.  In the driver, this simplifying assumption meant
that the RNC management could be reduced to entry into the suspended
state, terminating the targeted I/O request, and resuming the RNC as
needed for device-specific management such as an SSP Abort Task or LUN
Reset Management request.

Use single_release() instead of seq_release() to free memory allocated
by single_open().
Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Steven Miao <realmz6@gmail.com>
Signed-off-by: Bob Liu <lliubbo@gmail.com>

Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Bob Liu <lliubbo@gmail.com>