When running the test which causes the race as shown in the previous patch,
we can hit the BUG "get_page() on refcount 0 page" in hugetlb_fault().

This race happens when pte turns into migration entry just after the first
check of is_hugetlb_entry_migration() in hugetlb_fault() passed with false.
To fix this, we need to check pte_present() again after huge_ptep_get().

This patch also reorders taking ptl and doing pte_page(), because
pte_page() should be done in ptl.  Due to this reordering, we need use
trylock_page() in page != pagecache_page case to respect locking order.

Fixes: 66aebce7 ("hugetlb: fix race condition in hugetlb_fault()")
Signed-off-by: NNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: James Hogan <james.hogan@imgtec.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Rik van Riel <riel@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Luiz Capitulino <lcapitulino@redhat.com>
Cc: Nishanth Aravamudan <nacc@linux.vnet.ibm.com>
Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
Cc: Steve Capper <steve.capper@linaro.org>
Cc: <stable@vger.kernel.org>	[3.2+]
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

We have a race condition between move_pages() and freeing hugepages, where
move_pages() calls follow_page(FOLL_GET) for hugepages internally and
tries to get its refcount without preventing concurrent freeing.  This
race crashes the kernel, so this patch fixes it by moving FOLL_GET code
for hugepages into follow_huge_pmd() with taking the page table lock.

This patch intentionally removes page==NULL check after pte_page.
This is justified because pte_page() never returns NULL for any
architectures or configurations.

This patch changes the behavior of follow_huge_pmd() for tail pages and
then tail pages can be pinned/returned.  So the caller must be changed to
properly handle the returned tail pages.

We could have a choice to add the similar locking to
follow_huge_(addr|pud) for consistency, but it's not necessary because
currently these functions don't support FOLL_GET flag, so let's leave it
for future development.

Here is the reproducer:

  $ cat movepages.c
  #include <stdio.h>
  #include <stdlib.h>
  #include <numaif.h>

  #define ADDR_INPUT      0x700000000000UL
  #define HPS             0x200000
  #define PS              0x1000

  int main(int argc, char *argv[]) {
          int i;
          int nr_hp = strtol(argv[1], NULL, 0);
          int nr_p  = nr_hp * HPS / PS;
          int ret;
          void **addrs;
          int *status;
          int *nodes;
          pid_t pid;

          pid = strtol(argv[2], NULL, 0);
          addrs  = malloc(sizeof(char *) * nr_p + 1);
          status = malloc(sizeof(char *) * nr_p + 1);
          nodes  = malloc(sizeof(char *) * nr_p + 1);

          while (1) {
                  for (i = 0; i < nr_p; i++) {
                          addrs[i] = (void *)ADDR_INPUT + i * PS;
                          nodes[i] = 1;
                          status[i] = 0;
                  }
                  ret = numa_move_pages(pid, nr_p, addrs, nodes, status,
                                        MPOL_MF_MOVE_ALL);
                  if (ret == -1)
                          err("move_pages");

                  for (i = 0; i < nr_p; i++) {
                          addrs[i] = (void *)ADDR_INPUT + i * PS;
                          nodes[i] = 0;
                          status[i] = 0;
                  }
                  ret = numa_move_pages(pid, nr_p, addrs, nodes, status,
                                        MPOL_MF_MOVE_ALL);
                  if (ret == -1)
                          err("move_pages");
          }
          return 0;
  }

  $ cat hugepage.c
  #include <stdio.h>
  #include <sys/mman.h>
  #include <string.h>

  #define ADDR_INPUT      0x700000000000UL
  #define HPS             0x200000

  int main(int argc, char *argv[]) {
          int nr_hp = strtol(argv[1], NULL, 0);
          char *p;

          while (1) {
                  p = mmap((void *)ADDR_INPUT, nr_hp * HPS, PROT_READ | PROT_WRITE,
                           MAP_PRIVATE | MAP_ANONYMOUS | MAP_HUGETLB, -1, 0);
                  if (p != (void *)ADDR_INPUT) {
                          perror("mmap");
                          break;
                  }
                  memset(p, 0, nr_hp * HPS);
                  munmap(p, nr_hp * HPS);
          }
  }

  $ sysctl vm.nr_hugepages=40
  $ ./hugepage 10 &
  $ ./movepages 10 $(pgrep -f hugepage)

Fixes: e632a938 ("mm: migrate: add hugepage migration code to move_pages()")
Signed-off-by: NNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Reported-by: NHugh Dickins <hughd@google.com>
Cc: James Hogan <james.hogan@imgtec.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Rik van Riel <riel@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Luiz Capitulino <lcapitulino@redhat.com>
Cc: Nishanth Aravamudan <nacc@linux.vnet.ibm.com>
Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
Cc: Steve Capper <steve.capper@linaro.org>
Cc: <stable@vger.kernel.org>	[3.12+]
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Migrating hugepages and hwpoisoned hugepages are considered as non-present
hugepages, and they are referenced via migration entries and hwpoison
entries in their page table slots.

This behavior causes race condition because pmd_huge() doesn't tell
non-huge pages from migrating/hwpoisoned hugepages.  follow_page_mask() is
one example where the kernel would call follow_page_pte() for such
hugepage while this function is supposed to handle only normal pages.

To avoid this, this patch makes pmd_huge() return true when pmd_none() is
true *and* pmd_present() is false.  We don't have to worry about mixing up
non-present pmd entry with normal pmd (pointing to leaf level pte entry)
because pmd_present() is true in normal pmd.

The same race condition could happen in (x86-specific) gup_pmd_range(),
where this patch simply adds pmd_present() check instead of pmd_huge().
This is because gup_pmd_range() is fast path.  If we have non-present
hugepage in this function, we will go into gup_huge_pmd(), then return 0
at flag mask check, and finally fall back to the slow path.

Fixes: 290408d4 ("hugetlb: hugepage migration core")
Signed-off-by: NNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: James Hogan <james.hogan@imgtec.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Rik van Riel <riel@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Luiz Capitulino <lcapitulino@redhat.com>
Cc: Nishanth Aravamudan <nacc@linux.vnet.ibm.com>
Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
Cc: Steve Capper <steve.capper@linaro.org>
Cc: <stable@vger.kernel.org>	[2.6.36+]
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Currently we have many duplicates in definitions around
follow_huge_addr(), follow_huge_pmd(), and follow_huge_pud(), so this
patch tries to remove the m.  The basic idea is to put the default
implementation for these functions in mm/hugetlb.c as weak symbols
(regardless of CONFIG_ARCH_WANT_GENERAL_HUGETL B), and to implement
arch-specific code only when the arch needs it.

For follow_huge_addr(), only powerpc and ia64 have their own
implementation, and in all other architectures this function just returns
ERR_PTR(-EINVAL).  So this patch sets returning ERR_PTR(-EINVAL) as
default.

As for follow_huge_(pmd|pud)(), if (pmd|pud)_huge() is implemented to
always return 0 in your architecture (like in ia64 or sparc,) it's never
called (the callsite is optimized away) no matter how implemented it is.
So in such architectures, we don't need arch-specific implementation.

In some architecture (like mips, s390 and tile,) their current
arch-specific follow_huge_(pmd|pud)() are effectively identical with the
common code, so this patch lets these architecture use the common code.

One exception is metag, where pmd_huge() could return non-zero but it
expects follow_huge_pmd() to always return NULL.  This means that we need
arch-specific implementation which returns NULL.  This behavior looks
strange to me (because non-zero pmd_huge() implies that the architecture
supports PMD-based hugepage, so follow_huge_pmd() can/should return some
relevant value,) but that's beyond this cleanup patch, so let's keep it.

Justification of non-trivial changes:
- in s390, follow_huge_pmd() checks !MACHINE_HAS_HPAGE at first, and this
  patch removes the check. This is OK because we can assume MACHINE_HAS_HPAGE
  is true when follow_huge_pmd() can be called (note that pmd_huge() has
  the same check and always returns 0 for !MACHINE_HAS_HPAGE.)
- in s390 and mips, we use HPAGE_MASK instead of PMD_MASK as done in common
  code. This patch forces these archs use PMD_MASK, but it's OK because
  they are identical in both archs.
  In s390, both of HPAGE_SHIFT and PMD_SHIFT are 20.
  In mips, HPAGE_SHIFT is defined as (PAGE_SHIFT + PAGE_SHIFT - 3) and
  PMD_SHIFT is define as (PAGE_SHIFT + PAGE_SHIFT + PTE_ORDER - 3), but
  PTE_ORDER is always 0, so these are identical.
Signed-off-by: NNaoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Acked-by: NHugh Dickins <hughd@google.com>
Cc: James Hogan <james.hogan@imgtec.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Rik van Riel <riel@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Luiz Capitulino <lcapitulino@redhat.com>
Cc: Nishanth Aravamudan <nacc@linux.vnet.ibm.com>
Cc: Lee Schermerhorn <lee.schermerhorn@hp.com>
Cc: Steve Capper <steve.capper@linaro.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Kswapd in balance_pgdate() currently uses wake_up() on processes waiting
in throttle_direct_reclaim(), which only wakes up a single process.  This
might leave processes waiting for longer than necessary, until the check
is reached in the next loop iteration.  Processes might also be left
waiting if zone was fully balanced in single iteration.  Note that the
comment in balance_pgdat() also says "Wake them", so waking up a single
process does not seem intentional.

Thus, replace wake_up() with wake_up_all().
Signed-off-by: NVlastimil Babka <vbabka@suse.cz>
Cc: Mel Gorman <mgorman@suse.de>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Vladimir Davydov <vdavydov@parallels.com>
Acked-by: NRik van Riel <riel@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Found it when I want to jump to the definition of MIGRATE_RESERVE ctags.
Signed-off-by: NBaoquan He <bhe@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Now kmemcheck_pagealloc_alloc() is only called by __alloc_pages_slowpath().
__alloc_pages_nodemask()
	__alloc_pages_slowpath()
		kmemcheck_pagealloc_alloc()

And the page will not be tracked by kmemcheck in the following path.
__alloc_pages_nodemask()
	get_page_from_freelist()

So move kmemcheck_pagealloc_alloc() into __alloc_pages_nodemask(),
like this:
__alloc_pages_nodemask()
	...
	get_page_from_freelist()
	if (!page)
		__alloc_pages_slowpath()
	kmemcheck_pagealloc_alloc()
	...
Signed-off-by: NXishi Qiu <qiuxishi@huawei.com>
Cc: Vegard Nossum <vegard.nossum@oracle.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Li Zefan <lizefan@huawei.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

__alloc_pages_nodemask() strips __GFP_IO when retrying the page
allocation.  But it does this by altering the function-wide variable
gfp_mask.  This will cause subsequent allocation attempts to inadvertently
use the modified gfp_mask.

Also, pass the correct mask (the mask we actually used) into
trace_mm_page_alloc().

Cc: Ming Lei <ming.lei@canonical.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: NYasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Cc: David Rientjes <rientjes@google.com>
Acked-by: NVlastimil Babka <vbabka@suse.cz>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The complexity of memcg page stat synchronization is currently leaking
into the callsites, forcing them to keep track of the move_lock state and
the IRQ flags.  Simplify the API by tracking it in the memcg.
Signed-off-by: NJohannes Weiner <hannes@cmpxchg.org>
Acked-by: NMichal Hocko <mhocko@suse.cz>
Reviewed-by: NVladimir Davydov <vdavydov@parallels.com>
Cc: Wu Fengguang <fengguang.wu@intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

The body of this function was removed by commit 0a31bc97 ("mm:
memcontrol: rewrite uncharge API").
Signed-off-by: NVladimir Davydov <vdavydov@parallels.com>
Acked-by: NMichal Hocko <mhocko@suse.cz>
Acked-by: NJohannes Weiner <hannes@cmpxchg.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

OOM killer tries to exclude tasks which do not have mm_struct associated
because killing such a task wouldn't help much.  The OOM victim gets
TIF_MEMDIE set to disable OOM killer while the current victim releases the
memory and then enables the OOM killer again by dropping the flag.

oom_kill_process is currently prone to a race condition when the OOM
victim is already exiting and TIF_MEMDIE is set after the task releases
its address space.  This might theoretically lead to OOM livelock if the
OOM victim blocks on an allocation later during exiting because it
wouldn't kill any other process and the exiting one won't be able to exit.
 The situation is highly unlikely because the OOM victim is expected to
release some memory which should help to sort out OOM situation.

Fix this by checking task->mm and setting TIF_MEMDIE flag under task_lock
which will serialize the OOM killer with exit_mm which sets task->mm to
NULL.  Setting the flag for current is not necessary because check and set
is not racy.
Reported-by: NTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: NMichal Hocko <mhocko@suse.cz>
Cc: David Rientjes <rientjes@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

out_of_memory() doesn't trigger the OOM killer if the current task is
already exiting or it has fatal signals pending, and gives the task
access to memory reserves instead.  However, doing so is wrong if
out_of_memory() is called by an allocation (e.g. from exit_task_work())
after the current task has already released its memory and cleared
TIF_MEMDIE at exit_mm().  If we again set TIF_MEMDIE to post-exit_mm()
current task, the OOM killer will be blocked by the task sitting in the
final schedule() waiting for its parent to reap it.  It will trigger an
OOM livelock if its parent is unable to reap it due to doing an
allocation and waiting for the OOM killer to kill it.
Signed-off-by: NTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: NMichal Hocko <mhocko@suse.cz>
Cc: David Rientjes <rientjes@google.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Add KPF_ZERO_PAGE flag for zero_page, so that userspace processes can
detect zero_page in /proc/kpageflags, and then do memory analysis more
accurately.
Signed-off-by: NYalin Wang <yalin.wang@sonymobile.com>
Acked-by: NKirill A. Shutemov <kirill@shutemov.name>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Add VM_BUG_ON_PAGE() for slab pages.  _mapcount is an union with slab
struct in struct page, so we must avoid accessing _mapcount if this page
is a slab page.  Also remove the unneeded bracket.
Signed-off-by: NYalin Wang <yalin.wang@sonymobile.com>
Acked-by: NKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Currently, we use lru.next/lru.prev plus cast to access or set
destructor and order of compound page.

Let's replace it with explicit fields in struct page.
Signed-off-by: NKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: NJerome Marchand <jmarchan@redhat.com>
Acked-by: NChristoph Lameter <cl@linux.com>
Acked-by: NJohannes Weiner <hannes@cmpxchg.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Pull MMC updates from Ulf Hansson:
 "MMC core:
   - Support for MMC power sequences.
   - SDIO function devicetree subnode parsing.
   - Refactor the hardware reset routines and enable it for SD cards.
   - Various code quality improvements, especially for slot-gpio.

  MMC host:
   - dw_mmc: Various fixes and cleanups.
   - dw_mmc: Convert to mmc_send_tuning().
   - moxart: Fix probe logic.
   - sdhci: Various fixes and cleanups
   - sdhci: Asynchronous request handling support.
   - sdhci-pxav3: Various fixes and cleanups.
   - sdhci-tegra: Fixes for T114, T124 and T132.
   - rtsx: Various fixes and cleanups.
   - rtsx: Support for SDIO.
   - sdhi/tmio: Refactor and cleanup of header files.
   - omap_hsmmc: Use slot-gpio and common MMC DT parser.
   - Make all hosts to deal with errors from mmc_of_parse().
   - sunxi: Various fixes and cleanups.
   - sdhci: Support for Fujitsu SDHCI controller f_sdh30"

* tag 'mmc-v3.20-1' of git://git.linaro.org/people/ulf.hansson/mmc: (117 commits)
  mmc: sdhci-s3c: solve problem with sleeping in atomic context
  mmc: pwrseq: add driver for emmc hardware reset
  mmc: moxart: fix probe logic
  mmc: core: Invoke mmc_pwrseq_post_power_on() prior MMC_POWER_ON state
  mmc: pwrseq_simple: Add optional reference clock support
  mmc: pwrseq: Document optional clock for the simple power sequence
  mmc: pwrseq_simple: Extend to support more pins
  mmc: pwrseq: Document that simple sequence support more than one GPIO
  mmc: Add hardware dependencies for sdhci-pxav3 and sdhci-pxav2
  mmc: sdhci-pxav3: Modify clock settings for the SDR50 and DDR50 modes
  mmc: sdhci-pxav3: Extend binding with SDIO3 conf reg for the Armada 38x
  mmc: sdhci-pxav3: Fix Armada 38x controller's caps according to erratum ERR-7878951
  mmc: sdhci-pxav3: Fix SDR50 and DDR50 capabilities for the Armada 38x flavor
  mmc: sdhci: switch voltage before sdhci_set_ios in runtime resume
  mmc: tegra: Write xfer_mode, CMD regs in together
  mmc: Resolve BKOPS compatability issue
  mmc: sdhci-pxav3: fix setting of pdata->clk_delay_cycles
  mmc: dw_mmc: rockchip: remove incorrect __exit_p()
  mmc: dw_mmc: exynos: remove incorrect __exit_p()
  mmc: Fix menuconfig alignment of MMC_SDHCI_* options
  ...

This one was driving me mad, with several lines of warnings during the
allmodconfig build for a single bogus pointer cast.  The warning was so
verbose due to the indirect macro expansion explanation, and the whole
thing was just for a debug printout.

The bogus pointer-to-integer cast was pointless anyway, so just remove
it, and use '%p' to show the pointer.
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Pull first round of SCSI updates from James Bottomley:
 "This is the usual grab bag of driver updates (hpsa, storvsc, mp2sas,
  megaraid_sas, ses) plus an assortment of minor updates.

  There's also an update to ufs which adds new phy drivers and finally a
  new logging infrastructure for SCSI"

* tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (114 commits)
  scsi_logging: return void for dev_printk() functions
  scsi: print single-character strings with seq_putc
  scsi: merge consecutive seq_puts calls
  scsi: replace seq_printf with seq_puts
  aha152x: replace seq_printf with seq_puts
  advansys: replace seq_printf with seq_puts
  scsi: remove SPRINTF macro
  sg: remove an unused variable
  hpsa: Use local workqueues instead of system workqueues
  hpsa: add in P840ar controller model name
  hpsa: add in gen9 controller model names
  hpsa: detect and report failures changing controller transport modes
  hpsa: shorten the wait for the CISS doorbell mode change ack
  hpsa: refactor duplicated scan completion code into a new routine
  hpsa: move SG descriptor set-up out of hpsa_scatter_gather()
  hpsa: do not use function pointers in fast path command submission
  hpsa: print CDBs instead of kernel virtual addresses for uncommon errors
  hpsa: do not use a void pointer for scsi_cmd field of struct CommandList
  hpsa: return failed from device reset/abort handlers
  hpsa: check for ctlr lockup after command allocation in main io path
  ...

Pull input updates from Dmitry Torokhov:
 "The first round of updates for the input subsystem.

  A few new drivers (power button handler for AXP20x PMIC, tps65218
  power button driver, sun4i keys driver, regulator haptic driver, NI
  Ettus Research USRP E3x0 button, Alwinner A10/A20 PS/2 controller).

  Updates to Synaptics and ALPS touchpad drivers (with more to come
  later), brand new Focaltech PS/2 support, update to Cypress driver to
  handle Gen5 (in addition to Gen3) devices, and number of other fixups
  to various drivers as well as input core"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: (54 commits)
  Input: elan_i2c - fix wrong %p extension
  Input: evdev - do not queue SYN_DROPPED if queue is empty
  Input: gscps2 - fix MODULE_DEVICE_TABLE invocation
  Input: synaptics - use dmax in input_mt_assign_slots
  Input: pxa27x_keypad - remove unnecessary ARM includes
  Input: ti_am335x_tsc - replace delta filtering with median filtering
  ARM: dts: AM335x: Make charge delay a DT parameter for TSC
  Input: ti_am335x_tsc - read charge delay from DT
  Input: ti_am335x_tsc - remove udelay in interrupt handler
  Input: ti_am335x_tsc - interchange touchscreen and ADC steps
  Input: MT - add support for balanced slot assignment
  Input: drv2667 - remove wrong and unneeded drv2667-haptics modalias
  Input: drv260x - remove wrong and unneeded drv260x-haptics modalias
  Input: cap11xx - remove wrong and unneeded cap11xx modalias
  Input: sun4i-ts - add support for touchpanel controller on A31
  Input: serio - add support for Alwinner A10/A20 PS/2 controller
  Input: gtco - use sign_extend32() for sign extension
  Input: elan_i2c - verify firmware signature applying it
  Input: elantech - remove stale comment from Kconfig
  Input: cyapa - off by one in cyapa_update_fw_store()
  ...

Pull fbdev changes from Tomi Valkeinen:

 - omapdss: add DRA7xxx SoC support

 - fbdev: support DMT (Display Monitor Timing) calculation

* tag 'fbdev-3.20' of git://git.kernel.org/pub/scm/linux/kernel/git/tomba/linux: (40 commits)
  omapfb: Return error code when applying overlay settings fails
  OMAPDSS: DPI: DRA7xx support
  OMAPDSS: HDMI: Add DRA7xx support
  OMAPDSS: DISPC: program dispc polarities to control module
  OMAPDSS: DISPC: Add DRA7xx support
  OMAPDSS: Add Video PLLs for DRA7xx
  OMAPDSS: Add functions for external control of PLL
  OMAPDSS: DSS: Add DRA7xx base support
  Doc/DT: Add DT binding doc for DRA7xx DSS
  OMAPDSS: add define for DRA7xx HW version
  OMAPDSS: encoder-tpd12s015: Fix race issue with LS_OE
  OMAPDSS: OMAP5: fix digit output's allowed mgrs
  OMAPDSS: constify port arrays
  OMAPDSS: PLL: add dss_pll_wait_reset_done()
  OMAPDSS: Add enum dss_pll_id
  video: fbdev: fix sys_copyarea
  video/mmpfb: allow modular build
  fb: via: turn gpiolib and i2c selects into dependencies
  fbdev: ssd1307fb: return proper error code if write command fails
  fbdev: fix CVT vertical front and back porch values
  ...

Pull sound updates from Takashi Iwai:
 "In this batch, you can find lots of cleanups through the whole
  subsystem, as our good New Year's resolution.  Lots of LOCs and
  commits are about LINE6 driver that was promoted finally from staging
  tree, and as usual, there've been widely spread ASoC changes.

  Here some highlights:

  ALSA core changes
   - Embedding struct device into ALSA core structures
   - sequencer core cleanups / fixes
   - PCM msbits constraints cleanups / fixes
   - New SNDRV_PCM_TRIGGER_DRAIN command
   - PCM kerneldoc fixes, header cleanups
   - PCM code cleanups using more standard codes
   - Control notification ID fixes

  Driver cleanups
   - Cleanups of PCI PM callbacks
   - Timer helper usages cleanups
   - Simplification (e.g. argument reduction) of many driver codes

  HD-audio
   - Hotkey and LED support on HP laptops with Realtek codecs
   - Dock station support on HP laptops
   - Toshiba Satellite S50D fixup
   - Enhanced wallclock timestamp handling for HD-audio
   - Componentization to simplify the linkage between i915 and hd-audio
     drivers for Intel HDMI/DP

  USB-audio
   - Akai MPC Element support
   - Enhanced timestamp handling

  ASoC
   - Lots of refactoringin ASoC core, moving drivers to more data driven
     initialization and rationalizing a lot of DAPM usage
   - Much improved handling of CDCLK clocks on Samsung I2S controllers
   - Lots of driver specific cleanups and feature improvements
   - CODEC support for TI PCM514x and TLV320AIC3104 devices
   - Board support for Tegra systems with Realtek RT5677
   - New driver for Maxim max98357a
   - More enhancements / fixes for Intel SST driver

  Others
   - Promotion of LINE6 driver from staging along with lots of rewrites
     and cleanups
   - DT support for old non-ASoC atmel driver
   - oxygen cleanups, XIO2001 init, Studio Evolution SE6x support
   - Emu8000 DRAM size detection fix on ISA(!!) AWE64 boards
   - A few more ak411x fixes for ice1724 boards"

* tag 'sound-3.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (542 commits)
  ALSA: line6: toneport: Use explicit type for firmware version
  ALSA: line6: Use explicit type for serial number
  ALSA: line6: Return EIO if read/write not successful
  ALSA: line6: Return error if device not responding
  ALSA: line6: Add delay before reading status
  ASoC: Intel: Clean data after SST fw fetch
  ALSA: hda - Add docking station support for another HP machine
  ALSA: control: fix failure to return new numerical ID in 'replace' event data
  ALSA: usb: update trigger timestamp on first non-zero URB submitted
  ALSA: hda: read trigger_timestamp immediately after starting DMA
  ALSA: pcm: allow for trigger_tstamp snapshot in .trigger
  ALSA: pcm: don't override timestamp unconditionally
  ALSA: off by one bug in snd_riptide_joystick_probe()
  ASoC: rt5670: Set use_single_rw flag for regmap
  ASoC: rt286: Add rt288 codec support
  ASoC: max98357a: Fix build in !CONFIG_OF case
  ASoC: Intel: fix platform_no_drv_owner.cocci warnings
  ARM: dts: Switch Odroid X2/U2 to simple-audio-card
  ARM: dts: Exynos4 and Odroid X2/U3 sound device nodes update
  ALSA: control: fix failure to return numerical ID in 'add' event
  ...

Pull media updates from Mauro Carvalho Chehab:

 - Some documentation updates and a few new pixel formats

 - Stop btcx-risc abuse by cx88 and move it to bt8xx driver

 - New platform driver: am437x

 - New webcam driver: toptek

 - New remote controller hardware protocols added to img-ir driver

 - Removal of a few very old drivers that relies on old kABIs and are
   for very hard to find hardware: parallel port webcam drivers
   (bw-qcam, c-cam, pms and w9966), tlg2300, Video In/Out for SGI (vino)

 - Removal of the USB Telegent driver (tlg2300).  The company that
   developed this driver has long gone and the hardware is hard to find.
   As it relies on a legacy set of kABI symbols and nobody seems to care
   about it, remove it.

 - several improvements at rtl2832 driver

 - conversion on cx28521 and au0828 to use videobuf2 (VB2)

 - several improvements, fixups and board additions

* tag 'media/v3.20-1' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: (321 commits)
  [media] dvb_net: Convert local hex dump to print_hex_dump_debug
  [media] dvb_net: Use standard debugging facilities
  [media] dvb_net: Use vsprintf %pM extension to print Ethernet addresses
  [media] staging: lirc_serial: adjust boolean assignments
  [media] stb0899: use sign_extend32() for sign extension
  [media] si2168: add support for 1.7MHz bandwidth
  [media] si2168: return error if set_frontend is called with invalid parameters
  [media] lirc_dev: avoid potential null-dereference
  [media] mn88472: simplify bandwidth registers setting code
  [media] dvb: tc90522: re-add symbol-rate report
  [media] lmedm04: add read snr, signal strength and ber call backs
  [media] lmedm04: Create frontend call back for read status
  [media] lmedm04: create frontend callbacks for signal/snr/ber/ucblocks
  [media] lmedm04: Fix usb_submit_urb BOGUS urb xfer, pipe 1 != type 3 in interrupt urb
  [media] lmedm04: Increase Interupt due time to 200 msec
  [media] cx88-dvb: whitespace cleanup
  [media] rtl28xxu: properly initialize pdata
  [media] rtl2832: declare functions as static
  [media] rtl2830: declare functions as static
  [media] rtl2832_sdr: add kernel-doc comments for platform_data
  ...

Pull HSI fix from Sebastian Reichel:
 "Fix uninitialized device pointer in nokia-modem"

* tag 'hsi-for-3.20' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi:
  hsi: nokia-modem: fix uninitialized device pointer

Pull power supply and reset changes from Sebastian Reichel:
 "New drivers:
   - charger driver for Maxim 77693
   - battery gauge driver for LTC 2941/2943
   - battery gauge driver for RT5033
   - reset driver for R-Mobile platforms

  Convert drivers to restart handler framework:
   - arm-versatile
   - at91
   - st-poweroff

  Misc:
   - remove deprecated sun6i reboot driver
   - use alarmtimer instead of rtc in charger-manager
   - misc fixes"

* tag 'for-v3.20' of git://git.infradead.org/battery-2.6: (48 commits)
  power_supply: 88pm860x: Fix leaked power supply on probe fail
  power/reset: restart-poweroff: Remove arm dependencies
  power/reset: st-poweroff: Fix misleading Kconfig description
  power/reset: st-poweroff: Register with kernel restart handler
  power/reset: Remove sun6i reboot driver
  power/reset: at91: Register with kernel restart handler
  power/reset: arm-versatile: Register with kernel restart handler
  power: test_power: Use enum as index for array of supplies
  Add devicetree binding documentation for the LTC2941/LTC2943 driver
  Add LTC2941/LTC2943 Battery Gauge Driver
  power/reset: brcmstb: Add support for old 65nm chips
  power/reset: brcmstb: Use the DT "compatible" string to indicate bit positions
  power/reset: brcmstb: Make the driver buildable on MIPS
  power: charger-manager: Use alarmtimer for battery monitoring in suspend.
  power/reset: at91-poweroff: Fix error handling and other compiler warnings
  bq27x00_battery: Call power_supply_changed only when capacity changed
  bq27x00_battery: fix register offset for bq27425
  power: max14577: Remove SYSFS dependency from Kconfig
  power: bq24190_charger: suppress build warning
  power: reset: Add reset driver for R-Mobile platforms
  ...

The firmware version is a single byte so have the variable type agree.
Since the address to this member is passed to the read function, using
an int is not even portable.
Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The serial number (aka ESN) is a 32-bit value.
Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Put an upper bound on how long we will wait for the device to respond to
a read/write request (i.e., 100 milliseconds) and return an error if
this is reached.
Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The device indicates the result of a read/write operation by making the
status available on a subsequent request from the driver.  This is not
ready immediately, though, so the driver is currently slamming the
device with hundreds of pointless requests before getting the expected
response.  Add a two millisecond delay before each attempt.  This is
approximately the behavior observed with version 4.2.7.1 of the Windows
driver.
Signed-off-by: NChris Rorvick <chris@rorvick.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

The BDW audio firmware DSP manages the DMA and the DMA cannot be
stopped exactly at the end of the playback stream. This means
stale samples may be played at PCM stop unless the driver copies
silence to the subsequent periods.
Signed-off-by: NLibin Yang <libin.yang@intel.com>
Reviewed-by: NLiam Girdwood <liam.r.girdwood@linux.intel.com>
Signed-off-by: NTakashi Iwai <tiwai@suse.de>

Pull networking updates from David Miller:

 1) More iov_iter conversion work from Al Viro.

    [ The "crypto: switch af_alg_make_sg() to iov_iter" commit was
      wrong, and this pull actually adds an extra commit on top of the
      branch I'm pulling to fix that up, so that the pre-merge state is
      ok.   - Linus ]

 2) Various optimizations to the ipv4 forwarding information base trie
    lookup implementation.  From Alexander Duyck.

 3) Remove sock_iocb altogether, from CHristoph Hellwig.

 4) Allow congestion control algorithm selection via routing metrics.
    From Daniel Borkmann.

 5) Make ipv4 uncached route list per-cpu, from Eric Dumazet.

 6) Handle rfs hash collisions more gracefully, also from Eric Dumazet.

 7) Add xmit_more support to r8169, e1000, and e1000e drivers.  From
    Florian Westphal.

 8) Transparent Ethernet Bridging support for GRO, from Jesse Gross.

 9) Add BPF packet actions to packet scheduler, from Jiri Pirko.

10) Add support for uniqu flow IDs to openvswitch, from Joe Stringer.

11) New NetCP ethernet driver, from Muralidharan Karicheri and Wingman
    Kwok.

12) More sanely handle out-of-window dupacks, which can result in
    serious ACK storms.  From Neal Cardwell.

13) Various rhashtable bug fixes and enhancements, from Herbert Xu,
    Patrick McHardy, and Thomas Graf.

14) Support xmit_more in be2net, from Sathya Perla.

15) Group Policy extensions for vxlan, from Thomas Graf.

16) Remove Checksum Offload support for vxlan, from Tom Herbert.

17) Like ipv4, support lockless transmit over ipv6 UDP sockets.  From
    Vlad Yasevich.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1494+1 commits)
  crypto: fix af_alg_make_sg() conversion to iov_iter
  ipv4: Namespecify TCP PMTU mechanism
  i40e: Fix for stats init function call in Rx setup
  tcp: don't include Fast Open option in SYN-ACK on pure SYN-data
  openvswitch: Only set TUNNEL_VXLAN_OPT if VXLAN-GBP metadata is set
  ipv6: Make __ipv6_select_ident static
  ipv6: Fix fragment id assignment on LE arches.
  bridge: Fix inability to add non-vlan fdb entry
  net: Mellanox: Delete unnecessary checks before the function call "vunmap"
  cxgb4: Add support in cxgb4 to get expansion rom version via ethtool
  ethtool: rename reserved1 memeber in ethtool_drvinfo for expansion ROM version
  net: dsa: Remove redundant phy_attach()
  IB/mlx4: Reset flow support for IB kernel ULPs
  IB/mlx4: Always use the correct port for mirrored multicast attachments
  net/bonding: Fix potential bad memory access during bonding events
  tipc: remove tipc_snprintf
  tipc: nl compat add noop and remove legacy nl framework
  tipc: convert legacy nl stats show to nl compat
  tipc: convert legacy nl net id get to nl compat
  tipc: convert legacy nl net id set to nl compat
  ...

Commit 1d10eb2f ("crypto: switch af_alg_make_sg() to iov_iter")
broke af_alg_make_sg() and skcipher_recvmsg() in the process of moving
them to the iov_iter interfaces.  The 'npages' calculation in the formar
calculated the number of *bytes* in the pages, and in the latter case
the conversion didn't re-read the value of 'ctx->used' after waiting for
it to become non-zero.

This reverts to the original code for both these cases.

Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: David Miller <davem@davemloft.net>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Pull trivial tree changes from Jiri Kosina:
 "Patches from trivial.git that keep the world turning around.

  Mostly documentation and comment fixes, and a two corner-case code
  fixes from Alan Cox"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial:
  kexec, Kconfig: spell "architecture" properly
  mm: fix cleancache debugfs directory path
  blackfin: mach-common: ints-priority: remove unused function
  doubletalk: probe failure causes OOPS
  ARM: cache-l2x0.c: Make it clear that cache-l2x0 handles L310 cache controller
  msdos_fs.h: fix 'fields' in comment
  scsi: aic7xxx: fix comment
  ARM: l2c: fix comment
  ibmraid: fix writeable attribute with no store method
  dynamic_debug: fix comment
  doc: usbmon: fix spelling s/unpriviledged/unprivileged/
  x86: init_mem_mapping(): use capital BIOS in comment

Pull live patching infrastructure from Jiri Kosina:
 "Let me provide a bit of history first, before describing what is in
  this pile.

  Originally, there was kSplice as a standalone project that implemented
  stop_machine()-based patching for the linux kernel.  This project got
  later acquired, and the current owner is providing live patching as a
  proprietary service, without any intentions to have their
  implementation merged.

  Then, due to rising user/customer demand, both Red Hat and SUSE
  started working on their own implementation (not knowing about each
  other), and announced first versions roughly at the same time [1] [2].

  The principle difference between the two solutions is how they are
  making sure that the patching is performed in a consistent way when it
  comes to different execution threads with respect to the semantic
  nature of the change that is being introduced.

  In a nutshell, kPatch is issuing stop_machine(), then looking at
  stacks of all existing processess, and if it decides that the system
  is in a state that can be patched safely, it proceeds insterting code
  redirection machinery to the patched functions.

  On the other hand, kGraft provides a per-thread consistency during one
  single pass of a process through the kernel and performs a lazy
  contignuous migration of threads from "unpatched" universe to the
  "patched" one at safe checkpoints.

  If interested in a more detailed discussion about the consistency
  models and its possible combinations, please see the thread that
  evolved around [3].

  It pretty quickly became obvious to the interested parties that it's
  absolutely impractical in this case to have several isolated solutions
  for one task to co-exist in the kernel.  During a dedicated Live
  Kernel Patching track at LPC in Dusseldorf, all the interested parties
  sat together and came up with a joint aproach that would work for both
  distro vendors.  Steven Rostedt took notes [4] from this meeting.

  And the foundation for that aproach is what's present in this pull
  request.

  It provides a basic infrastructure for function "live patching" (i.e.
  code redirection), including API for kernel modules containing the
  actual patches, and API/ABI for userspace to be able to operate on the
  patches (look up what patches are applied, enable/disable them, etc).

  It's relatively simple and minimalistic, as it's making use of
  existing kernel infrastructure (namely ftrace) as much as possible.
  It's also self-contained, in a sense that it doesn't hook itself in
  any other kernel subsystem (it doesn't even touch any other code).
  It's now implemented for x86 only as a reference architecture, but
  support for powerpc, s390 and arm is already in the works (adding
  arch-specific support basically boils down to teaching ftrace about
  regs-saving).

  Once this common infrastructure gets merged, both Red Hat and SUSE
  have agreed to immediately start porting their current solutions on
  top of this, abandoning their out-of-tree code.  The plan basically is
  that each patch will be marked by flag(s) that would indicate which
  consistency model it is willing to use (again, the details have been
  sketched out already in the thread at [3]).

  Before this happens, the current codebase can be used to patch a large
  group of secruity/stability problems the patches for which are not too
  complex (in a sense that they don't introduce non-trivial change of
  function's return value semantics, they don't change layout of data
  structures, etc) -- this corresponds to LEAVE_FUNCTION &&
  SWITCH_FUNCTION semantics described at [3].

  This tree has been in linux-next since December.

    [1] https://lkml.org/lkml/2014/4/30/477
    [2] https://lkml.org/lkml/2014/7/14/857
    [3] https://lkml.org/lkml/2014/11/7/354
    [4] http://linuxplumbersconf.org/2014/wp-content/uploads/2014/10/LPC2014_LivePatching.txt

  [ The core code is introduced by the three commits authored by Seth
    Jennings, which got a lot of changes incorporated during numerous
    respins and reviews of the initial implementation.  All the followup
    commits have materialized only after public tree has been created,
    so they were not folded into initial three commits so that the
    public tree doesn't get rebased ]"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/livepatching:
  livepatch: add missing newline to error message
  livepatch: rename config to CONFIG_LIVEPATCH
  livepatch: fix uninitialized return value
  livepatch: support for repatching a function
  livepatch: enforce patch stacking semantics
  livepatch: change ARCH_HAVE_LIVE_PATCHING to HAVE_LIVE_PATCHING
  livepatch: fix deferred module patching order
  livepatch: handle ancient compilers with more grace
  livepatch: kconfig: use bool instead of boolean
  livepatch: samples: fix usage example comments
  livepatch: MAINTAINERS: add git tree location
  livepatch: use FTRACE_OPS_FL_IPMODIFY
  livepatch: move x86 specific ftrace handler code to arch/x86
  livepatch: samples: add sample live patching module
  livepatch: kernel: add support for live patching
  livepatch: kernel: add TAINT_LIVEPATCH

Pull HID updates from Jiri Kosina:
 "Updates for HID code

   - improveements of Logitech HID++ procotol implementation, from
     Benjamin Tissoires

   - support for composite RMI devices, from Andrew Duggan

   - new driver for BETOP controller, from Huang Bo

   - fixup for conflicting mapping in HID core between PC-101/103/104
     and PC-102/105 keyboards from David Herrmann

   - new hardware support and fixes in Wacom driver, from Ping Cheng

   - assorted small fixes and device ID additions all over the place"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid: (33 commits)
  HID: wacom: add support for Cintiq 27QHD and 27QHD touch
  HID: wacom: consolidate input capability settings for pen and touch
  HID: wacom: make sure touch arbitration is applied consistently
  HID: pidff: Fix initialisation forMicrosoft Sidewinder FF Pro 2
  HID: hyperv: match wait_for_completion_timeout return type
  HID: wacom: Report ABS_MISC event for Cintiq Companion Hybrid
  HID: Use Kbuild idiom in Makefiles
  HID: do not bind to Microchip Pick16F1454
  HID: hid-lg4ff: use DEVICE_ATTR_RW macro
  HID: hid-lg4ff: fix sysfs attribute permission
  HID: wacom: peport In Range event according to the spec
  HID: wacom: process invalid Cintiq and Intuos data in wacom_intuos_inout()
  HID: rmi: Add support for the touchpad in the Razer Blade 14 laptop
  HID: rmi: Support touchpads with external buttons
  HID: rmi: Use hid_report_len to compute the size of reports
  HID: logitech-hidpp: store the name of the device in struct hidpp
  HID: microsoft: add support for Japanese Surface Type Cover 3
  HID: fixup the conflicting keyboard mappings quirk
  HID: apple: fix battery support for the 2009 ANSI wireless keyboard
  HID: fix Kconfig text
  ...

Commit 84683a7e ("sata_dwc_460ex: enable COMPILE_TEST for the
driver") enabled this driver for non-ppc460-ex platforms, but it was
then disabled for ARM and ARM64 by commit 2de5a9c0 ("sata_dwc_460ex:
disable compilation on ARM and ARM64") because it's too noisy and
broken.

This disabled is entirely, because it's too noisy on x86-64 too, and
there's no point in disabling architectures one by one.  At a minimum,
the code isn't 64-bit clean, and even on 32-bit it is questionable
whether it makes sense.

Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Merge misc updates from Andrew Morton:
 "Bite-sized chunks this time, to avoid the MTA ratelimiting woes.

   - fs/notify updates

   - ocfs2

   - some of MM"

That laconic "some MM" is mainly the removal of remap_file_pages(),
which is a big simplification of the VM, and which gets rid of a *lot*
of random cruft and special cases because we no longer support the
non-linear mappings that it used.

From a user interface perspective, nothing has changed, because the
remap_file_pages() syscall still exists, it's just done by emulating the
old behavior by creating a lot of individual small mappings instead of
one non-linear one.

The emulation is slower than the old "native" non-linear mappings, but
nobody really uses or cares about remap_file_pages(), and simplifying
the VM is a big advantage.

* emailed patches from Andrew Morton <akpm@linux-foundation.org>: (78 commits)
  memcg: zap memcg_slab_caches and memcg_slab_mutex
  memcg: zap memcg_name argument of memcg_create_kmem_cache
  memcg: zap __memcg_{charge,uncharge}_slab
  mm/page_alloc.c: place zone_id check before VM_BUG_ON_PAGE check
  mm: hugetlb: fix type of hugetlb_treat_as_movable variable
  mm, hugetlb: remove unnecessary lower bound on sysctl handlers"?
  mm: memory: merge shared-writable dirtying branches in do_wp_page()
  mm: memory: remove ->vm_file check on shared writable vmas
  xtensa: drop _PAGE_FILE and pte_file()-related helpers
  x86: drop _PAGE_FILE and pte_file()-related helpers
  unicore32: drop pte_file()-related helpers
  um: drop _PAGE_FILE and pte_file()-related helpers
  tile: drop pte_file()-related helpers
  sparc: drop pte_file()-related helpers
  sh: drop _PAGE_FILE and pte_file()-related helpers
  score: drop _PAGE_FILE and pte_file()-related helpers
  s390: drop pte_file()-related helpers
  parisc: drop _PAGE_FILE and pte_file()-related helpers
  openrisc: drop _PAGE_FILE and pte_file()-related helpers
  nios2: drop _PAGE_FILE and pte_file()-related helpers
  ...

Pull gfs2 updates from Steven Whitehouse:
 "This time we have mostly clean ups.  There is a bug fix for a NULL
  dereference relating to ACLs, and another which improves (but does not
  fix entirely) an allocation fall-back code path.  The other three
  patches are small clean ups"

* tag 'gfs2-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-nmw:
  GFS2: Fix crash during ACL deletion in acl max entry check in gfs2_set_acl()
  GFS2: use __vmalloc GFP_NOFS for fs-related allocations.
  GFS2: Eliminate a nonsense goto
  GFS2: fix sprintf format specifier
  GFS2: Eliminate __gfs2_glock_remove_from_lru

Pull xfs update from Dave Chinner:
 "This update contains:

   - RENAME_EXCHANGE support

   - Rework of the superblock logging infrastructure

   - Rework of the XFS_IOCTL_SETXATTR implementation
       * enables use inside user namespaces
       * fixes inconsistencies setting extent size hints

   - fixes for missing buffer type annotations used in log recovery

   - more consolidation of libxfs headers

   - preparation patches for block based PNFS support

   - miscellaneous bug fixes and cleanups"

* tag 'xfs-for-linus-3.20-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/dgc/linux-xfs: (37 commits)
  xfs: only trace buffer items if they exist
  xfs: report proper f_files in statfs if we overshoot imaxpct
  xfs: fix panic_mask documentation
  xfs: xfs_ioctl_setattr_check_projid can be static
  xfs: growfs should use synchronous transactions
  xfs: fix behaviour of XFS_IOC_FSSETXATTR on directories
  xfs: factor projid hint checking out of xfs_ioctl_setattr
  xfs: factor extsize hint checking out of xfs_ioctl_setattr
  xfs: XFS_IOCTL_SETXATTR can run in user namespaces
  xfs: kill xfs_ioctl_setattr behaviour mask
  xfs: disaggregate xfs_ioctl_setattr
  xfs: factor out xfs_ioctl_setattr transaciton preamble
  xfs: separate xflags from xfs_ioctl_setattr
  xfs: FSX_NONBLOCK is not used
  xfs: don't allocate an ioend for direct I/O completions
  xfs: change kmem_free to use generic kvfree()
  xfs: factor out a xfs_update_prealloc_flags() helper
  xfs: remove incorrect error negation in attr_multi ioctl
  xfs: set superblock buffer type correctly
  xfs: set buf types when converting extent formats
  ...

Pull quota interface unification and misc cleanups from Jan Kara:
 "The first part of the series unifying XFS and VFS quota interfaces.

  This part unifies turning quotas on and off so quota-tools and
  xfs_quota can be used to manage any filesystem.  This is useful so
  that userspace doesn't have to distinguish which filesystem it is
  working with.  As a result we can then easily reuse tests for project
  quotas in XFS for ext4.

  This also contains minor cleanups and fixes for udf, isofs, and ext3"

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: (23 commits)
  udf: remove bool assignment to 0/1
  udf: use bool for done
  quota: Store maximum space limit in bytes
  quota: Remove quota_on_meta callback
  ocfs2: Use generic helpers for quotaon and quotaoff
  ext4: Use generic helpers for quotaon and quotaoff
  quota: Add ->quota_{enable,disable} callbacks for VFS quotas
  quota: Wire up ->quota_{enable,disable} callbacks into Q_QUOTA{ON,OFF}
  quota: Split ->set_xstate callback into two
  xfs: Remove some pointless quota checks
  xfs: Remove some useless flags tests
  xfs: Remove useless test
  quota: Verify flags passed to Q_SETINFO
  quota: Cleanup flags definitions
  ocfs2: Move OLQF_CLEAN flag out of generic quota flags
  quota: Don't store flags for v2 quota format
  jbd: drop jbd_ENOSYS debug
  udf: destroy sbi mutex in put_super
  udf: Check length of extended attributes and allocation descriptors
  udf: Remove repeated loads blocksize
  ...