Pull mce cleanup from Tony Luck:
 "One more mce cleanup before the 3.5 merge window closes"

* tag 'please-pull-mce' of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras:
  x86/mce: Cleanup timer mess

Pull s390 patches from Heiko Carstens:
 "A couple of s390 patches for the 3.5 merge window.  Just a collection
  of bug fixes and cleanups."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/uaccess: fix access_ok compile warnings
  s390/cmpxchg: select HAVE_CMPXCHG_LOCAL option
  s390/cmpxchg: fix sign extension bugs
  s390/cmpxchg: fix 1 and 2 byte memory accesses
  s390/cmpxchg: fix compile warnings specific to s390
  s390/cmpxchg: add missing memory barrier to cmpxchg64
  s390/cpu: remove cpu "capabilities" sysfs attribute
  s390/kernel: Fix smp_call_ipl_cpu() for offline CPUs
  s390/kernel: Introduce memcpy_absolute() function
  s390/headers: replace __s390x__ with CONFIG_64BIT where possible
  s390/headers: remove #ifdef __KERNEL__ from not exported headers
  s390/irq: split irq stats for cpu-measurement alert facilities
  s390/kexec: Move early_pgm_check_handler() to text section
  s390/kdump: Use real mode for PSW restart and kexec
  s390/kdump: Account /sys/kernel/kexec_crash_size changes in OS info
  s390/kernel: Remove OS info init function call and diag 308 for kdump

Pull misc parisc updates from James Bottomley:
 "This is a couple of updates to complete our fixes and one to fix a
  compile failure caused during the merge window.  Additionally, we now
  switch to the generic strncopy_from_user."

* tag 'parisc-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/parisc-2.6:
  [PARISC] update parisc to use generic strncpy_from_user()
  [PARISC] Fix parisc compile failure after smp: Add task_struct argument to __cpu_up()
  [PARISC] fix TLB fault path on PA2.0 narrow systems
  [PARISC] fix boot failure on 32-bit systems caused by branch stubs placed before .text

Pull additional x86 fixes from Peter Anvin.

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86, amd, xen: Avoid NULL pointer paravirt references
  x86, mtrr: Fix a type overflow in range_to_mtrr func
  x86, realmode: Unbreak the ia64 build of drivers/acpi/sleep.c
  x86/mm/pat: Improve scaling of pat_pagerange_is_ram()
  x86: hpet: Fix copy-and-paste mistake in earlier change
  x86/mce: Fix 32-bit build
  x86/bitops: Move BIT_64() for a wider use

Pull late-merged development and first fixes for arm-soc from Olof Johansson:
 "This branch contains a few development patches for Samsung and
  Versatile Express that were submitted to arm-soc near the beginning of
  the merge window.  We picked them up with the agreement that they
  would need to sit in linux-next for a while, and now they have.

  There are also two fixes:
   - One long-standing build breakage on ixp4xx due to missing gpiolib
     dependencies.
   - The other is for some gpio device tree changes needed on lpc32xx."

* tag 'devel-late' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: LPC32xx: Adjust dts files to gpio dt binding
  ixp4xx: fix compilation by adding gpiolib support
  ARM: vexpress: Remove twice included header files
  ARM: vexpress: Device Tree updates
  ARM: EXYNOS: Support suspend and resume for EXYNOS5250
  ARM: EXYNOS: Add Clock register list for save and restore
  ARM: EXYNOS: Add PMU table for EXYNOS5250
  ARM: EXYNOS: Rename of function for pm.c
  ARM: EXYNOS: Remove GIC save & restore function
  ARM: dts: Add node for interrupt combiner controller on EXYNOS5250
  ARM: S3C24XX: add support for second irq set of S3C2416
  ARM: S3C64XX: use timekeeping wrapper on cpuidle
  ARM: S3C64XX: declare the states with the new api on cpuidle
  ARM: S3C64XX: Hook up carrier class modules on Cragganmore
  ARM: S3C64XX: Initial hookup for Bells module on Cragganmore

Pull Sparc updates from David S. Miller:

 1) Remove the idiotic situation wherein Leon was a special case in all
    of the TLB/cache handling code.

    The worst side effect of this bogosity is that you couldn't build a
    kernel with Leon support enabled (to get better build coverage), and
    test boot it on a non-LEON cpu.

    Leon is, in all core respects, programatically identical to the
    32-bit SRMMU.  Except that they put the TLB registers in a different
    alternate address space location.

    Through code patching (for fast paths) and run time checks, this
    issue is now a thing of the past.

    From Sam Ravnborg.

 2) There was a mis-merge of arch/sparc/Kconfig for one of the
    clockevents changes that went in, causing 32-bit sparc to start
    failing to build.

    I merged in your tree to get those clockevents changes (and added a
    note to the merge commit) then added Stephen Rothwell's fix for the
    merge error.

 3) Software quad floating point emulation was not working properly on
    more recent Niagara chips, because the way the situation is reported
    by the cpu has changed.

    Nobody noticed because gcc emits calls to software emulation
    routines in glibc.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc: (25 commits)
  sparc: fix sparc64 build due to leon.h inclusion
  sparc32: remove unused variable in head_32.S
  sparc32,leon: fix leon bootup
  sparc32: Export leon_dma_ops to modules.
  sparc32: support leon + sun in dma_make_coherent()
  sparc32,leon: always support leon in ioport
  sparc32,leon: always include leon_pmc in build
  sparc32: refactor cpu_idle()
  sparc32: srmmu_probe now knows about leon too
  sparc32: drop LEON hack for ASI_M_MMUREGS
  sparc32: introduce run-time patching of srmmu access functions
  sparc32: introduce support for run-time patching for all shared assembler code
  sparc32,leon: fix section mismatch warning
  sparc32,leon: always include leon_smp + leon_mm in build
  sparc32,leon: always include leon_kernel in build
  sparc32,leon: clean up leon.h
  sparc32: handle leon in cpu.c
  sparc32: handle leon in irq_32.c
  sparc32: add support for run-time patching of leon/sun single instructions
  sparc32: introduce sparc32_start_kernel called from head_32.S
  ...

Pull networking changes from David S. Miller:

 1) Fix IPSEC header length calculation for transport mode in ESP.  The
    issue is whether to do the calculation before or after alignment.
    Fix from Benjamin Poirier.

 2) Fix regression in IPV6 IPSEC fragment length calculations, from Gao
    Feng.  This is another transport vs tunnel mode issue.

 3) Handle AF_UNSPEC connect()s properly in L2TP to avoid OOPSes.  Fix
    from James Chapman.

 4) Fix USB ASIX driver's reception of full sized VLAN packets, from
    Eric Dumazet.

 5) Allow drop monitor (and, more generically, all generic netlink
    protocols) to be automatically loaded as a module.  From Neil
    Horman.

Fix up trivial conflict in Documentation/feature-removal-schedule.txt
due to new entries added next to each other at the end. As usual.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (38 commits)
  net/smsc911x: Repair broken failure paths
  virtio-net: remove useless disable on freeze
  netdevice: Update netif_dbg for CONFIG_DYNAMIC_DEBUG
  drop_monitor: Add module alias to enable automatic module loading
  genetlink: Build a generic netlink family module alias
  net: add MODULE_ALIAS_NET_PF_PROTO_NAME
  r6040: Do a Proper deinit at errorpath and also when driver unloads (calling r6040_remove_one)
  r6040: disable pci device if the subsequent calls (after pci_enable_device) fails
  skb: avoid unnecessary reallocations in __skb_cow
  net: sh_eth: fix the rxdesc pointer when rx descriptor empty happens
  asix: allow full size 8021Q frames to be received
  rds_rdma: don't assume infiniband device is PCI
  l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case
  mac80211: fix ADDBA declined after suspend with wowlan
  wlcore: fix undefined symbols when CONFIG_PM is not defined
  mac80211: fix flag check for QoS NOACK frames
  ath9k_hw: apply internal regulator settings on AR933x
  ath9k_hw: update AR933x initvals to fix issues with high power devices
  ath9k: fix a use-after-free-bug when ath_tx_setup_buffer() fails
  ath9k: stop rx dma before stopping tx
  ...

Signed-off-by: James Bottomley <JBottomley@Parallels.com>

* fixes:
  ixp4xx: fix compilation by adding gpiolib support

* fixes2:
  ARM: LPC32xx: Adjust dts files to gpio dt binding

The GPIO devicetree binding in 3.5 doesn't register the various LPC32xx GPIO
banks via DT subnodes but always all at once, and changes the gpio referencing
to 3 cells (bank, gpio, flags). This patch adjusts the DTS files to this
binding that was just accepted to the gpio subsystem.
Signed-off-by: Roland Stigge <stigge@antcom.de>
Signed-off-by: Olof Johansson <olof@lixom.net>

Stub out MSR methods that aren't actually needed.  This fixes a crash
as Xen Dom0 on AMD Trinity systems.  A bigger patch should be added to
remove the paravirt machinery completely for the methods which
apparently have no users!
Reported-by: Andre Przywara <andre.przywara@amd.com>
Link: http://lkml.kernel.org/r/20120530222356.GA28417@andromeda.dapyr.netSigned-off-by: H. Peter Anvin <hpa@zytor.com>
Cc: <stable@vger.kernel.org>

* late/board:
  ARM: S3C64XX: Hook up carrier class modules on Cragganmore
  ARM: S3C64XX: Initial hookup for Bells module on Cragganmore

* late/soc:
  ARM: vexpress: Remove twice included header files
  ARM: vexpress: Device Tree updates
  ARM: EXYNOS: Support suspend and resume for EXYNOS5250
  ARM: EXYNOS: Add Clock register list for save and restore
  ARM: EXYNOS: Add PMU table for EXYNOS5250
  ARM: EXYNOS: Rename of function for pm.c
  ARM: EXYNOS: Remove GIC save & restore function
  ARM: dts: Add node for interrupt combiner controller on EXYNOS5250
  ARM: S3C24XX: add support for second irq set of S3C2416

* late/cleanup:
  ARM: S3C64XX: use timekeeping wrapper on cpuidle
  ARM: S3C64XX: declare the states with the new api on cpuidle

Current failure paths attempt to free resources which we failed to request
and disable resources which we failed to enable ones. This leads to kernel
oops/panic. This patch does some simple re-ordering to prevent this from
happening.

Cc: netdev@vger.kernel.org
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Use unsigned long for dealing with jiffies not int. Rename the
callback to something sensible. Use __this_cpu_read/write for
accessing per cpu data.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Borislav Petkov <borislav.petkov@amd.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>

When boot on sun G5+ with 4T mem, see an overflow in mtrr cleanup as below.

*BAD*gran_size: 2G      chunk_size: 2G  num_reg: 10     lose cover RAM:
-18014398505283592M

This is because 1<<31 sign extended. Use an unsigned long constant to
fix it.  Useful for mem larger than or equal to 4T.

-v2: Use 64bit constant instead of explicit type conversion as suggested
by Yinghai. Description updated too.
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>
Link: http://lkml.kernel.org/r/4FC5A77F.6060505@oracle.comSigned-off-by: H. Peter Anvin <hpa@zytor.com>

disable_cb is just an optimization: it
can not guarantee that there are no callbacks.
In particular it doesn't have any effect when
event index is on.

Instead, detach, napi disable and reset on freeze ensure we don't run
concurrently with a callback.

Remove the useless calls so we get same behaviour
with and without event index.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Make netif_dbg use dynamic debugging whenever
CONFIG_DYNAMIC_DEBUG is enabled.

commit b558c96f
("dynamic_debug: make dynamic-debug supersede DEBUG ccflag")
missed updating the netif_dbg variant.
Signed-off-by: Joe Perches <joe@perches.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

x86/trampoline contains an urgent commit which is necessarily on a
newer baseline.
Signed-off-by: H. Peter Anvin <hpa@zytor.com>

Pull ceph updates from Sage Weil:
 "There are some updates and cleanups to the CRUSH placement code, a bug
  fix with incremental maps, several cleanups and fixes from Josh Durgin
  in the RBD block device code, a series of cleanups and bug fixes from
  Alex Elder in the messenger code, and some miscellaneous bounds
  checking and gfp cleanups/fixes."

Fix up trivial conflicts in net/ceph/{messenger.c,osdmap.c} due to the
networking people preferring "unsigned int" over just "unsigned".

* git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client: (45 commits)
  libceph: fix pg_temp updates
  libceph: avoid unregistering osd request when not registered
  ceph: add auth buf in prepare_write_connect()
  ceph: rename prepare_connect_authorizer()
  ceph: return pointer from prepare_connect_authorizer()
  ceph: use info returned by get_authorizer
  ceph: have get_authorizer methods return pointers
  ceph: ensure auth ops are defined before use
  ceph: messenger: reduce args to create_authorizer
  ceph: define ceph_auth_handshake type
  ceph: messenger: check return from get_authorizer
  ceph: messenger: rework prepare_connect_authorizer()
  ceph: messenger: check prepare_write_connect() result
  ceph: don't set WRITE_PENDING too early
  ceph: drop msgr argument from prepare_write_connect()
  ceph: messenger: send banner in process_connect()
  ceph: messenger: reset connection kvec caller
  libceph: don't reset kvec in prepare_write_banner()
  ceph: ignore preferred_osd field
  ceph: fully initialize new layout
  ...

Pull perf updates from Ingo Molnar.

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (21 commits)
  perf ui browser: Stop using 'self'
  perf annotate browser: Read perf config file for settings
  perf config: Allow '_' in config file variable names
  perf annotate browser: Make feature toggles global
  perf annotate browser: The idx_asm field should be used in asm only view
  perf tools: Convert critical messages to ui__error()
  perf ui: Make --stdio default when TUI is not supported
  tools lib traceevent: Silence compiler warning on 32bit build
  perf record: Fix branch_stack type in perf_record_opts
  perf tools: Reconstruct event with modifiers from perf_event_attr
  perf top: Fix counter name fixup when fallbacking to cpu-clock
  perf tools: fix thread_map__new_by_pid_str() memory leak in error path
  perf tools: Do not use _FORTIFY_SOURCE when DEBUG=1 is specified
  tools lib traceevent: Fix signature of create_arg_item()
  tools lib traceevent: Use proper function parameter type
  tools lib traceevent: Fix freeing arg on process_dynamic_array()
  tools lib traceevent: Fix a possibly wrong memory dereference
  tools lib traceevent: Fix a possible memory leak
  tools lib traceevent: Allow expressions in __print_symbolic() fields
  perf evlist: Explicititely initialize input_name
  ...

Revert usage of acpi_wakeup_address and move definition
to x86 architecture code in order to make compilation work
in ia64.

[jsakkine: tested compilation in ia64/x86-64 and added
proper commit message]
Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Originally-by: H. Peter Anvin <hpa@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@intel.com>
Link: http://lkml.kernel.org/r/1338370421-27735-1-git-send-email-jarkko.sakkinen@intel.com
Cc: Tony Luck <tony.luck@intel.com>
Cc: Len Brown <lenb@kernel.org>
Signed-off-by: H. Peter Anvin <hpa@zytor.com>

Pull i2c updates from Jean Delvare.

* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  i2c: Split I2C_M_NOSTART support out of I2C_FUNC_PROTOCOL_MANGLING
  i2c-dev: Add support for I2C_M_RECV_LEN

Pull second set of watchdog updates from Wim Van Sebroeck:
 "This changeset contains following changes:
   * Add support for multiple watchdog devices.  We use dynamically
     allocated device id's for this.
   * Add locking into the generic watchdog infrastructure.
   * Add support for dynamically allocated watchdog_device structs so
     that we can deal with devices that get unbound.
   * convert following drivers to the generic watchdog framework:
     sch5627, sch5636 and sp805_wdt.
   * Add DA9052/53 PMIC watchdog support
   * Fix printk format warnings for iTCO_wdt.c"

* git://www.linux-watchdog.org/linux-watchdog:
  watchdog: iTCO_wdt.c: fix printk format warnings
  watchdog: sp805_wdt: Add clk_{un}prepare support
  watchdog: sp805_wdt: convert to watchdog core
  hwmon/sch56xx: Depend on watchdog for watchdog core functions
  watchdog: sch56xx-common: set correct bits in register()
  Watchdog: DA9052/53 PMIC watchdog support
  watchdog: sch56xx-common: Add proper ref-counting of watchdog data
  watchdog: sch56xx: Remove unnecessary checks for register changes
  watchdog: sch56xx: Use watchdog core
  watchdog: Add support for dynamically allocated watchdog_device structs
  watchdog: Add Locking support
  watchdog: watchdog_dev: Rewrite wrapper code
  watchdog: use dev_ functions
  watchdog: create all the proper device files
  watchdog: Add a flag to indicate the watchdog doesn't reboot things
  watchdog: Add multiple device support
  watchdog: watchdog_core.h: make functions extern
  watchdog: correct the name of the watchdog_core inlude file
  watchdog: Add watchdog_active() routine
  watchdog: watchdog_dev: include private header to pickup global symbol prototypes

Pull drm fixes from Dave Airlie:
 "Just regular fixes, bunch from intel, quieting some of the over
  zealous power warnings, and the rest just misc.

  I've got another pull with the remaining dma-buf bits, since the vmap
  bits are in your tree now.  I'll send tomorrow just to space things
  out a bit."

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (22 commits)
  drm/edid/quirks: ViewSonic VA2026w
  drm/udl: remove unused variables.
  drm/radeon: fix XFX quirk
  drm: Use stdint types for consistency
  drm: Constify params to format_check() and framebuffer_checks()
  drm/radeon: fix typo in trinity tiling setup
  drm/udl: unlock before returning in udl_gem_mmap()
  radeon: make radeon_cs_update_pages static.
  drm/i915: tune down the noise of the RP irq limit fail
  drm/i915: Remove the error message for unbinding pinned buffers
  drm/i915: Limit page allocations to lowmem (dma32) for i965
  drm/i915: always use RPNSWREQ for turbo change requests
  drm/i915: reject doubleclocked cea modes on dp
  drm/i915: Adding TV Out Missing modes.
  drm/i915: wait for a vblank to pass after tv detect
  drm/i915: no lvds quirk for HP t5740e Thin Client
  drm/i915: enable vdd when switching off the eDP panel
  drm/i915: Fix PCH PLL assertions to not assume CRTC:PLL relationship
  drm/i915: Always update RPS interrupts thresholds along with frequency
  drm/i915: properly handle interlaced bit for sdvo dtd conversion
  ...

Pull block driver updates from Jens Axboe:
 "Here are the driver related changes for 3.5.  It contains:

   - The floppy changes from Jiri.  Jiri is now also marked as the
     maintainer of floppy.c, I shall be publically branding his forehead
     with red hot iron at the next opportune moment.

   - A batch of drbd updates and fixes from the linbit crew, as well as
     fixes from others.

   - Two small fixes for xen-blkfront courtesy of Jan."

* 'for-3.5/drivers' of git://git.kernel.dk/linux-block: (70 commits)
  floppy: take over maintainership
  floppy: remove floppy-specific O_EXCL handling
  floppy: convert to delayed work and single-thread wq
  xen-blkfront: module exit handling adjustments
  xen-blkfront: properly name all devices
  drbd: grammar fix in log message
  drbd: check MODULE for THIS_MODULE
  drbd: Restore the request restart logic
  drbd: introduce a bio_set to allocate housekeeping bios from
  drbd: remove unused define
  drbd: bm_page_async_io: properly initialize page->private
  drbd: use the newly introduced page pool for bitmap IO
  drbd: add page pool to be used for meta data IO
  drbd: allow bitmap to change during writeout from resync_finished
  drbd: fix race between drbdadm invalidate/verify and finishing resync
  drbd: fix resend/resubmit of frozen IO
  drbd: Ensure that data_size is not 0 before using data_size-1 as index
  drbd: Delay/reject other state changes while establishing a connection
  drbd: move put_ldev from __req_mod() to the endio callback
  drbd: fix WRITE_ACKED_BY_PEER_AND_SIS to not set RQ_NET_DONE
  ...

Merge block/IO core bits from Jens Axboe:
 "This is a bit bigger on the core side than usual, but that is purely
  because we decided to hold off on parts of Tejun's submission on 3.4
  to give it a bit more time to simmer.  As a consequence, it's seen a
  long cycle in for-next.

  It contains:

   - Bug fix from Dan, wrong locking type.
   - Relax splice gifting restriction from Eric.
   - A ton of updates from Tejun, primarily for blkcg.  This improves
     the code a lot, making the API nicer and cleaner, and also includes
     fixes for how we handle and tie policies and re-activate on
     switches.  The changes also include generic bug fixes.
   - A simple fix from Vivek, along with a fix for doing proper delayed
     allocation of the blkcg stats."

Fix up annoying conflict just due to different merge resolution in
Documentation/feature-removal-schedule.txt

* 'for-3.5/core' of git://git.kernel.dk/linux-block: (92 commits)
  blkcg: tg_stats_alloc_lock is an irq lock
  vmsplice: relax alignement requirements for SPLICE_F_GIFT
  blkcg: use radix tree to index blkgs from blkcg
  blkcg: fix blkcg->css ref leak in __blkg_lookup_create()
  block: fix elvpriv allocation failure handling
  block: collapse blk_alloc_request() into get_request()
  blkcg: collapse blkcg_policy_ops into blkcg_policy
  blkcg: embed struct blkg_policy_data in policy specific data
  blkcg: mass rename of blkcg API
  blkcg: style cleanups for blk-cgroup.h
  blkcg: remove blkio_group->path[]
  blkcg: blkg_rwstat_read() was missing inline
  blkcg: shoot down blkgs if all policies are deactivated
  blkcg: drop stuff unused after per-queue policy activation update
  blkcg: implement per-queue policy activation
  blkcg: add request_queue->root_blkg
  blkcg: make request_queue bypassing on allocation
  blkcg: make sure blkg_lookup() returns %NULL if @q is bypassing
  blkcg: make blkg_conf_prep() take @pol and return with queue lock held
  blkcg: remove static policy ID enums
  ...

Pull IOMMU updates from Joerg Roedel:
 "Not much stuff this time.  The only change to the IOMMU core code is
  the addition of a handle to the fault handling code.  A few updates to
  the AMD IOMMU driver to work around new errata.  The other patches are
  mostly fixes and enhancements to the existing ARM IOMMU drivers and
  documentation updates.

  A new IOMMU driver for the Exynos platform was also underway but got
  merged via the Samsung tree and is not part of this tree."

* tag 'iommu-updates-v3.5' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  Documentation: kernel-parameters.txt Add amd_iommu_dump
  iommu/core: pass a user-provided token to fault handlers
  iommu/tegra: gart: Fix register offset correctly
  iommu: OMAP: device detach on domain destroy
  iommu: tegra/gart: Add device tree support
  iommu: tegra/gart: use correct gart_device
  iommu/tegra: smmu: Print device name correctly
  iommu/amd: Add workaround for event log erratum
  iommu/amd: Check for the right TLP prefix bit
  dma-debug: release free_entries_lock before saving stack trace

hugetlb_reserve_pages() can be used for either normal file-backed
hugetlbfs mappings, or MAP_HUGETLB.  In the MAP_HUGETLB, semi-anonymous
mode, there is not a VMA around.  The new call to resv_map_put() assumed
that there was, and resulted in a NULL pointer dereference:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
  IP: vma_resv_map+0x9/0x30
  PGD 141453067 PUD 1421e1067 PMD 0
  Oops: 0000 [#1] PREEMPT SMP
  ...
  Pid: 14006, comm: trinity-child6 Not tainted 3.4.0+ #36
  RIP: vma_resv_map+0x9/0x30
  ...
  Process trinity-child6 (pid: 14006, threadinfo ffff8801414e0000, task ffff8801414f26b0)
  Call Trace:
    resv_map_put+0xe/0x40
    hugetlb_reserve_pages+0xa6/0x1d0
    hugetlb_file_setup+0x102/0x2c0
    newseg+0x115/0x360
    ipcget+0x1ce/0x310
    sys_shmget+0x5a/0x60
    system_call_fastpath+0x16/0x1b

This was reported by Dave Jones, but was reproducible with the
libhugetlbfs test cases, so shame on me for not running them in the
first place.

With this, the oops is gone, and the output of libhugetlbfs's
run_tests.py is identical to plain 3.4 again.

[ Marked for stable, since this was introduced by commit c50ac050
  ("hugetlb: fix resv_map leak in error path") which was also marked for
  stable ]
Reported-by: Dave Jones <davej@redhat.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: <stable@vger.kernel.org>        [2.6.32+]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

Merge in these fixlets.
Signed-off-by: Ingo Molnar <mingo@kernel.org>

Add amd_iommu_dump to kernel-parameters.txt
Signed-off-by: Shuah Khan <shuahkhan@gmail.com>
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>

Function pat_pagerange_is_ram() scales poorly to large address
ranges, because it probes the resource tree for each page.

On a 2.6 GHz Opteron, this function consumes 34 ms for a 1 GB range.

It is called twice during untrack_pfn_vma(), slowing process
cleanup and handicapping the OOM killer.

This replacement consumes less than 1ms, under the same conditions.

Signed-off-by: John Dykstra <jdykstra@cray.com> on behalf of Cray Inc.
Acked-by: Suresh Siddha <suresh.b.siddha@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/1337980366.1979.6.camel@redwood
[ Small stylistic cleanups and renames ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>

Since there are uses for I2C_M_NOSTART which are much more sensible and
standard than most of the protocol mangling functionality (the main one
being gather writes to devices where something like a register address
needs to be inserted before a block of data) create a new I2C_FUNC_NOSTART
for this feature and update all the users to use it.

Also strengthen the disrecommendation of the protocol mangling while we're
at it.

In the case of regmap-i2c we remove the requirement for mangling as
I2C_M_NOSTART is the only mangling feature which is being used.
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Wolfram Sang <w.sang@pengutronix.de>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

As the bus driver side implementation of I2C_M_RECV_LEN is heavily
tied to SMBus, we can't support received length over 32 bytes, but
let's at least support that.

In practice, the caller will have to setup a buffer large enough to
cover the case where received length byte has value 32, so minimum
32 + 1 = 33 bytes, possibly more if there is a fixed number of bytes
added for the specific slave (for example a checksum.)
Signed-off-by: Jean Delvare <khali@linux-fr.org>
Tested-by: Douglas Gilbert <dgilbert@interlog.com>

On s390 access_ok is a macro which discards all parameters and always
returns 1. This can result in compile warnings which warn about unused
variables like this:

fs/read_write.c: In function 'rw_copy_check_uvector':
fs/read_write.c:684:16: warning: unused variable 'buf' [-Wunused-variable]

Fix this by adding a __range_ok() function which consumes all parameters
but still always returns 1.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Now that hopefully all cmpxchg/xchg bugs have been fixed select
HAVE_CMPXCHG_LOCAL option which uncovered a couple of bugs on s390.

The only call site which is affected seems to be within mm/vmstat.c.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

For 1 and 2 byte operands for xchg and cmpxchg the old and new values
get or'ed into the larger 4 byte old value before the compare and swap
instruction gets executed. This is done without using the proper byte
mask before or'ing the values.
If the caller passed in negative old or new values these got sign
extended by the caller. Which in turn means that either the old value
never matches, or, even worse, unrelated bytes would be changed in memory.

Luckily there don't seem to be any callers around yet, since that would
have resulted in the specification exception fixed in an earlies patch.
Signed-off-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>